FINRA Off-Channel Communication Rules, and Why They Are Reaching Smaller Firms

The federal enforcement record makes the trend concrete. The August 2024 round of off-channel settlements reached 26 firms and $390 million, and it extended beyond the largest banks to investment advisers and smaller registrants (SEC Release 2024-144). For FINRA member firms, the underlying obligations sit in rules that have applied all along.

FINRA Rule 4511 is the general books-and-records requirement. It obliges firms to make and preserve the records that FINRA rules and the Exchange Act require, and to preserve them in the format and for the periods specified under SEA Rule 17a-4. In other words, 4511 pulls the SEC’s retention clocks directly into the FINRA rulebook. A business message sent on an unarchived app is a 4511 problem before it is anything else.

FINRA Rule 3110 is the supervision requirement. Rule 3110(b)(4) requires procedures for the review of incoming and outgoing correspondence and internal communications relating to the firm’s securities business. You cannot review what you do not capture, so 3110 and 4511 fail together the moment a channel goes unarchived.

FINRA has been explicit that the channel does not matter: if a communication relates to the firm’s business, the obligation to retain and supervise it applies regardless of the device or application used (Regulatory Notice 17-18). It has also flagged off-channel communications and recordkeeping in its 2024 Annual Regulatory Oversight Report.

Three structural facts put smaller firms in front of this. First, device reality: at a large bank, business happens on managed, captured devices, and personal-phone use is an exception the surveillance team hunts for; at a 40- or 200-person firm, personal devices are often the primary tool and there may be no surveillance team at all. Second, capture reality: enterprise archiving connectors are priced for enterprises, and many smaller firms archive email well while leaving chat and mobile messaging untouched. Third, attention reality: the same person may own compliance, operations, and half the client relationships, so reconciliation of “what we use” against “what we capture” is the task most likely to slip.

The result is a firm that is fully subject to Rules 4511 and 3110 but is meeting them for only one channel. That is precisely the profile the sweep has begun to reach, and it connects directly to our reference on SEC recordkeeping requirements for 2026 and our reporting on incomplete WhatsApp archives.

Write down the approved-channel list, then police it. Rule 3110 expects supervision, not aspiration. A one-page policy that names the channels staff may use for business, and prohibits the rest, is the document an examiner will ask to see, alongside evidence you enforce it.

Close the mobile gap first. If email is archived and mobile messaging is not, mobile is your live exposure. Prioritise capture on the channel where unmanaged personal devices dominate.

Attest, but verify. Annual attestations that “I only use approved channels” are necessary and insufficient. Pair them with at least one technical check, so supervision does not rest on the honour system.

Keep the reconciliation current. The exposure is not a message; it is a channel nobody wired into the archive. Maintain a living map of people, devices, channels, and archive feeds, and review it on a fixed cadence.