In 2025, enforcement trends in both the United States and the United Kingdom made one point unmistakably clear: compliance (including mobile compliance) failure is no longer defined by the absence of policy. It’s defined by the failure to operationalise supervision across the channels employees actually use.

Regulators have repeatedly characterised off-channel communications as a books-and-records and supervisory systems failure, not an intent problem.

In 2025, the U.S. Securities and Exchange Commission (SEC) continued its enforcement actions against broker-dealers and investment advisers for record-keeping violations tied to personal devices and encrypted messaging applications. These actions reaffirmed that regulatory violations arise where firms fail to preserve business communications conducted on personal devices, even where no specific customer harm is identified. The SEC emphasised that firms must maintain systems “reasonably designed” to ensure compliance (written prohibitions alone are insufficient).

Similarly, in September 2025, the U.S. Commodity Futures Trading Commission (CFTC) issued additional orders reinforcing that record-keeping violations don’t require proof of customer harm. Supervisory failures stemming from unmonitored personal device communications were treated as independent compliance violations.

The regulatory position is consistent: supervision is outcome-based.

“We have a policy” is not a defence. “Were the communications captured?” is the operative question.

The reality: employees use these channels, eschewing mobile compliance

Enforcement findings increasingly show that off-channel usage is widespread, including among senior personnel.

In one 2025 CFTC order, internal firm sampling found that approximately 70 per cent of sampled associated persons had used personal texts or unapproved messaging applications such as WhatsApp and SMS for business communications, despite firm policies prohibiting such use.

This isn’t isolated misconduct. It is behavioural reality.

WhatsApp in traditional financial services

WhatsApp’s global user base exceeded 2.7 billion monthly active users in 2025, according to Meta. Its ubiquity across jurisdictions and client demographics makes it a default channel for relationship-based services activity.

The UK Financial Conduct Authority (FCA), in its 2025 Annual Report and supervisory communications to wholesale firms, reiterated expectations that firms must maintain effective systems and controls to ensure orderly record-keeping and supervision. Internal supervisory findings referenced in 2025 indicated that 41 per cent of identified communication breaches involved director-grade or senior personnel, underscoring that this is a governance issue, not a junior staff issue.

Market structure explains the persistence of WhatsApp in traditional finance:

• Clients expect immediacy and mobile responsiveness
• Cross-border activity requires flexible communication tools
• Senior relationship managers rely on established, trusted platforms.

Academic commentary published in the Journal of Financial Compliance in 2025 observed that firms relying solely on a policy of prohibition without technological capture mechanisms experienced materially higher supervisory breach rates. Prohibition without infrastructure increases circumvention.

WhatsApp isn’t inherently a compliance failure. Uncaptured WhatsApp is.

Telegram and crypto market structure

Telegram presents a parallel challenge in digital asset markets.

The Telegram app reported over 900 million monthly active users globally in 2025. Unlike many messaging platforms, Telegram supports large-scale public and private groups, broadcast channels, and encrypted communications, features that align directly with token issuance communities, decentralised finance governance groups, and over-the-counter crypto trading networks.

The Bank for International Settlements (BIS), in its 2025 FinTech publications examining digital asset market infrastructure, highlighted the supervisory risks associated with encrypted messaging platforms embedded in crypto ecosystems. Similarly, IOSCO’s 2025 updates to its policy recommendations for crypto and digital asset markets emphasised that existing record-keeping and supervision requirements apply irrespective of technological medium.

Telegram functions not merely as a messaging tool, but as part of crypto market microstructure.

For firms operating in digital assets, Telegram provides:

• Real-time global investor engagement
• Community governance communication
• Liquidity and sentiment coordination
• Operational scalability.

Eliminating Telegram from crypto market activity is commercially unrealistic.

The regulatory expectation is not abandonment. It is supervision.

Mobile compliance supervision is an obligation

Across 2025 enforcement actions, regulators consistently used the phrase “reasonably designed” when describing supervisory failures.

Supervisory liability arises not because employees misbehaved, but because firms failed to implement systems capable of:

• Capturing business communications across both approved and de facto channels
• Detecting channel-hopping from monitored to unmonitored platforms
• Providing supervisors with review visibility
• Maintaining immutable, auditable records.

In retail brokerage enforcement actions in 2025, the SEC highlighted insufficient systems to determine whether employees were complying with off-channel restrictions.

Under accountability frameworks such as the UK’s Senior Managers and Certification Regime, responsibility for systems and controls is explicitly allocated. Inadequate communications capture infrastructure therefore creates both institutional and personal regulatory exposure.

The failure is architectural.

Why prohibition alone fails when it comes to mobile compliance

The empirical data is consistent: attempts to eliminate encrypted messaging through policy alone don’t produce compliance.

The CFTC’s 2025 sampling data showing ~70 per cent non-compliance with internal policy demonstrates this starkly.

Commercial reality drives usage:

• Crypto counterparties default to Telegram
• Corporate clients communicate via WhatsApp
• Global investors expect mobile-first interaction.

Firms that attempt to eliminate these channels may impair competitiveness. Firms that fail to supervise them impair compliance.

The only defensible path is controlled capture.

The governance maturity question

Research published in 2025 proposes a four-pillar framework for communications governance:

1. Documented policies and procedures
2. Targeted training and attestations
3. Technological capture infrastructure
4. Continuous monitoring and supervisory review.

Most firms satisfy the first pillar. Fewer have fully implemented the third and fourth.

Regulators assess outcomes:

• Were communications captured?
• Were they reviewable?
• Is there evidence of monitoring?
• Can the firm produce an audit trail?

The next enforcement action won’t hinge on what was said. It will depend on whether you were able to see it.

From mobile compliance policy to proof

For compliance leaders, the question is no longer whether encrypted messaging exists inside their organisation. It’s whether their governance framework produces defensible evidence.

Regulators evaluate supervision through demonstrable outcomes:

• Are all business communications captured?
• Can supervisors review them?
• Is channel-hopping detectable?
• Is there a tamper-resistant audit trail?

Policy documentation alone doesn’t answer these questions.

What changes the equation is infrastructure.

A mature communications governance mobile compliance model includes:

• Unified capture across email, SMS, WhatsApp, Telegram and other encrypted applications
• Centralised retention aligned to regulatory books-and-records requirements
• Integrated surveillance capable of identifying behavioural anomalies
• Supervisor visibility and documented review workflows
• Audit-ready reporting demonstrating compliance effectiveness

The objective isn’t to eliminate commercially valuable channels. WhatsApp strengthens client responsiveness. Telegram is embedded in digital asset markets. SMS remains foundational in relationship-driven trading.

The objective is to ensure that business growth doesn’t outpace supervisory control.

In 2025, enforcement trends clarified that regulators won’t accept technological complexity as justification for incomplete supervision.

If the business communicates there, compliance must capture there.

Do you have a mobile communications compliance solution in place? If not, you might be exposed to risk.

Thanks for reading this. If you’ve got any questions or comments, do feel free to get in touch.

Author: Alma Beutelspacher, Product Manager, Insightful Technology

More about mobile communication compliance

Sources and information

U.S. Securities and Exchange Commission (2025).
SEC Press Releases and Enforcement Actions – Recordkeeping and Off-Channel Communications.
https://www.sec.gov/enforcement

U.S. Securities and Exchange Commission (2025).
Exchange Act Rule 17a-4; Advisers Act Rule 204-2 – Books and Records Requirements.
https://www.ecfr.gov/current/title-17

U.S. Commodity Futures Trading Commission (September 2025).
CFTC Enforcement Orders – Recordkeeping and Supervision Failures.
https://www.cftc.gov/PressRoom/PressReleases

U.S. Commodity Futures Trading Commission (2025).
CFTC Rule 1.31 – Recordkeeping Requirements.
https://www.ecfr.gov/current/title-17/chapter-I/part-1

Financial Conduct Authority (2025).
FCA Annual Report and Accounts 2025.
https://www.fca.org.uk/publication/annual-reports/annual-report-2025.pdf

Financial Conduct Authority (2025).
Dear CEO Letters – Wholesale Brokers and Capital Markets Firms.
https://www.fca.org.uk/firms/dear-ceo-letters

Bank for International Settlements (2025).
BIS FinTech Papers – Digital Asset Markets and Supervisory Risks.
https://www.bis.org/publ/fintech.htm

IOSCO (2025).
Policy Recommendations for Crypto and Digital Asset Markets – 2025 Update.
https://www.iosco.org/library/pubdocs/pdf/IOSCOPDxxx.pdf

Journal of Financial Compliance (2025).
“Supervisory Controls and Encrypted Messaging in Regulated Financial Markets.”
https://www.henrystewartpublications.com/jfc

Journal of Financial Market Infrastructures (2025).
“Telegram Communities and Market Microstructure in Digital Asset Trading.”
https://www.risk.net/journal-of-financial-market-infrastructures

Meta Platforms, Inc. (2025).
Form 10-K Annual Report.
https://investor.fb.com/financials/sec-filings/default.aspx

Telegram Messenger LLP (2025).
Telegram Transparency Report and Platform Statistics.
https://telegram.org/transparency