Client Communication Compliance for Wealth Management Firms

The structural problem in wealth management is not that advisors are careless. It is that advisors are responsive. Responsiveness lives on whatever channel the client chooses.

A client texts. An advisor answers. The exchange is professional, useful, and fully outside anything the firm can capture. Repeat that across a book of business. Now the firm has a supervision gap that no policy document closed.

The SEC's 2021-2024 off-channel recordkeeping initiative provides a useful historical record of how communication-channel gaps can become supervision and recordkeeping problems. This article draws practical lessons from those cases without assuming the same enforcement posture will remain unchanged.

What the enforcement record shows

From late 2021 through 2024, the Commission brought a series of off-channel recordkeeping actions. The cited orders are useful for understanding recurring control failures, while current enforcement priorities should be checked separately.

In September 2022, sixteen firms agreed to pay more than $1.1 billion combined. The Commission said the failings ran across all sixteen firms. They involved employees at multiple levels of authority, including supervisors and senior executives.

In February 2024, sixteen firms agreed to pay more than $81 million combined.

In September 2024, the Commission charged twelve firms, and eleven paid a combined $88,225,000. The Commission again described personnel at multiple levels of authority, including supervisors and senior managers. It also noted that the violations persisted after the first recordkeeping matters became public in 2021.

Three things in that record are worth a firm's attention.

The failures were not confined to the front line. Supervisors and senior executives appear in the orders. A supervision program cannot work when the people supervising are on that channel too.

The cited SEC orders describe conduct that continued after earlier actions became public. They show why awareness and written policies must be paired with implementation, supervision, and testing; they do not establish what every industry participant knew.

Self-reporting was associated with different outcomes in a September 2024 action. The SEC said one self-reporting firm resolved without a civil penalty and two others received lower penalties. That is a fact about those matters, not a promise about how another case would be treated.

Read the orders and one detail repeats. The firms did not lack policies. They had them, in writing, and the messages went out anyway.

The obligations themselves sit in two places. Rule 204-2 under the Advisers Act covers investment advisers. Rule 17a-4 under the Exchange Act covers broker-dealers.

Consult the applicable eCFR provisions separately: Rule 204-2 for investment advisers and Rule 17a-4 for broker-dealers. The firm's compliance team should determine the record categories, retention, and preservation requirements.

Why the gap opens where it does

Convenience, client preference, and shared devices can encourage off-channel use. These pressures do not excuse violations of firm policy or applicable recordkeeping and supervisory requirements.

The client chose the channel. A client who texts is not difficult. They are talking the way they talk with everyone. An advisor who insists on email is asking the client to change for the firm's convenience. That is a strange thing to ask a client to do.

Responsiveness is the product. In this business, speed of response is what sets a firm apart. A channel that takes three extra steps loses to a channel that takes none, especially at 7 p.m.

Both channels live on one device. The compliant channel and the uncaptured one are two icons apart. There is no friction to route around. The only thing standing between them is discipline, applied thousands of times.

Read together, those three explain why policy falls short. A policy that asks people to be slower and less convenient is competing with the easier path. It loses at the margin, in small amounts, again and again. Then one day the amount is not small.

What actually closes it

Firms that handle this well do three things, in this order.

1. Make the approved, captured channel practical to use. Test access, login, device, and workflow friction with advisors while retaining required security controls. A separate app or device does not automatically make a program fail.

This requires a combination of platform capability, policies, training, and supervision.

2. Build supervision around actual risk and the firm's policies, including senior personnel where their communications are in scope. The cited SEC orders show that recordkeeping failures were not limited to junior staff.

3. Detect the gap rather than assume it has closed. Attestations tell you what people believe they should say. Check whether client facing activity has a matching record. Then look hard at the advisors who have unusually few.

That last one is awkward, and it is the one that finds things.

None of the three works on its own. A convenient channel with no monitoring just moves the gap. Monitoring with no convenient channel just finds it, over and over.

The question that moves advisors internally

Compliance framing rarely changes advisor behavior. It sounds like a limit on the relationship the advisor built.

There is a different question that lands. It is not about rules:

If you left tomorrow, could the firm still serve your clients well, and could you hand off cleanly?

An advisor whose client history lives in text threads on a personal device cannot answer yes. Neither can the firm. That is a continuity problem, a succession problem, and a client service problem. It becomes a regulatory problem after that.

The question also works from the other side of the desk. Ask the firm what it would hand a new advisor on day one. If the answer is a client record with holes in it, that is the same problem seen from above.

Supervision arguments leave some advisors cold. This one often lands. It is about their book rather than the firm's exposure. And the remedy is the same

What to ask a communications vendor

Six questions. Ask for mechanism, not capability.

1. How do you capture a business conversation that starts on an advisor's mobile device? Ask for the mechanism. "Our mobile app supports it" is not one.
2. Which channels do you capture, named one by one? Voice, voicemail, business messaging, fax, and video, answered one at a time rather than as "communications."
3. Can I retrieve every communication with one client across every channel in a single search?
4. Can you set retention per record type? Can you apply a legal hold to a subset?
5. Is there an audit log of who accessed which record?
6. What does an export contain? Can you hand it to a regulator without reprocessing?

Ask every vendor, including us. If an answer arrives as a feature list, ask again in the same words. You want a described mechanism.

One more thing about that call. Write the answers down as they come. A month later, nobody remembers which product each answer covered.

Frequently Asked Questions

What are off-channel communications?

Business communications conducted on channels the firm has not approved or cannot capture, often including messaging applications on personal devices. They were a central subject of the SEC's 2021-2024 off-channel recordkeeping initiative.

Can advisors text clients?

That depends on the firm's policies, the applicable recordkeeping obligations, and whether the messaging path can be supervised and preserved as required. Personal-device SMS often falls outside a firm's approved capture systems unless the firm has implemented a specific control. The practical goal is an approved business messaging path that the firm can govern and retain.

What did the SEC's enforcement actions actually find?

Across multiple actions since 2021, the Commission described widespread use of unapproved communication methods, with failures involving employees at multiple levels of authority including supervisors and senior executives, and conduct that persisted after the first actions were publicized.

Does self-reporting help?

In a September 2024 action, the SEC said one self-reporting firm resolved without a civil penalty and two others received lower penalties. That does not establish a guaranteed outcome for another firm.

How do firms supervise advisor communications effectively?

A practical program can combine approved channels that advisors will actually use, risk-based supervision that includes senior personnel where appropriate, and testing for gaps rather than relying only on attestations. The firm's compliance team should define the actual supervisory standard.

How long must advisor communications be retained?

Retention periods depend on record type, entity type, and jurisdiction, and the determination belongs to your compliance counsel and the rule text. Any vendor stating a single universal period should be asked for the citation.

Quick Answers

• Gaps can arise when approved channels are inconvenient or when capture, supervision, and policy controls are ineffective.
• The SEC orders name supervisors and senior executives. The conduct continued after the first actions were public.
• Combine approved usable channels with capture, retention, supervision, training, and testing.
• The internal question that works: if you left tomorrow, could the firm serve your clients and could you hand off cleanly?
• Ask vendors for mechanisms, especially for conversations started on a mobile device.