Approaching your CCO about mobile device compliance

—

Approaching your CCO about mobile device compliance

An essential guide for EU-based firms

An essential guide for EU-based firmsContents

—
About Global Relay

Introduction

Step 1
Painting a picture of the EU’s evolving risk landscape

Step 2
Understanding your company’s risk profile

Step 3
Outlining regulatory expectations and guidance

Step 4
Securing support across the business

Step 5
Researching potential solutions

Conclusion
Pitching the proposal

Working with Global Relay for mobile device compliance

Introduction

In today’s corporate landscape, mobile devices are central to successful business strategy. Communications practices have advanced with the introduction of channels like instant messaging and SMS, making mobile devices a popular business tool for enabling real-time interaction and increasing productivity.

As digital communications channels become more prevalent in financial workflows, it’s important for firms to reassess their communications capture policies to ensure they maintain compliance with regulatory expectations. However, compliance teams often work with limited resources due to budget and personnel constraints, and implementing device policies, such as firm-issued devices or bring-your-own device (BYOD), adds additional challenges.

Effective mobile device compliance can help reduce long-term costs, prevent regulatory repercussions, strengthen resilience, and increase efficiency across operations—and, with the right pitch, you can convince senior stakeholders of its clear business value. This guide will provide a step-by-step approach to speaking with your CCO about evolving communications capture needs to increase buy-in and build a more comprehensive mobile compliance policy.

Back to contents

1. Painting a picture of the EU’s evolving risk landscape

Regulators have established clear expectations for communications capture in response to the evolution of digital communications, including the European Union’s (EU) Markets in Financial Instruments Directive II (MiFID II) and Market Abuse Regulation (MAR).

In the past, firms may have only monitored “traditional” business communication channels such as email. Now, it’s increasingly common for personnel to use mobile devices to communicate across multiple channels, from ephemeral messaging apps to social media—and firms need to ensure that all platforms are being used compliantly.

Open the conversation by pointing out mobile device use that may already be posing a compliance risk to your firm.

Substantiate your conversation by including real-world scenarios that align with your CCO’s responsibilities, such as:

1. Unmonitored mobile devices
High-risk employees, such as traders, could be using unauthorized personal devices or unmonitored channels to send business communications, conduct phone calls, and share sensitive information. If your firm has not established thorough communications compliance policies, these conversations could go uncaptured, increasing potential risk.

Back to contents

2. Ephemeral messaging apps
Digital channels such as MS Teams, Telegram, and WhatsApp are becoming more popular amongst personnel—but their ephemeral messaging features can pose substantial recordkeeping and eDiscovery challenges, as messages can be set to disappear after a specified time.

3. Social media platforms
Social media platforms are becoming more prevalent for marketing and business outreach purposes. If an adviser posts their financial advice on LinkedIn, for example, this falls under MiFID II regulation as a business communication that must be captured.

4. Market manipulation
Without robust policies to monitor communications on mobile devices, firms can fail to identify instances of financial misconduct and market abuse. Finanstilsynet, Norway’s financial supervisory authority, fined Danske Bank $4.4 million (50 million Norwegian Krone) for overlooking market manipulation happening on digital communications channels.

5. Record retention requirements
Firms under EU jurisdiction are expected to comply with recordkeeping requirements like MiFID II, which outline expectations for capturing and retaining electronic communications records. Without an up-to-date compliance policy, firms can find themselves in violation of these requirements by failing to capture all channels used to conduct business conversations.

Back to contents

2. Understanding your company’s risk profile

After summarizing the current risk environment, evaluate your firm’s unique risk profile to identify where compliance gaps may exist. A risk assessment can expose the blind spots in current communications infrastructure and where additional controls might be needed.

To start, compile a list of all the communications platforms that are used within your business, including SMS, IM, video channels, or social media. It is beneficial to do this by discussing channel use with employees, especially those in “high risk” positions, to understand which channels they leverage. Then, clarify whether you have any existing practices in place to capture and/or monitor these channels.

This approach could look like:

Understanding whether personnel are using personal or unauthorized devices for communications that could be business-related.

Determining if you’re monitoring and capturing data from cloud-based collaboration platforms (like Microsoft Teams or Zoom).

Identify whether there are unexpected applications where personnel could be conducting business communications—for example, a gaming platform such as Discord.

Becoming familiar with your data governance structure, such as identifying how data flows across your business.

Back to contents

Speak to anyone involved in outward-facing roles, including traders, investment advisers, and support personnel, to understand how communications happen, and via which channels. It could be that many business dealings happen on voice channels, or that clients prefer instant messaging platforms.

These insights may reveal compliance “workarounds,” or methods in which employees speed up conversations. These “workarounds” may fall outside of official recordkeeping systems and are perhaps the most compelling point when building a case for investment in tools that enable compliant communications.

Back to contents

3. Outlining regulatory expectations and guidance

After evaluating your firm’s risk profile and identifying areas where unmonitored mobile device use could be occurring, the next step is to outline regulatory expectations and guidance. In the EU, this includes regulations like the MiFID II directive, which correlates with the Markets in Financial Instruments Regulation (MiFIR) legislation, as well as MAR requirements and even the Markets in Crypto-Assets Regulation (MiCA).

Record retention requirements outlined in the EU’s MiFID II directive

The MiFID II directive, which was established in 2018, is a comprehensive rulebook aimed to strengthen financial regulation within the EU. One of the core requirements of the directive is to maintain accurate and complete transaction reporting to enhance transparency and support market integrity.

Specifically, MiFID II Article 16 lists that investment firms must take steps to ensure that all records, including voice or electronic communications, are captured for all activities and transactions. Firms are expected to maintain these records for a period of five years, or up to seven if requested by an authority.

This directive is applicable to all communications that involve business activity, regardless of channel used, and was established to deter business conversations that fall outside a firm’s scope of capture.

Back to contents

Record retention requirements outlined in the EU’s MiFIR legislation

Alongside MiFID II, MiFIR focuses on the technical aspects of reporting and transparency. MiFIR requires EU-based firms to retain detailed trade and order data, whether on their own account or on behalf of a client, which then needs to be reported to a central repository so that regulators can access it for market oversight.

While MiFID II is more focused on compliance documentation, MiFIR standardizes regulatory reporting requirements across EU-firms.

Recordkeeping and archiving rules outlined in the EU’s MAR

Alongside MiFID II and MiFIR is the MAR, which came into force in 2016. MAR was implemented to tighten recordkeeping requirements and more effectively address market abuse occurring across new platforms. It specifically targets insider dealing, unlawful disclosure of insider information, and market manipulation.

MAR states that firms must maintain detailed records of all communications, transactions, and decisions that are related to market activity for review and investigation purposes. New communications channels introduce new avenues for financial misconduct, reinforcing the need for robust governance and complete communications oversight.

Recordkeeping rules outlined in the EU’s MiCA

Beyond recordkeeping requirements for traditional financial firms, crypto asset service providers should also be aware of MiCA. With digital assets becoming more steadily integrated into the industry, MiCA’s goal is to ensure investor protection and market integrity where crypto activity is concerned.

MiCA outlines data standards around record retention for crypto-asset service providers (CASP) who handle order placements or transaction executions. CASPs are expected to retain records of all crypto-asset services, activities, orders, and transactions.

Back to contents

4. Securing support across the business

Effective communications compliance requires collaboration across business lines. By initiating conversations with other departments to understand the communications channels they use and what controls may already be in place, you can present the business-wide benefits of mobile device compliance.

There are a wide range of departments outside of compliance functions that will benefit from better access to communications data and stronger device compliance.

These departments include:

Legal
By ensuring all business-related communications, including mobile communications and social media interactions, are properly captured and retrievable, legal teams are given access to a pool of necessary data that will enable them to proactively manage risk and ensure policies align with global and local regulations.

IT and cybersecurity
These teams manage device provisioning, mobile device management (MDM), and access controls, as well as the implementation of technical safeguards and security infrastructure. IT and cybersecurity leaders will want to ensure solutions support protected device management, encryption standards, and secure APIs for scalable cloud-based applications.

Back to contents

Security and risk management
Risk officers and security professionals are tasked with reducing organizational exposure to fraud, data leaks, and regulatory violations. This is the bread and butter of your CCO’s oversight. By framing your proposal around risk mitigation, particularly the risks associated with mobile devices, you appeal directly to their priorities.

HR and employee experience
Human Resources (HR) teams are concerned with employee privacy, onboarding, and ensuring acceptable use policies are clearly communicated and enforced. A mobile compliance solution with configurable permissions and user-friendly interfaces supports these needs while minimizing disruption to employee workflows. HR is also a valuable ally in training and enforcing new policies and securing proactive employee buy in, so support from this department will be critical.

PR and Marketing
Social media and mobile messaging platforms are commonly used for corporate announcements, media relations, marketing activity, and crisis communication. These activities must be conducted in a compliant manner to avoid reputational and regulatory consequences. A mobile compliance solution that captures content across all messaging platforms ensures communications are archived, searchable, and defensible—whether they originate from official accounts or mobile devices. Demonstrating this capability can win support from teams focused on brand protection and external transparency.

Document discussions with relevant stakeholders to demonstrate cross-departmental alignment and identify shared priorities. This helps strengthen your proposal by highlighting common goals, success metrics, and broad support across the business.

Back to contents

5. Researching potential solutions

Once you’ve secured support across the business, you’ll need to lay out the potential solutions to address compliance risk posed by mobile devices. Research technology platforms and policy enhancements that can directly eliminate the gaps identified in your risk assessment.

First and foremost, your mobile device capture tool should be able to capture communications across all channels where business activity is taking place. These tools shouldn’t restrict communication, but instead enhance employee experience and foster collaboration while ensuring compliant use.

In addition, look out for the following features when researching communications compliance solutions:

Archiving and eDiscovery
On top of simply storing communications data, a scalable, structured archiving system can make a huge difference when it comes to eDiscovery. Tools that can filter through and zero-in on relevant communications are invaluable during litigation where information must be presented completely and at a moment’s notice.

Back to contents

AI-enabled eDiscovery
Beyond capturing business communications occurring on mobile devices, AI-enabled discovery can enrich data insights. AI-enabled risk monitoring tools can also recognize patterns, analyze sentiment, and proactively flag potential threats.

Risk monitoring
In addition to communications capture, advanced monitoring solutions can identify, evaluate and justify flagged risks to allow teams to escalate misconduct before it becomes a regulatory or legal issue.

In addition to researching the benefits of each solution, make sure you consider all logistical and functional elements of implementation. Does this tool integrate with existing systems? What’s the timeline for deployment? Can you verify vendor credibility? What are the cost estimates? All of these will be important to structuring your argument when explaining how an upgraded mobile device compliance plan will work within your organization.

Back to contents

Conclusion: Pitching the proposal

Now, the final piece of the puzzle: building a strong business case and pitching the proposal. The key to supporting your case is to demonstrate not only the potential repercussions of poor compliance policies, but the multiple benefits of more effective mobile compliance.

By investing in a strong mobile device compliance strategy, firms can avoid much greater costs—a point that will greatly resonate with CCOs and the executive board. The benefits of proactive communications compliance to underscore when making your case are:

Avoiding costly fines and legal action
Non-compliance with recordkeeping rules can result in hugely costly enforcement actions.

Efficiency gains
Centralized mobile data capture reduces the time and manual effort of audit prep and legal holds. It also helps optimize lengthy data search and sourcing processes.

Protect your reputation
One data breach or investigation involving unmonitored mobile communications can significantly erode stakeholder—and public—trust.

Futureproofing
Regulators continue to scrutinize digital communications. Being proactive reduces risk exposure over time, and allows you to stay ahead of the compliance challenges of evolving communications channels.

With a strong business case, you can prove that proactive investment in mobile device compliance will help to save long term, provide a competitive edge, and increase collaboration and productivity both internally and externally.

Back to contents

Why Global Relay for Mobile Device Compliance

With over 25 years of experience in recordkeeping and risk mitigation, Global Relay understands the risks posed to your organization and the tools you need to manage them. Global Relay’s suite of mobile device compliance solutions enables firms to meet mobile data retention and preservation requirements for both corporate device and BYOD policies, ensure good digital communication governance to boost efficiency and resilience, detect bad conduct and emerging risk, and find the data you need when it matters most.

Learn more

Back to contents