Comma Compliance @TresCommaComp

About a third of advised clients want their advisor to text them. Most policies say no. That gap is where off-channel comms comes from. Not bad actors, just people doing the job the way the client asked. Fix it by archiving the communications that people actually use.

88.2% of clients weigh how an advisor communicates when deciding whether to hire them. 92.4% above $500K. Your communication policy is a screening criterion whether you meant it to be or not.

Financial activities employment is down 121,000 since its peak in May 2025. FINRA hasn't scaled its recordkeeping requirements back to match. Whether a firm has cut staff or not, it still has to record, keep, and hand over every message under SEC Rule 17a-4 when asked.

41% of FCA-flagged off-channel breaches involved director-grade staff or above. If leadership isn't following the policy, why would anyone else? fca.org.uk/publications/m…

$6.26M in FINRA fines last quarter for recordkeeping and off-channel comms. Median: $ 175K. Largest: $ 2.6M. One quarter. Same theme regulators have been telegraphing for four years. #offchannecompliance

FINRA: "Most of the issues we identify at member firms are inadvertent." Same for off-channel. Your firm isn't trying to be sneaky by using WhatsApp or iMessage. They're doing it because it's convenient, so just build for it. #compliancearchiving

Recent SEC whistleblower case wasn't about fraud or investor harm but about the language that could discourage reporting. An overlooked lesson: most whistleblower concerns don't start in a formal reporting system. They start in texts, DMs, and slack messages.

Last quarter at FINRA: brokers were personally barred and suspended for off-channel messaging. Not firm fines, actual career consequences. The kind that follow a CRD permanently. #commacompliance

A federal court just treated AI prompts and outputs as discoverable evidence. If your compliance team uses AI for alert triage, summaries, or lexicon reviews, you're creating a new category of business record. #AIGovernance #Compliance

"Don't use WhatsApp for client business" is a 2026 policy joke. Let employees communicate how they will. Make the archive catch up.

Walk the floor at any compliance conference and count how many vendors actually built their own capture tech. Not many. Most are a front-end sitting on a partner. We built our own capture layer. Every channel is ingested directly. Fewer failure points = yes please.

The ICI + IAA just asked the SEC to modernize its recordkeeping rule. The current one was written in 1961. Their asks: safe harbor for good-faith compliance, and cybersecurity integrated into retention requirements: not treated as a separate problem.

Arc Relay: Open-source MCP control plane with per-user tool permissions producthunt.com/products/comma… by @TresCommaComp

"Discouraged" is not a supervisory procedure. Neither is "periodically" or "where possible." FINRA Rule 3110 requires procedures designed to achieve compliance, and vague qualifiers don't clear that. commacompliance.com/post/wsps-off-…

FINRA's new exam approach in 5 pts: - 80% of new firms = lowest risk tier -Lower-risk firms: 4yr -> 6yr exam cycles -Data requests down 12% in '25 -Firms get advance notice by quarter -Preliminary findings shared mid-exam now

Sure! You can check out any time you like, but leaving costs you. Compliance archiving vendors have turned exit fees into a business model. Export charges, per-connector pricing,migration lock-in. It adds up fast. commacompliance.com/post/hidden-fe…

iCloud backup is not an archive. If your SEC compliance plan for iMessage relies on it, there's a gap between "we have the messages" and "we can produce them in an exam."

Don't fall for the marketing speak when evaluating compliance vendors. commacompliance.com/compare

What do you like to do on weekends? A wealth management firm signed up for Comma on Sunday. No demo, no sales call. Found it, evaluated it, paid. We figured if the compliance product is clear enough, you'll find us on a Sunday. #Compliance #RegTech

Don't rely on back-based capture and archive if you're trying to rely on being compliant.