The FCA has warned firms about their 'off-channel' communications, which could include mobile phone calls and emails, after its review showed that staff at most firms breach internal policies.

It urged firms to make sure that all staff record relevant communications, either off or on channel.

'Off-channel' communications is a reference to business communications to clients sent via platforms or mobile devices which are not explicitly sanctioned or approved by a firm's compliance department. Examples could include some text messages, messages via social media or emails sent from non-company addresses.

The FCA said its review covered off-channel communications that take place outside of monitored, recorded channels a firm has permitted. 

The regulator surveyed 11 banks and said all had improved their processes over the past two years.

The FCA said: “All firms in our sample could evidence action taken to improve their approach, though to varying degrees. Most, but not all, firms in our sample continue to identify breaches of their internal policies.”

The regulator said the ongoing breaches demonstrated the importance of firms also focusing on improvements in behaviour and not just in detecting off-channel communications.

It said the breaches occurred across all staff grades, with 41% involving individuals at director grade or above. 

Source: FCA Multi-channel review

Looking ahead the FCA advised firms to consider the following key questions:

• Do employees fully understand their responsibility to record all relevant communications?
• Does leadership set a strong 'tone from the top' and encourage a 'speak up' culture for compliance with SYSC 10A?
• Are there any unreasonable barriers preventing staff from following the policy framework effectively?
• Does the firm effectively monitor third-party vendors to ensure expected performance and reliability?
• Is the firm's surveillance model well-aligned with its business model?
• Where a global framework is in place, do UK senior managers have sufficient oversight of its implementation and results?
• Do accountable executives receive the right MI to oversee compliance and assess surveillance effectiveness?
• Where patterns of non-compliance emerge, do accountable Senior Management Functions (SMFs) take prompt corrective action?