The above enforcement action serves as a helpful reminder for firms to ensure text messages or other electronic records are retained in compliance with applicable recordkeeping and supervision requirements. As firms have shifted to remote work and employees use various messaging applications, compliance risk arises.

Firms are beginning to implement archiving technology that can record all smartphone content, including text messages. They can manage compliance by adopting these comprehensive solutions and developing policies and procedures to ensure proper supervision, review and retention. Archiving software solutions reduce risk for brokers and clients, streamline supervision and compliance activities and protect sensitive firm and client data.

FINRA Rule 3110 requires a firm’s supervisory system to provide for the establishment and maintenance of policies and procedures. Firms that have not already done so should implement and periodically review formal written electronic communication policies. As your firm works through creating and maintaining policies and procedures, consider the following:

• Policies and procedures must be tailored to the specific risks of the firm and address all activities in which your firm engages. Policies should be appropriate for the size and structure of the firm’s business
  
  
• Policies and procedures should set forth standards for devices and applications that may be used so all communications can be retained and supervised
  
  
• Permissible messaging applications must allow message retention
  
  
• Policies and procedures should be updated to reflect regulatory changes, as well as changes made to the supervisory process
  
  
• FINRA recommends that firms adopt a combination of lexicon and random review of electronic correspondence
  
  
• A manual internal review process is recommended
  
  
• All applicable departments should be involved in the creation of the firm’s written electronic policy (management, IT, legal, compliance, marketing, operations, trading)
  
  
• All policies and procedures must specify basic parameters for reviewing electronic communications. There is no prescribed formula for determining how many emails to review, but enough should be reviewed for an advisor to be able to defend it as reasonable. Policies and procedures are not required to specify exact percentages or quantities to review
  
  
• The most important takeaway is to review as many messages as are specified by the firm’s policies. If the policies call for a review of four percent of all emails each month, reviewing only two percent in a quarter is missing the mark

It’s critical that your firm review its current written electronic communication retention and supervision policies to ensure those policies keep up with the pace of technology.