Communications Compliance Still Matters, Even When Headlines Don't

By Consaya Editorial — 2026-08-28

Enforcement headlines faded after the SEC changed leadership. The routine work didn't.

The prior SEC chair brought 95 enforcement actions and $2.3 billion in penalties against firms for book-and-record violations, chiefly around off-channel communications. That was loud. That got attention. Under the new chair, the agency shifted gears toward individual accountability and cross-border misconduct instead. The volume of those big firm-level actions dropped. But FINRA's examination program kept going exactly as before, quietly identifying the same control failures in member firms that were showing up three years ago.

This matters because FINRA doesn't need headlines to move. The 2026 Annual Regulatory Oversight Report shows recurring findings that signal where FINRA's priorities rest. Firms still can't retain business-related electronic communications reliably. They still miss detecting business conducted through unapproved platforms like personal Slack accounts or WhatsApp groups. Written supervisory procedures still don't specify which channels are approved, how detection happens, or what correction looks like. Reviews of captured communications remain shallow — limited sampling, weak keyword searches, no real multilingual coverage.

The real problem isn't that firms lack policies or systems. Most have both. The problem is that business doesn't happen in one place anymore. A conversation starts in Slack, moves to email, lands in a Teams meeting with documents attached. Each of those is firm business. Each of those is subject to recordkeeping and supervision. Your legacy email surveillance system was built to watch inboxes. It wasn't built for the platforms your people actually use.

For compliance leaders, the shift from policy to proof is where the friction lives. Having a comms policy is table stakes. Demonstrating that your policies, systems and supervisory processes actually work together is the real test. That means governance that's enforced through training and attestation, not just a document. Detection systems that can identify business activity outside approved channels. An archive where communications are stored defensibly and remain accessible. Clear escalation and remediation paths with documentation showing that controls operate in practice, not just on paper.

One weak link undermines the whole thing. A message flagged in surveillance might relate to trading activity, outside business, disclosure obligations or an internal investigation. If your communications control is sound but your trading oversight isn't, or vice versa, the examiner notices the gap. Capture, surveillance and retention can't be treated as separate problems.

Consaya handles the recordkeeping piece — it keeps your books ready for filing and generates compliance packs — but the broader point stands: you need systems that talk to each other and actually detect what's happening, not just systems that exist.

The headlines moved on. The work didn't.

Source: https://www.cpapracticeadvisor.com/2026/08/28/the-sec-changed-focus-finra-has-not/189239/