Off-channel communications under MiFID II and SYSC 10A: what UK and EU firms must record

Ask a UK or EU firm about off-channel communications and the usual answer is that WhatsApp is not permitted. The policy says so, everyone has read it, and the matter is considered closed.

Read the rule carefully and that answer creates the problem it was meant to avoid. The recording obligation attaches to equipment the firm provides and to equipment whose use the firm has accepted or permitted. Permission established by practice counts. A channel that is formally banned and routinely used is a channel the firm has accepted, and the records were required all along.

Most writing on this topic is about United States enforcement, because that is where the largest penalties have been. The UK and EU regime is separate, and it is the one that applies to firms reading this.

What the rule actually says

The obligation sits in Article 16(7) of MiFID II. Investment firms must take all reasonable steps to record relevant telephone conversations and electronic communications made with, sent from, or received by equipment provided by the firm to an employee or contractor, or equipment whose use by an employee or contractor the firm has accepted or permitted.

In the UK the same regime is onshored in the FCA Handbook at SYSC 10A. The substantive obligations, the channel scope, the relevance test and the retention period mirror the EU position.

Two features of the drafting do most of the work.

It is channel-neutral. A deskphone call, a mobile call, an SMS and a messaging app message are treated the same way. The rule attaches to the conversation, and the medium does not change the obligation.

It captures permitted use, however permission arose. This is the phrase firms underestimate. Permission does not have to be written. A supervisor who replies to a client message on a personal device, a team that agrees a deal in a group chat, a manager who knows and does not object, all establish acceptance in practice.

The relevance test

Not every conversation is in scope. The obligation covers communications that are intended to result in a transaction, or that relate to the reception, transmission and execution of orders, or to dealing on own account. Conversations that do not conclude in a transaction are still in scope if they were intended to.

The practical consequence is that intention rather than outcome sets the boundary. A discussion that explores a trade and goes nowhere is recordable. A social exchange with the same client is not. The person deciding is usually the person having the conversation, in the moment, which is why scope questions produce inconsistent practice inside the same desk.

Retention

Records must be kept for at least five years, and where the competent authority requests it, up to seven. That period is worth holding in mind when a firm decides to tolerate a channel it cannot capture, because the gap persists as a five-year hole in a population a regulator can sample at any point within it.

Why a ban is not a control

The pattern in enforcement across jurisdictions is consistent, and it is worth being blunt about. Firms with clear written prohibitions were penalised anyway, because the prohibition was contradicted by practice and the practice is what the rule follows.

The reason people move to an unrecorded channel is worth examining rather than deploring. Speed is one: the client is on the app, the answer is needed now, and switching costs a reply cycle. Informality is another: some things are easier to say without a record. The second reason is the one that should concern a compliance function, because the content most likely to travel off-channel is exactly the content most likely to matter later.

A ban addresses neither. It removes the approved route to the behaviour and leaves the behaviour.

Who is actually in scope

One question comes up in every implementation and the answer is wider than people expect.

The obligation follows the activity rather than the job title. Anyone whose conversations are intended to result in a transaction is in scope, which routinely includes people outside the front office: relationship managers who take an order in passing, product specialists brought into a client call, and senior staff who step into a negotiation. Contractors are named in the rule alongside employees.

The common gap is the person who deals occasionally. A desk with a permanent order-taking function is configured correctly on day one. The colleague who handles a client twice a quarter is the one whose personal mobile was never brought into scope, and whose two conversations a quarter are exactly the ones a sample will surface.

Build the scope list from activity, then check it against the systems list. The names in the first and not the second are your exposure.

A scope decision table

Take this to a desk meeting. The middle column is the test, and the right column is what to do when the answer is unclear.

Situation	In scope?	If unclear
Client messages a personal mobile about a possible trade	Yes, if the firm has accepted the practice	Move it to a captured channel and continue there, in the same reply
Internal group chat discussing pricing on a live order	Yes, it relates to order handling	Treat internal as in scope by default
Social message that turns into a market conversation	Yes, from the point it turns	Capture from the turn, and record why
Exploratory discussion that never becomes an order	Yes, intention governs	Capture. Outcome is decided afterwards, scope is not

The consistent instruction underneath all four rows: move the conversation rather than declining it. A reply that says the discussion continues by email preserves both the relationship and the record, and it takes one sentence.

What to do about the channel you already tolerate

1. Establish where conversations actually happen, by asking the desks rather than reading the policy.
2. For each channel, decide to capture it or to stop it, and record the decision with its reasoning.
3. Where you stop it, give people the approved route to the same speed, since removing the route without replacing it produces the same behaviour somewhere less visible.
4. Where you capture it, confirm the retention meets five years and that the records are retrievable rather than merely stored.
5. Revisit annually, because tolerated practice re-establishes itself.

Where a pre-send check fits, and where it does not

Being precise here matters. A pre-send language check does not solve recordkeeping. It does not capture a channel, it does not retain anything for five years, and it is no answer to a SYSC 10A gap. Archiving and capture tools do that job.

What it addresses is the adjacent risk. On the channels that are captured, the exposure moves from the record existing to what the record says, and a five-year retention period means every sentence is readable for five years by someone whose job is to find the worst one. Our pre-send check works on that second problem, on the channels you already capture.

The takeaway

Check your policy against your practice this quarter, because the rule follows the practice. If a banned channel is in regular use, the recording obligation has already attached to it and the ban is evidence of knowledge rather than a defence. For what happens to the content once it is captured and readable for five years, see our guide to the everyday phrases that cross the line.