Off-channel Communications

Halloran Securities exchanges roughly 90,000 emails a month between its representatives and customers. Its written supervisory procedures call for automated lexicon screening of every message plus a documented random sample pulled for principal review, rather than a human reading each one. Under FINRA Rule 3110, is this approach acceptable?

1. A.No. Every outgoing email to a customer is a retail communication and must be approved by a principal before it is sentIndividual emails to customers are correspondence when they reach 25 or fewer retail investors in 30 days, and correspondence is subject to supervision and review, not pre-use approval.
2. B.Yes. A risk-based method such as lexicon screening plus documented sampling satisfies the rule if it is reasonably designed and the firm evidences the reviews it performedCorrect. The rule demands reasonably designed review procedures and documentation, not message-by-message reading.
3. C.No. A registered principal must review and evidence review of every incoming and outgoing customer emailThis is the common misreading. Review of all correspondence must be provided for by the procedures, but the rule permits risk-based methods rather than universal individual review.
4. D.Yes, but only for internal communications. Messages to and from customers must each be reviewed individuallyThe rule draws no such line. Risk-based review is available for correspondence with customers as well as internal communications.

Why: Rule 3110 requires procedures for reviewing incoming and outgoing correspondence and internal communications relating to the member's securities business, but it does not require a principal to read every message. FINRA expressly contemplates a risk-based approach: lexicon or keyword screening, sampling, and escalation criteria are all acceptable so long as the method is reasonably designed for the firm's business and the firm documents both the procedures and the reviews actually performed.

Compliance at Fenwick Securities discovers that several representatives have been discussing recommendations and order instructions with customers by text message on their personal mobile phones, entirely outside the firm's monitored messaging platform. What is the firm's obligation?

1. A.Business-related electronic communications are firm records regardless of device or application, so Fenwick must capture, supervise and retain them; permitting unmonitored off-channel messaging violates the supervision and recordkeeping rules.Correct. Content, not the device, determines record status, and the firm owes both supervision and preservation.
2. B.Communications sent from personal devices are outside the firm's responsibility so long as the firm did not issue the phone.Wrong. Device ownership does not determine whether a business communication is a firm record.
3. C.Only messages sent to more than 25 retail investors within 30 days must be retained; individual texts fall below that threshold.Wrong. That threshold distinguishes correspondence from retail communications for approval and filing; retention applies to both.
4. D.Texting customers is permissible provided each representative submits a monthly written summary of the conversations to a principal.Wrong. A summary is neither capture nor preservation of the actual communications the rules require.

Why: Whether a communication is a firm record depends on its content, not on the device, application or account used to send it. Business-related electronic communications with the public must be supervised under FINRA's supervision rules and preserved under the SEC's books and records rules. A firm that allows representatives to conduct business on channels it cannot review or retain has failed on both counts, which is why firms either prohibit off-channel messaging outright or deploy an archiving solution and train and surveil against it.