Since 2017, Touch has been helping a leading independent Nordic investment bank meet many challenges it faced to ensure regulatory compliance for recording conversations, adapt to privacy regulations, and to enhance operational resilience.
The privately held 400-strong organisation offers finance, M&A (mergers and acquisitions), capital raising and corporate restructuring, equity research, and brokerage services to corporate clients and international investors, both locally and globally.
Like all financial services players, that means it works in a strictly regulated environment. The challenge is that growth has meant that, to better serve its expanding client base, which now includes major accounts everywhere from the EU to the UK, the US and Asia-Pac, the company must abide by a wide range of compliance regulations.
These include FCA rules and the UK’s implementation of GDPR, the EU’s MiFID II, GDPR, and DORA banking regs, SEC and FINRA rules in the US, and PDPA and MAS in Singapore.
That complexity is increased by the unique, decentralised company structure, as over half of its staff are partner-shareholders, which demands strong alignment between Compliance, IT, and senior stakeholders, as well as a constant focus on limiting its regulatory exposure across multiple jurisdictions. This presents a particular challenge when it comes to compliance recording.
Why Touch?
To support its operations, the organisation needed to meet all these complex compliance recording obligations – and it also need to do so efficiently, without duplicating efforts.
Any recording solution would also need to operate seamlessly with existing communications and back-office infrastructure. At the time, this included:
- Mitel MX-One fixed lines
- Skype for Business
- IPC trading turrets
The company also has an ongoing strategic partnership with its mobile communications supplier, Telia.
After an extensive selection process, Touch Technologies was identified as offering the best solution to provide compliance recording, and to provide a comprehensive record of all conversations and dialogues, consolidated from all channels in use.
What made Touch the ideal match was the fact the solution was purpose-built for compliance use cases, and came as a single, unified platform for multichannel access and replay. Touch’s secure, tamper-proof, and 100% audit-ready storage features also made it attractive, as was its flexible support for the level of multi-regulatory contexts the company needed to operate in.
The solution met the desired goals, offering a unified, compliant recording solution with fully centralised storage, search, and playback facilities. Initially, it was required to cover over 250 qualified users in six locations (Oslo, Stockholm, Copenhagen, Frankfurt, London, and New York).
Go-ahead was a joint decision by internal IT and Compliance leaders, who embraced the idea of a single supplier, better infrastructure control, increased efficiency, and the ability to access the robust fand comprehensive audit trail, case handling, compliant search, and playback facilities Touch could offer.
Success, change and growth
In addition to meeting compliance recording demands in general, the organisation has a number of additional requirements for whitelisting so that it could align the demands of MiFID, GDRP and the other relevant legislation. These include:
Department-based whitelisting for internal conversations
Recording is the default mode, but to avoid duplicate or unnecessary recordings, rules and policies are applied to whitelist certain internal dialogues. Each conversation is assessed based on internal or departmental roles before triggering recording. For example, if the participants work in Research or Support, then calls may not be capture. Similarly, if only one party is governed by compliance regulations, the recording proceeds – but the resulting record is stored only in the space reserved for the regulated user. This would apply, for example, to a conversation between Markets and Research, with the Markets user being regulated.
Keyword-based exclusions for meetings
Terms have been predefined to exclude certain meetings held on Microsoft teams from the compliance recording capture process. By default, all are automatically recorded, but if the subject line of the meeting request includes terms such as “HR” or “restricted”, then such meetings are excluded. This prevents internal or sensitive meetings from being recorded unnecessarily and supports GDPR-compliant data minimisation.
On-by-default with manual opt-out
This means that teams that typically require recording can occasionally pause it – for example, for internal admin conversations.
Off-by-default with manual opt-in
For departments rarely subject to regulatory capture, Touch enables user-triggered recording when needed.
Banner suppression / customisation
The recording banners in Teams can be removed or tailored. This is because internal stakeholders don’t need visual alerts for every call as consent is already covered in company policy. This reduces unnecessary disruption and helps normalise compliance recording.
The organisation is guaranteed 5 years’ worth of retention, in line with regulations such as MiFID II (although Legal can go beyond this, if needed). The Compliance team has full access to the archive, search, case handling, and audit logs, while the Administration and IT function can now easily and centrally manage all users and licenses, as well as all roles, and maintain all overall access control.
Finally, recorded users can view their call log (but not play stored recordings), and add private contacts to the main whitelist.
From on-prem to full cloud
The original on-prem service has now been migrated to the full Touch cloud platform, simplifying management and changes. During the initial delivery phase, the Touch team collaborated with experts from the customer to identify the relevant data sources and to integrate with the existing systems. Following launch, the on-prem solution delivered efficiently for a number of years.
In 2023, however, both parties agreed that migration to the cloud would deliver additional benefits, such as faster updates and more flexible policy controls.
Next steps: AI for Compliance
Recently, the organisation’s Compliance professionals requested smarter tools to help with their investigations. As a result, Touch is developing Touch Copilot, an AI assistant for natural language search across all data (chat + transcribed calls), with this institution due to be one of the first production sites.
The system is will help in a range of scenarios, including suspected insider trading. Here, an investigator can define a timeframe and ask Copilot useful questions such as:
- “Has anyone discussed [ticker] before [date]?”
- “Do any conversations suggest knowledge of confidential info?”
- “Has there been any unusual trading behaviour without previous activity?”
Full GenAI (generative AI) techniques, augmented by Touch’s industry knowledge ,will deliver this and more, as all organisational calls are transcribed and chat is already in text.
As a direct result, this organisation’s Compliance team expects to be able to identify potential issues faster, document proactive compliance steps, and respond to regulatory enquiries much more rapidly and from a fully informed basis.
In summary, it is evident that the partnership between Touch and this finance leader is delivering consistent value—and that the move to the next stage with AI could unlock even more.
Would you like to know more?
Find out more about Touch Call Recording Service and how this will benefit your business.
