We review the FCA’s findings on off-channel communications, highlighting governance, monitoring, and surveillance practices in wholesale banks, and discusses how energy and commodity firms can benchmark their controls, policies, and vendor oversight to reduce regulatory risk.
Off-channel communications monitoring pose compliance and market abuse risks and challenge. The FCA stresses board-level accountability, vendor oversight, and robust monitoring. Firms that fail to manage these channels risk breaches, poor MI, and ineffective controls, which can attract regulatory scrutiny.
Firms should map activities to channels, enforce clear policies, issue corporate devices, enhance lexicon/NLP surveillance, oversee vendors, track MI trends, and apply consistent consequences. Effective training, self-reporting, and senior management ownership are critical for compliance success.
On 7 August 2025, the FCA published a report (click here) on its findings from a multi-firm review of wholesale banks on their approach to off-channel communications. That is communications which take place outside of monitored and recorded channels which a firm has permitted. The review covered eleven wholesale banks (both large and small) and focused on practical actions firms may take rather than on actual rule changes. Interestingly, the FCA notes that, unlike US regulators, it did not seize or scrutinise personal devices to interrogate them for possible off-channel communications as part of its review.
The FCA reiterated that the core recording obligations sit in SYSC 10A (click here) and were communicated in prior communications such as FCA Market Watch 66 (click here) from January 2011. While SYSC 10A applies to regulated firms carrying out MiFID business, energy and commodity firms that do not have a regulated entity but which trade in the UK will also likely benefit from reviewing the FCA’s findings and, where appropriate, benchmark and enhance their current off-channel communication governance and controls.
In the report, the FCA stresses that firms must record and monitor in-scope communications, including those that lead to in-scope activities, and must take reasonable steps to prevent the use of unrecorded channels. At the same time, it signals that it will continue to take an outcomes-based approach and does not intend to codify rules for every new app or encrypted service in the marketplace.
What were key report findings identified by the FCA?
[1] Off-Channel Communication Governance is making progress but still requires work. All firms in the sample could evidence improvements in managing off-channel communications over the past two years. Yet most still reported breaches of their own internal policies, and these occurred across all staff grades.
Notably, 41% of breaches involved individuals at Director level or above and also included breaches by third party contractors and even interns. The FCA noted that a breach of internal policy is not automatically a breach of FCA rules, and that breach volumes are a somewhat ambiguous signal. High numbers may reflect a functioning detection framework, while low numbers may point to under-detection.
[2] Monitoring Off-Channel Communication is strengthening. Banks are updating monitoring policy terminology to keep pace with devices like smartwatches, streamlining self-disclosure processes, and tightening simple but high-impact practices such as prohibiting personal numbers in out-of-office replies and in company active directories.
Many firms have moved to single global off-channel communication policies to drive consistency, although the FCA reminds firms that UK standards must still be met and that local implementation has to align with those standards. Several banks now provide corporate devices to client-facing staff to reinforce separation of business and personal use, sometimes using distinctive colours for quick identification in sensitive areas like trading floors.
[3] Communication Surveillance tooling is evolving. Firms are expanding lexicons to include emerging channel vernacular, emojis, GIFs, and are surveilling voice notes and even video messages.
Some are integrating natural language processing (NLP) alongside lexicon models to reduce false alerts and to spot “channel hopping” behaviour from recorded to unrecorded platforms. A few banks are monitoring on-channel usage patterns to identify anomalously low activity that may indicate off-channel migration.
Most communication surveillance vendors now offer NLP to enhance lexicon-based surveillance capabilities. Firms like Shield, Behavox, SteelEye, Smarsh, and Global Relay all claim to provide some type of NLP or Artificial Intelligence capability.
For those energy and commodity firms exploring onboarding a communication surveillance vendor, the initial phase of deploying such a tool typically starts by using a baseline lexicon key word and phrases library to identify potential market abuse. While all vendors are promoting and actively pushing firms to adopt AI and NLP, banks are still just dipping their toes into these capabilities. Many energy and commodity firms will be familiar with lexicon surveillance for spot checking communications however with the introduction of AI and NLP, the theory is that more ‘true positives’ are identified while reducing the number of ‘false positives’. In addition, new behaviours and conduct risks that may not be identifiable using lexicons would also be flagged via NLP thus highlighting new risks not found using traditional lexicons.
The jury is still out as to how impactful AI is in communication surveillance. Like any new technology, AI and NLP requires up-front investment in time and training by surveillance analysts to help tune the models to specific firm risks. All vendors provide ‘out of the box’ surveillance policies across e-communication and voice however the ‘secret sauce’ is in the tuning and training / re-training of the surveillance policies once live which requires firms to review and augment their trade surveillance teams and operating models.
The following is a short list of considerations when exploring the onboarding of a communication surveillance vendor with respect to their NLP and AI capabilities:
Third-party vendors are both enabling and stressing the framework. Banks report the benefits of third-party vendor solutions for capturing a wider set of channels, but also highlight outages, data reconciliation challenges, and inaccurate transcription.
The FCA is direct on accountability noting that firms cannot transfer their regulatory responsibilities under SYSC 10A to service providers. Firms must maintain vendor oversight and ensure data quality controls are in place when data is incomplete or missing.
MI is a key differentiator. The strongest MI suites include:
Where MI is narrow and breach-only, the FCA observed that oversight committees are stuck reacting to symptoms rather than diagnosing causes. In smaller firms, it noted that the best examples still achieve group-level visibility with UK-specific breakouts and SLA-based alert handling.
Consequence management is visible, but calibration varies. Firms use a spectrum of measures from reminders and refresher training through to formal warnings and impacts on bonuses or promotions where off-channel communications are identified. The review however did not see the most severe penalties applied.
Targeted training that uses real examples, and that promotes self-reporting and speaking up, is becoming increasingly common.
The FCA concludes its report with a set of questions for firms that reinforce expected board-level ownership, senior management accountability, vendor oversight, and alignment of surveillance models to the business as follows:
We summarise a list of key findings and dive further into detail alongside compliance considerations below.
We further analyse the FCA report across the following five themes alongside potential compliance considerations against which energy and commodity firms, where appropriate, may wish to benchmark:
[1] Regulatory scope and expectations under SYSC 10A
Off-channel communications risk arises when staff discuss in-scope regulated activities over channels that are not recorded or monitored. SYSC 10A requires firms to record, retain, and monitor electronic and telephone communications related to in-scope activities, including those that lead to such activities, and to take reasonable steps to prevent the use of unapproved channels.
The FCA’s review is does not propose new rules. It restates what good looks like under the existing framework and clarifies its supervisory lens. The regime is activity-based and does not attempt to name or ban each new platform. Discussions that are not about in-scope activities, such as logistics, are outside SYSC 10A. However, repeated breaches of internal policy, especially where senior staff are involved or where trends worsen, may still trigger supervisory attention.
Key themes
Compliance Considerations
[2] Governance architecture and policy frameworks
Governance architecture covers policy design, ownership, device strategy, self-disclosure processes, and the practical aids that make compliant behaviour easy and non-compliance harder.
The review shows many banks have:
Some have introduced dedicated helplines to guide staff and have embedded common queries into training. Corporate device strategies are now common for client-facing teams, with visible identifiers to help floor monitors. These are classic “prevention beats detection” controls, and they are readily auditable.
Key Themes
Most firms in our sample were providing corporate devices to client-facing staff to reinforce the separation of work-related and personal activities, though this is not required under our rules. Some firms used brightly coloured devices for easy identification, particularly in restricted areas like trading floors. Surveillance managers we spoke to favoured corporate devices, citing improved monitoring, recording, and control as well as the expectation it sets among staff. While some firms offered them broadly, others limited them to specific client-facing or transactional-facing staff.
Compliance Considerations
[3] Surveillance and analytics
Surveillance covers the detection logic, data capture, and review processes that identify in-scope communications, risky patterns, and evasive behaviour across text, audio, and video.
Banks are expanding beyond classic lexicons. The best programmes capture the language and artefacts of modern messaging, from emojis to GIFs, and cover voice notes and videos. NLP is being layered in to reduce false positives and to parse context. The FCA noted that some firms track on-channel usage to identify who is sending suspiciously few messages on a given communication platform compared to peers, which can be a strong indicator of off-channel diversion. ‘Channel hopping’ is now a defined surveillance risk and is being built into models.
Key Themes
Compliance Considerations
[4] Third-party vendors (TPV) and operational resilience
Vendor risk in communications surveillance spans capture, storage, transcription, reconciliation, and retrieval. It touches technology resilience, data quality, contractual controls, and regulatory accountability.
More vendors are offering capture and monitoring of a wider channel set, which helps firms meet coverage obligations. But the review surfaces real issues including service outages and data reconciliation problems that call into question whether the right communications were captured, delayed, missing or even accurate, for example voice transcription. The FCA stressed that firms cannot transfer SYSC 10A responsibilities to third parties. Vendor KPIs, resilience testing, and oversight must be strong enough to detect and correct service quality failures.
Some firms reported challenges with TPV solutions, including service outages that disrupted recording and monitoring, data reconciliation issues that made it difficult for firms to validate that the right communications had been captured at all times to validate captured communications, and delays or missing recorded data from vendors.
TPVs do not always perform as expected… Poor service can also discourage employees from using recorded channels, reinforcing the need for firms to maintain strong oversight of their vendors and the quality of their services.
We also remind firms that regulatory responsibilities in relation to SYSC 10A cannot be transferred to third parties.
Key Themes
Compliance Considerations
[5] MI, breach patterns, and consequence management
MI is the overarching data that that shows whether the off-channel communication governance framework works in practice. Breach management and disciplinary responses test whether governance has teeth and whether internal culture supports compliance.
The FCA noted that the best MI suites in large firms included detailed breach tracking by title, business area, channel, and severity, progress on remediation projects and second-line findings, framework effectiveness measures such as training completion and alert disposition rates, vendor KPIs, device and BYOD monitoring, and trend analysis with RAG thresholds and commentary.
In weaker MI packs, breach counts appear without context, which limits oversight committees to reactive discussions. Smaller firms can still produce strong MI by reporting at group level, adding UK-specific metrics, tracking SLAs for alert reviews, and reporting trends in alerts and investigations.
The most comprehensive MI in large firms included:
The most comprehensive MI in smaller firms included:
Key Themes
Training played a key role in reinforcing expectations. Some firms emphasised in the training self-reporting and speaking up about off-channel communications. Role-targeted, scenario-based sessions incorporated real examples from surveillance to make training more effective.
Compliance Considerations
Take a short tour of the RegTrail Insights Platform with a free trial for a limited time.
