What does ESMA's 2024 Sanctions Report Mean for Energy and Commodity Firms?
ESMA publishes report on 2024 EU sanctions highlighting MAR and MiFID enforcement trends - we highlight the implications for energy and commodity traders.
Read the blog
What Is It About
We review the FCA’s findings on off-channel communications, highlighting governance, monitoring, and surveillance practices in wholesale banks, and discusses how energy and commodity firms can benchmark their controls, policies, and vendor oversight to reduce regulatory risk.
Why It's Important
Off-channel communications monitoring pose compliance and market abuse risks and challenge. The FCA stresses board-level accountability, vendor oversight, and robust monitoring. Firms that fail to manage these channels risk breaches, poor MI, and ineffective controls, which can attract regulatory scrutiny.
Key Takeaways
Firms should map activities to channels, enforce clear policies, issue corporate devices, enhance lexicon/NLP surveillance, oversee vendors, track MI trends, and apply consistent consequences. Effective training, self-reporting, and senior management ownership are critical for compliance success.
Thanks for your interest in our content.
Enjoy the read!
Introductions
On 7 August 2025, the FCA published a report (click here) on its findings from a multi-firm review of wholesale banks on their approach to off-channel communications. That is communications which take place outside of monitored and recorded channels which a firm has permitted. The review covered eleven wholesale banks (both large and small) and focused on practical actions firms may take rather than on actual rule changes. Interestingly, the FCA notes that, unlike US regulators, it did not seize or scrutinise personal devices to interrogate them for possible off-channel communications as part of its review.
The FCA reiterated that the core recording obligations sit in SYSC 10A (click here) and were communicated in prior communications such as FCA Market Watch 66 (click here) from January 2011. While SYSC 10A applies to regulated firms carrying out MiFID business, energy and commodity firms that do not have a regulated entity but which trade in the UK will also likely benefit from reviewing the FCA’s findings and, where appropriate, benchmark and enhance their current off-channel communication governance and controls.
In the report, the FCA stresses that firms must record and monitor in-scope communications, including those that lead to in-scope activities, and must take reasonable steps to prevent the use of unrecorded channels. At the same time, it signals that it will continue to take an outcomes-based approach and does not intend to codify rules for every new app or encrypted service in the marketplace.
What were key report findings identified by the FCA?
[1] Off-Channel Communication Governance is making progress but still requires work. All firms in the sample could evidence improvements in managing off-channel communications over the past two years. Yet most still reported breaches of their own internal policies, and these occurred across all staff grades.
Notably, 41% of breaches involved individuals at Director level or above and also included breaches by third party contractors and even interns. The FCA noted that a breach of internal policy is not automatically a breach of FCA rules, and that breach volumes are a somewhat ambiguous signal. High numbers may reflect a functioning detection framework, while low numbers may point to under-detection.
[2] Monitoring Off-Channel Communication is strengthening. Banks are updating monitoring policy terminology to keep pace with devices like smartwatches, streamlining self-disclosure processes, and tightening simple but high-impact practices such as prohibiting personal numbers in out-of-office replies and in company active directories.
Many firms have moved to single global off-channel communication policies to drive consistency, although the FCA reminds firms that UK standards must still be met and that local implementation has to align with those standards. Several banks now provide corporate devices to client-facing staff to reinforce separation of business and personal use, sometimes using distinctive colours for quick identification in sensitive areas like trading floors.
[3] Communication Surveillance tooling is evolving. Firms are expanding lexicons to include emerging channel vernacular, emojis, GIFs, and are surveilling voice notes and even video messages.
Some are integrating natural language processing (NLP) alongside lexicon models to reduce false alerts and to spot “channel hopping” behaviour from recorded to unrecorded platforms. A few banks are monitoring on-channel usage patterns to identify anomalously low activity that may indicate off-channel migration.
Most communication surveillance vendors now offer NLP to enhance lexicon-based surveillance capabilities. Firms like Shield, Behavox, SteelEye, Smarsh, and Global Relay all claim to provide some type of NLP or Artificial Intelligence capability.
For those energy and commodity firms exploring onboarding a communication surveillance vendor, the initial phase of deploying such a tool typically starts by using a baseline lexicon key word and phrases library to identify potential market abuse. While all vendors are promoting and actively pushing firms to adopt AI and NLP, banks are still just dipping their toes into these capabilities. Many energy and commodity firms will be familiar with lexicon surveillance for spot checking communications however with the introduction of AI and NLP, the theory is that more ‘true positives’ are identified while reducing the number of ‘false positives’. In addition, new behaviours and conduct risks that may not be identifiable using lexicons would also be flagged via NLP thus highlighting new risks not found using traditional lexicons.
The jury is still out as to how impactful AI is in communication surveillance. Like any new technology, AI and NLP requires up-front investment in time and training by surveillance analysts to help tune the models to specific firm risks. All vendors provide ‘out of the box’ surveillance policies across e-communication and voice however the ‘secret sauce’ is in the tuning and training / re-training of the surveillance policies once live which requires firms to review and augment their trade surveillance teams and operating models.
The following is a short list of considerations when exploring the onboarding of a communication surveillance vendor with respect to their NLP and AI capabilities:
- Model Detection approach. Are the vendors surveillance policies lexicon rules first, AI first, or a hybrid? Can you see why an alert fired, and can you tune it without a data scientist?
- False positives. What concrete features cut out noise? Contextual NLP, conversation threading, sentiment, entity linking, de-duplication, social media understanding, and behavioral baselines (e.g. low on-channel usage by peer group, unusual time-of-day patterns) are all good indicators to measure in a proof of concept (PoC).
- New behavior risks. Can the system spot channel hopping (i.e. where employees switch from recorded to non-recorded channels), code words, emojis/GIFs, voice notes, and short video? Can it learn from your cases and add scenarios quickly?
- Voice. What is the accuracy of your voice transcription across unique languages and intra-language with specific dialects and/or accents? How does your voice transcription provide and assign speaker diarization e.g. identifying who is speaking? How does your system reduce background noise? Can you transcribe multiple languages including the ability to identify language switching intra-conversation?
- Policy lifecycle. What are your out-of-the-box surveillance policy scenarios? For each policy, do you have vendor release notes that are descriptive in explaining how surveillance is done? How do you perform A/B tests and back tests to ensure policy accuracy and no model drifting? What vendor documentation evidence on AI/NLP policy transparency do you have which can be handed over to both internal parties, for example internal audit or risk and external parties such as regulators or exchanges?
- Operational reality. How do you validate capture completeness by channel? What capabilities do you offer to reconcile data feed from source to system ingestion? How do you manage data recovery and what are your data resilience service level agreements (SLAs) when data is found missing or incomplete? What management information (MI) reports do you provide to monitor and manage data resilience? How are you able to export data to other data models?
Third-party vendors are both enabling and stressing the framework. Banks report the benefits of third-party vendor solutions for capturing a wider set of channels, but also highlight outages, data reconciliation challenges, and inaccurate transcription.
The FCA is direct on accountability noting that firms cannot transfer their regulatory responsibilities under SYSC 10A to service providers. Firms must maintain vendor oversight and ensure data quality controls are in place when data is incomplete or missing.
MI is a key differentiator. The strongest MI suites include:
- Granular breach trend analysis, covering corporate titles, business areas, communication channels and severity gradings;
- Device activation and usage monitoring;
- Vendor KPIs;
- Training and attestation rates; and
- Second-line findings, all presented with clear RAG thresholds and commentary.
Where MI is narrow and breach-only, the FCA observed that oversight committees are stuck reacting to symptoms rather than diagnosing causes. In smaller firms, it noted that the best examples still achieve group-level visibility with UK-specific breakouts and SLA-based alert handling.
Consequence management is visible, but calibration varies. Firms use a spectrum of measures from reminders and refresher training through to formal warnings and impacts on bonuses or promotions where off-channel communications are identified. The review however did not see the most severe penalties applied.
Targeted training that uses real examples, and that promotes self-reporting and speaking up, is becoming increasingly common.
The FCA concludes its report with a set of questions for firms that reinforce expected board-level ownership, senior management accountability, vendor oversight, and alignment of surveillance models to the business as follows:
- Do employees fully understand their responsibility to record all relevant communications?
- Does leadership set a strong 'tone from the top' and encourage a 'speak up' culture for compliance with SYSC 10A?
- Are there any unreasonable barriers preventing staff from following the policy framework effectively?
- Does the firm effectively monitor third-party vendors to ensure expected performance and reliability?
- Is the firm's surveillance model well-aligned with its business model?
- Where a global framework is in place, do UK senior managers have sufficient oversight of its implementation and results?
- Do accountable executives receive the right MI to oversee compliance, and assess surveillance effectiveness?
- Where patterns of non-compliance emerge, do accountable Senior Management Functions (SMFs) take prompt corrective action?
We summarise a list of key findings and dive further into detail alongside compliance considerations below.
Compliance Considerations
We further analyse the FCA report across the following five themes alongside potential compliance considerations against which energy and commodity firms, where appropriate, may wish to benchmark:
- Regulatory scope and expectations under SYSC 10A;
- Governance architecture and policy frameworks;
- Surveillance and analytics;
- Third-party vendors and operational resilience; and
- MI, breach patterns, and consequence management.
[1] Regulatory scope and expectations under SYSC 10A
Off-channel communications risk arises when staff discuss in-scope regulated activities over channels that are not recorded or monitored. SYSC 10A requires firms to record, retain, and monitor electronic and telephone communications related to in-scope activities, including those that lead to such activities, and to take reasonable steps to prevent the use of unapproved channels.
The FCA’s review is does not propose new rules. It restates what good looks like under the existing framework and clarifies its supervisory lens. The regime is activity-based and does not attempt to name or ban each new platform. Discussions that are not about in-scope activities, such as logistics, are outside SYSC 10A. However, repeated breaches of internal policy, especially where senior staff are involved or where trends worsen, may still trigger supervisory attention.
Key themes
- Outcomes over prescriptions. By declining to write channel-specific regulatory rules, the FCA keeps the onus on firms to map activities to communication channels and to show that controls are effective across a dynamically changing landscape. This mirrors the MiFID II approach that focuses on records of transactions and communications relevant to transactions rather than named tools. It also aligns with the principles of proportionality and materiality used across UK regulation.
- Evidence standards. The FCA’s use of firm-submitted data and its decision not to collect personal devices in this exercise does not limit future supervisory or enforcement actions. For Compliance, Senior Management, and Boards, firms should be able to evidence the mapping of business activities to channels, the rationale for what communication channels are permitted, the controls that prevent leakage to unrecorded platforms, and the MI that proves those controls are working.
Compliance Considerations
- Refresh communication channel mapping at least annually or when the business launches new products or coverage models. Ensure clear documentation for business rationale and coordinate with IT to ensure the appropriate technology controls and governance are in place both internally and with your third party surveillance vendor.
- Embed an ‘outcomes focus’ lens when implementing policies and attestations for new application. When a new communication app appears, ensure appropriate documentation and analysis outlining whether it can carry in-scope business content and, if so, how your firm will capture and monitor it.
[2] Governance architecture and policy frameworks
Governance architecture covers policy design, ownership, device strategy, self-disclosure processes, and the practical aids that make compliant behaviour easy and non-compliance harder.
The review shows many banks have:
- Consolidated monitoring policies into a single, global policy across all jurisdictions;
- Tightened policy language to include new technologies such as wearable tech, e.g. smart watches;
- Streamlined contingency plans to record and archive communications when primary systems are down;
- Simplified self-disclosure channels for off-channel communications; and
- Removed unnecessary traps such as listing personal numbers in automated replies or in company directories.
Some have introduced dedicated helplines to guide staff and have embedded common queries into training. Corporate device strategies are now common for client-facing teams, with visible identifiers to help floor monitors. These are classic “prevention beats detection” controls, and they are readily auditable.
Key Themes
- Global policy, local accountability. The FCA notes that while consolidated policies reduce fragmentation and help international businesses align their standards they still carry a governance duty for UK senior manager functions (SMFs) to demonstrate that they understand local gaps, have requested exceptions where needed, and can evidence outcomes in the UK legal and market context. The review explicitly flags the need for UK standards and alignment in any global policy implementation.
- Device strategy as a control. The FCA notes that many banks prefer issuing corporate devices to high-risk populations as it narrows the number of channels that a trader may be able to access and use for business purposes while simplifying the capture and monitoring of business communications (versus via personal devices). One strategy noted in the report was the use of distinctive colours as a simple but effective tool for physical supervision on trading floors. In terms of allocation, the FCA noted that banks used a risk-based approach which prioritised client-facing and transactional roles which was consistent with proportionality and second-line testing methods.
Most firms in our sample were providing corporate devices to client-facing staff to reinforce the separation of work-related and personal activities, though this is not required under our rules. Some firms used brightly coloured devices for easy identification, particularly in restricted areas like trading floors. Surveillance managers we spoke to favoured corporate devices, citing improved monitoring, recording, and control as well as the expectation it sets among staff. While some firms offered them broadly, others limited them to specific client-facing or transactional-facing staff.
- Self-disclosure, helplines, and tailored training. The FCA highlighted banks who streamlined processes and created ‘speak up’ helplines to guide staff on off-channel communications, streamline processes for self-reporting, and tailor training content using common off-channel communication queries. The FCA also stressed that boards should ask for metrics on self-disclosures and track whether they are rising after training campaigns, which would indicate trust in the process.
Compliance Considerations
- Firms with a global communications policy and trading in the UK, should ensure global policy alignment with UK regulatory requirements including SYSC 10A and Market Watch 66.
- Maintain a written device strategy that explains populations in scope, issuance criteria, and controls for bring your own device (BYOD) or Corporate Device activation, usage monitoring, and de-provisioning. Reconcile JML (joiners, movers, leavers) from HR database to Mobile Device population to ensure correct mobile communication applications are provisioned.
- Build a standard operating procedure for self-disclosure including subsequent investigation approach by communication channel, findings dissemination, and related feedback to staff including follow-on training. For MI purposes, build a dashboard that can track self-reported volumes, investigation cycle times, and outcomes.
[3] Surveillance and analytics
Surveillance covers the detection logic, data capture, and review processes that identify in-scope communications, risky patterns, and evasive behaviour across text, audio, and video.
Banks are expanding beyond classic lexicons. The best programmes capture the language and artefacts of modern messaging, from emojis to GIFs, and cover voice notes and videos. NLP is being layered in to reduce false positives and to parse context. The FCA noted that some firms track on-channel usage to identify who is sending suspiciously few messages on a given communication platform compared to peers, which can be a strong indicator of off-channel diversion. ‘Channel hopping’ is now a defined surveillance risk and is being built into models.
Key Themes
- Modernising lexicons. The FCA observed firms updating their lexicons to include emojis and GIFs. These artefacts often carry trading intent or confirmations in compressed form. Surveillance libraries that treat them as lexicons and map them to intent categories improve both recall and precision.
- Hybrid Surveillance models - Lexicon and NLP. Many banks are incorporating hybrid surveillance techniques combining lexicons with NLP to filter out false positives. This combination aligns with model risk management principles, i.e. start with transparent rules, then layer in models that can be explained and validated and which are well suited to auditability while avoiding black-box dependence.
- Behavioural analytics. The FCA notes that two firms are monitoring unexpectedly low usage of approved apps across peer groups as a proxy for off-channel leakage. It mirrors surveillance concepts used in trade supervision, such as identifying “quiet traders” around key events.
- Role-based device deployment via Corp Issued Mobile Devices. The FCA noted that corporate devices remain favoured by surveillance managers. They make capture and control simpler and set expectations for staff. Some firms deploy them broadly while others focus on client-facing or transactional roles. Whatever the model, the surveillance approach must align to the business model, which the FCA names as a board-level question.
Compliance Considerations
- Review existing surveillance lexicon library and where appropriate update it to include emoji’s, GIF mappings, and voice and video specific terms (where appropriate).
- Review change control procedures in terms of cadence to update lexicons and business rationale. For example, holding a monthly Compliance meeting where analysts and Compliance management review monthly alerts, and decide and document what changes they will make to lexicons.
- Implement second-line model governance for any NLP or AI policy used in alerting, including validation, explainability notes, back-testing, and periodic bias checks.
- Add behavioural metrics such as relative on-channel usage, device activation gaps, and sudden drops in activity to MI packs provided to senior management.
[4] Third-party vendors (TPV) and operational resilience
Vendor risk in communications surveillance spans capture, storage, transcription, reconciliation, and retrieval. It touches technology resilience, data quality, contractual controls, and regulatory accountability.
More vendors are offering capture and monitoring of a wider channel set, which helps firms meet coverage obligations. But the review surfaces real issues including service outages and data reconciliation problems that call into question whether the right communications were captured, delayed, missing or even accurate, for example voice transcription. The FCA stressed that firms cannot transfer SYSC 10A responsibilities to third parties. Vendor KPIs, resilience testing, and oversight must be strong enough to detect and correct service quality failures.
Some firms reported challenges with TPV solutions, including service outages that disrupted recording and monitoring, data reconciliation issues that made it difficult for firms to validate that the right communications had been captured at all times to validate captured communications, and delays or missing recorded data from vendors.
TPVs do not always perform as expected… Poor service can also discourage employees from using recorded channels, reinforcing the need for firms to maintain strong oversight of their vendors and the quality of their services.
We also remind firms that regulatory responsibilities in relation to SYSC 10A cannot be transferred to third parties.
Key Themes
- Operational resilience – Data Outages. Outages in capture services directly impair recordkeeping. Firms should treat vendor downtime as an operational disruption under their resilience frameworks, with impact tolerances, user communications, and data remediation procedures. The FCA review noted firms that built contingency plans to record and archive communications when primary systems were down.
- Data reconciliation and completeness. Where reconciliation is weak, firms cannot evidence completeness of records. Completeness is at the heart of SYSC 10A and is key to litigation readiness. The FCA points to data reconciliation issues and delays or missing data noting that firms should have a reconciler role that checks channel-by-channel capture volumes against reference data, with exception management to mitigate gaps in data feeds including replaying of data and re-running of surveillance policies.
- Voice Transcription accuracy. Inaccurate voice transcription undermines surveillance quality and investigations. The FCA mentions one vendor service whose transcription was largely inaccurate which discouraged the use of voice as a recorded channel. The behavioural knock-on effect of poor-quality transcription and a firm’s inability to capture voice accurately can provide an incentive for traders to go off-channel since the preferred communication channel (voice) is not an approved channel due to inaccurate transcription.
- Accountability and contracts. The FCA reminds firms that regulatory responsibility cannot be transferred. Vendor contracts should reflect that with audit rights, service level remedies, data access obligations, incident reporting timelines, and termination triggers tied to material defects in capture or retrieval. Vendor KPIs should sit in MI packs that go to senior oversight committees.
Compliance Considerations
- Simulate vendor data outtages at least annually. Include user guidance during outages, manual capture alternatives, and post-incident reconciliation to prove completeness.
- Track vendor KPIs in board MI. Capture success rates by channel, reconciliation exceptions, transcription accuracy, latency from event to availability, and incident response timelines.
- Perform independent quality reviews of voice transcripts and retrievals. Feed defects into both vendor remediation and internal training.
[5] MI, breach patterns, and consequence management
MI is the overarching data that that shows whether the off-channel communication governance framework works in practice. Breach management and disciplinary responses test whether governance has teeth and whether internal culture supports compliance.
The FCA noted that the best MI suites in large firms included detailed breach tracking by title, business area, channel, and severity, progress on remediation projects and second-line findings, framework effectiveness measures such as training completion and alert disposition rates, vendor KPIs, device and BYOD monitoring, and trend analysis with RAG thresholds and commentary.
In weaker MI packs, breach counts appear without context, which limits oversight committees to reactive discussions. Smaller firms can still produce strong MI by reporting at group level, adding UK-specific metrics, tracking SLAs for alert reviews, and reporting trends in alerts and investigations.
The most comprehensive MI in large firms included:
- Detailed breach tracking, covering corporate titles, business areas, communication channels and severity gradings.
- Remedial project updates, including adverse audits and second line of defence (2LOD) findings for executive oversight.
- Framework effectiveness assessment, with attestation and training completion rates, plus surveillance alert disposition rates.
- Third-party vendor KPIs, used for assurance or identifying service gaps.
- Corporate device and BYOD monitoring that tracked activation and usage to detect potential non-compliance.
- Trend analysis, metrics which tracked across months or quarters using well-considered RAG thresholds, with accompanied commentary on negative trends.
- Meeting minutes reviewed by the FCA showed that comprehensive MI contributed to fuller discussions.
The most comprehensive MI in smaller firms included:
- Breach data was reported at the group level, with the best examples including UK-specific metrics.
- SLAs for reviewing alerts were monitored using red, amber, green (RAG) thresholds, and trend analysis was conducted for alert and investigation volumes.
- Issues and enhancement programme updates were tracked with regular progress reports.
Key Themes
- Interpreting breach data. Eight firms disclosed 178 breaches in the prior 12 months, while three firms reported none. 41% percent involved director-grade or above. The FCA cautioned that counts are not clean signals of breaching FCA rules. High counts may mean detection works, whereas low counts may signal under-dection and reporting. Overall, the FCA suggests that boards should review breach data based on time-series, population-adjusted rates, with triangulation by device usage, channel activation, and self-reporting volumes.
- Linking MI to action. The FCA noted that meeting minutes with comprehensive MI supported fuller discussions. MI should guide action including tightening device issuance, tuning lexicons, upgrading vendors, or launching targeted training and consequence campaigns.
- Consequence management. Firms reported a range of measures from reminders and refresher training to caution letters, formal warnings, performance impacts, and for serious cases, limits on bonuses and promotions or dismissal with references noting the reason. Training is being sharpened through role-based scenarios and real surveillance examples, with emphasis on self-reporting and speaking up.
Training played a key role in reinforcing expectations. Some firms emphasised in the training self-reporting and speaking up about off-channel communications. Role-targeted, scenario-based sessions incorporated real examples from surveillance to make training more effective.
Compliance Considerations
- Upgrade MI to prove effectiveness of off-channel communication governance, not just actual surveillance activity. Incorporate breach data with control health indicators and behavioural metrics, and present trends with thresholds and narrative to senior management.
- Calibrate discipline and explain it. Staff need to see consistent, fair application across grades. Track discipline outcomes and include in annual reviews to support deterrence and fairness while also publicising where appropriate to the wider monitored community through formal communications or training.
- Treat training as a change lever. Review current off-channel communication training and revise where appropriate. Use examples from your own surveillance, keep training sessions role-specific, and measure impact on self-disclosure and on-channel usage.
Want to read more?
Request a Demo
Take a short tour of the RegTrail Insights Platform with a free trial for a limited time.