Communications compliance is no longer defined by a single rulebook. It is shaped by a patchwork of regimes, each built for a different market, that collectively force regulated firms to capture, store and produce communications evidence on request.
According to Wordwatch, a UK trading desk can fall under MiFID II, MAR and FCA conduct rules simultaneously, while a US broker-dealer answers to the SEC, FINRA and, for swaps business, the CFTC. Add an EU entity into the mix and DORA stacks on top of all of it.
One misconception recurs across the sector: the idea that US rules demand records be kept in “original format for the first two years.” That phrase does not appear in SEC Rules 17a-4 or 18a-6. Instead, those rules require records that are complete, unaltered, verifiable and quickly retrievable, six years for 17a-4(a) records and three for communications under 17a-4(b).
Preserving the original file has become the industry’s default method of proving all four conditions at once, but it remains a control choice rather than a legal mandate.
Enforcement, rather than the rules themselves, has shifted hardest. ESMA logged €44.5m in MiFID II and MiFIR fines across 294 actions in 2024, up from €18.3m the year prior, while MAR sanctions from 24 national authorities reached €45.5m, led by a €20.7m penalty from France’s AMF.
In the UK, the FCA’s August 2025 review of off-channel communications found 178 policy breaches across 11 wholesale banks in a single year, 41% involving director-grade staff.
Across the Atlantic, the SEC and CFTC’s off-channel sweep has cooled since its 2021 peak, but its legacy has not: roughly 100 organisations have been charged and over $2bn levied since it began.
The CFTC’s one-year floor for oral communications under Rule 1.31(b)(2) is frequently misread as a target rather than a minimum, particularly where the same call is also evidence under MiFID II or a litigation hold.
Asia-Pacific regulators are converging on similar expectations. Hong Kong’s SFC ties data location directly to licensing conditions, Singapore’s MAS is tightening reconciliation demands under MAS REWRITE, and Australia’s ASIC has flagged voice notes and encrypted messaging as capture gaps under Information Sheet 283.
For multi-jurisdiction firms, three defaults tend to resolve the overlap: apply the longest retention clock across all applicable regimes, preserve original files even where not strictly mandated, and unify capture across voice, chat, email and mobile channels rather than running separate systems per regulator.
The full Wordwatch post can be read here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
