The current communication monitoring landscape is a ‘wild west’, and firms need to ensure their processes are nimble so they can adapt to new and evolving communication channels.
This came from a recent webinar hosted by Smarsh, a RegTech company that helps simplify communications compliance. The discussion focused on modernising communication monitoring capabilities to meet the dynamic landscape where employees have a plethora of channels at their disposal.
Peter Wannemacher, principal analyst for research and advisory company Forrester, served as the chair of the panel. He was joined by Susan Schroeder, partner, vice chair of securities and financial services department at WilmerHale, and Robert Mara, the Americas financial services risk technology leader at EY.
Setting the landscape of the chat, Wannemacher noted that all businesses now operate at the “speed of digital.” What this means is that companies are having to rapidly adapt their processes so they can keep up with ever-evolving marketplace. To which, Wannemacher noted that this has created an ecosystem of hyper adoption and a rapid shift in behaviours.
As companies look to improve their digital operations, a Forrester report recently concluded that 70% of financial services companies put strengthening compliance as a high or critical priority for 2024. This is a trend Forrester has seen for the past five years. The biggest action financial services firms are taking to address this need is improving oversight through better risk data and analytics, with 38% stating this as a key strategy of theirs. This was followed by creating new leadership roles (31%), improving agility and flexibility of existing IT systems (31%), expanding the use of risk, governance and compliance tools (31%), aligning company culture (28%), investing in continuous monitoring tools (27%) and enhancing training (27%). These are just some of the strategies firms are implementing.
While companies are eager to upgrade their governance, it is not a simple task. Communication monitoring has faced a particularly difficult period over the last few years. The Covid-19 pandemic encouraged businesses to adopt more digital communication tools, such as Zoom and Microsoft Teams, but other services like WhatsApp have also provided a convenient way for employees to engage with one another or with clients. This has left firms with a tough task of ensuring they are capturing all relevant communication on company and personal devices to ensure they are not at risk of fines.
A recent report from Shield and LeapXpert found that only 51% of the financial institutions surveyed are currently monitoring employee communications on WhatsApp, a popular messaging platform. Over the past couple of years, firms have faced billions of dollars of fines for failures to effectively monitor digital communication channels. One notable example is JP Morgan’s $200m fine for executives using personal devices for business communication.
While many firms are attempting to implement controls, the same survey found that 73% of financial institutions unsure of their ability to implement effective bans on unapproved mobile communication channels.
The first question Wannemacher pitched to the panellists was around how firms are changing their policies for monitoring work and personal devices and how are they strengthen their supervisory capabilities.
Schroeder was the first to respond and highlighted that financial institutions already have policies and procedures that prohibit staff from using their personal devices for sending texts or other messages. However, the SEC believes the firms are not doing enough to enforce this and want active surveillance that identifies red flags quickly. She said, “I think there’s an increasing expectation that they use data and analytics to determine whether or not people are transitioning or pivoting away from a captured email communication. One simple example is firms including in their email review lexicon and phrases, such as ‘let’s take it offline’, or the phrase ‘text me.’ They’re reviewing those references, and then following up with those individuals to say, ‘Did you text with this person, did you take this offline’, and they’re disciplining them.”
One solution Mara has observed is the revival of company-owned devices. He stated that firms had slowly transitioned towards bring your own device models but are beginning to pivot back. They’re also looking at the channels they allow on the devices. Mara was clear that communication monitoring is a balancing act. For example, a decade ago, WhatsApp and WeChat were not as popular, but nowadays it is a core messaging service and customers expect to be able to use it.
He also agreed with Schroeder that firms can’t simply rely on their policies and need to be actively monitoring their communications. “Frankly, that’s a little bit of the Wild West. We’re seeing organizations do some of the things that Susan mentioned in terms of adding things to lexicons. But we’re also seeing them do communication profiling. We’re seeing organizations look to see whether or not there are unapproved devices being used within the four walls of their physical location. We’re seeing additional evaluations of channels, based upon site traffic, bandwidth and other things, to identify if there are new things popping up in their organization that they need to take action on.”
The wild west
Wannemacher focused on this concept of communications monitoring being like the wild west and posed the question of whether this will continue to be the case for the coming years.
Mara was the first to respond and agreed that this will be the foreseeable future of the space due to several reasons. One cause is simply because of the proliferation of communication channels. There are countless pieces of software out there that allow people to exchange messages, whether it is traditional tools like Zoom, or other software via social media, trading platforms, gaming platforms and many more.
The market is only going to continue to evolve, and more methods will be adopted by consumers and employees. He said, “You’re never really going to be able to go and say that you know what the different communication channels that people might want to communicate on are. You’re not going to be able to say, with any type of clarity, two years from now what customers are going to want to be able to communicate on. And you don’t know how the capabilities of the existing systems that you have are going to evolve. What this is going to require is that you’re going to be a lot more nimble in your approach.”
While this might start firms panicking about an even more complex landscape of communication monitoring, Mara noted that he believes the regulators are not concerned about the inadvertent stuff. “If something happens to start off on a private thing, and somebody just happens to say, ‘hey, what about this’, I’m not certain that the regulators are going to be really focused on those little one offs that happen. They’re looking for more of a culture of compliance.” It’s more about having ongoing tools to monitor communication and catch the bad actors who are going to be trying to hide their dealings and leveraging various channels.
Schroeder echoed Mara’s thoughts, noting there is more uncertainty to come within communication monitoring. She said, “It may get more complicated before it gets easier.” One of the biggest challenges she sees is through tertiary functions within platforms that are not intended for written communication exchange, such as the chat function within Zoom or writing shown in the background of the video.
Similarly, Schroeder highlighted the ability to make comments within Google Docs or Word documents. While this would previously be considered a document, these comments allow users to send messages back and forth and could be considered a communication tool.
“I do worry that given the fervour with which we see the regulator’s pursuing this, even absent evidence of nefarious conduct, that we haven’t seen the end of it. In terms of what firm’s need to do to be nimble and to get ahead of this issue, I think they need to be thinking about inventories of what is available and what are people using, without the firm knowing about.” She stated that firms should not discourage employees using technology or disabling functions, such as chat in Zoom, if it will help them in their job. Firms should be exploring what staff are using, what they want to use and see how they can ensure it is used within the confines of policy.
To get even more insights about the future of communication monitoring, watch the full webinar here.
Keep up with all the latest FinTech news here.
Copyright © 2023 FinTech Global
Copyright © 2018 RegTech Analyst
