Unfortunately, your compliance defences are only as strong as your weakest channel

At Touch, we cover more than 60 of these, so we understand the complex landscape that many of you must maintain.

The problem is “recording everything” and “having a bullet-proof compliance record” are unfortunately not necessarily the same thing. In today’s market the question for you and your compliance team isn’t whether you’re recording calls, but whether you can demonstrate a coherent, channel-agnostic record of regulated communications, if required to do so. Let’s see what that means for you as an organisation.

The regulators expect you to stop things happening on private equipment

Really, it comes down to internal action. Compliance teams have spent years building sophisticated systems around voice recording, recording calls, retaining them, making them searchable and monitoring them.

As a result, a regulated organisation in, say, financial services or healthcare, may have excellent call recording, retention and monitoring processes. But none of that matters if employees conduct business through channels that sit outside the same compliance framework (think mobile messaging, collaboration platforms, video meetings, personal devices or emerging AI-enabled communications).

If a conversation with a client no longer starts on the recorded telephone system but goes to mobile, video, and so on, it may escape you. But the regulators still say that’s your problem: to take just one jurisdiction, the FCA's SYSC 10A rules require firms to take “reasonable steps to record relevant telephone conversations and retain copies of relevant electronic communications”—while also requiring firms to prevent relevant communications being conducted on private equipment that the firm cannot record or copy.

It’s very easy, then, to fall into the trap of not seeing that “We record all our telephone calls” is not the same as being able to say to a regulator or your own C-Suite that "We can identify, capture, retain, retrieve and supervise relevant communications wherever they occur.”

Regulators know this isn’t easy and are open to revising their rules (see last year’s FINRA's 2025 Regulatory Notice 25-07, for instance). But in the meantime, they can be pretty savage about punishing breaches: in 2024 alone, the SEC said its recordkeeping cases resulted in more than $600 million in civil penalties against more than 70 firms, part of a wider picture of charges against more than 100 firms and more than $2 billion in penalties since December 2021.

In 2023, meanwhile, it came down hard on 11 Wall Street firms where it said employees had used personal devices and applications, including iMessage, WhatsApp and Signal, for business communications that were not preserved.

Trends like this show that as stated, that a compliance framework is only as strong as the least controlled channel through which regulated business can be conducted.

In fact, you don’t have a call recording problem at all. You actually have a communications governance problem.

What do you absolutely NEED to be able to do here?

Every compliance team always must be able to answer these three questions about every channel:

1. Can we capture it?
2. Can we retain it securely and immutably?
3. Can we retrieve and supervise it alongside the other relevant communications?

To do that, best practice suggests that the answer isn't necessarily to deploy a different compliance system for every channel but instead aim for a consistent control framework across channels, with common principles for capture, retention, search and retrieval, and so on.

The important concept here is joined-up evidence. If a compliance investigator needs to understand a client interaction, they shouldn't have to reconstruct it manually from five disconnected systems. Again, citing the FCA, they want to see you always meeting requirements around accessibility, replay/copying, protection against alteration or deletion, and the quality, accuracy and completeness of telephone and electronic communication records.

And this problem keeps shifting, as new channels emerge or as popular ones seep into business dialogues – like WhatsApp, for example. Many organisations in regulated industries have found that both employees and customers use WhatsApp – and Touch offers a solution that can be added to your compliance framework, capturing conversation on WhatsApp, integrated and aligned with all your other comms channels.

So, as things change, you can close those gaps and remove the weakest link.

Why working with Touch could solve your weakest channel challenges

If you agree that it’s best to stop thinking about your call recording compliance process as a collection of separate recording systems and start thinking about it as one communications-control framework operating across multiple channels, then a great place to start might be to review your entire communication inventory, identify permitted channels, map which are actually captured, and test whether records can be brought together when a compliance investigation or regulatory request arrives.

But most important of all, you need to know what happens when the conversation leaves the recorded channel. The good news is that with our decades of experience in multiple channels and in multiple regulatory environments, we can genuinely help you.

Why? Because Infrastructure for regulated firms to capture, retain and retrieve for conversations and messaging to achieve full compliance with MiFID II, Dodd-Frank, MAS (and more) is literally what we do every day.

Let’s start to find a way together to plug any gaps in your compliance firewall today. And all that takes is one email.