CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel

The week

In late 2024 the U.S. government spent months explaining why, for some people, a text message is far less private than it feels.

The trigger was a series of disclosures about intrusions into U.S. telecommunications networks, the systems run by phone carriers that route our calls and texts. U.S. agencies attributed them to a China-linked group known as Salt Typhoon, which they said had stolen call records and accessed some communications. In effect, a foreign intelligence operation had found its way inside the plumbing that carries ordinary phone traffic.

The public account built up in stages. On November 13, 2024, the FBI and CISA issued a joint statement. It said actors affiliated with the People’s Republic of China had compromised networks at multiple telecommunications companies and stolen customer call records. They had also compromised the private communications of a limited number of people, mostly involved in government or political activity.

The statement added a further detail: the actors had copied certain information subject to U.S. law enforcement requests made under court orders. Carriers have been required since 1994, under the Communications Assistance for Law Enforcement Act, to support court-authorized interception. The systems that serve those requests are, by design, a window into the network. The agencies did not say how the actors reached that information, but the intruders had evidently come close to some of the most sensitive functions a carrier runs.

On December 3 and 4, CISA, the NSA, the FBI and partner agencies in Australia, Canada and New Zealand published enhanced visibility and hardening guidance for communications infrastructure. It was written for network engineers, not the public. It told them to watch for unauthorized configuration changes, centralize and protect logs, manage devices through a separate out-of-band network, apply default-deny access lists and disable insecure protocols. The agencies said the intrusions had exploited existing weaknesses rather than novel techniques. Around the same time, a senior White House official, deputy national security adviser Anne Neuberger, said at least eight U.S. telecommunications companies had been affected.

On December 18, 2024, the Cybersecurity and Infrastructure Security Agency, or CISA, the federal agency responsible for helping protect civilian networks, published mobile communications best practices for “highly targeted individuals”. It meant people in senior government or political roles likely to interest foreign intelligence services. The document was a few pages long and marked for unrestricted sharing. It told its readers to assume that communications between mobile devices and internet services were at risk of interception or manipulation.

Its advice was concrete. CISA recommended using only end-to-end encrypted communications. That means messages are scrambled on the sender’s phone and unscrambled only on the recipient’s, so anyone in between, including a compromised carrier, sees gibberish. It recommended replacing SMS-based multi-factor authentication, the familiar six-digit code texted to your phone when you log in, with phishing-resistant methods such as FIDO security keys. Those are small physical devices or built-in phone features that prove who you are in a way a fake website cannot trick or intercept. And it recommended setting a PIN on carrier accounts, so that a criminal cannot simply call your phone company, pretend to be you and move your number to their own device.

The list went further. It advised using a password manager, updating software regularly, preferring the latest phone hardware, and avoiding personal VPNs, which shift risk from the internet provider to the VPN provider. For iPhone users it suggested Lockdown Mode and turning off the setting that lets iMessage fall back to unencrypted SMS. For Android users it advised using RCS messaging only when end-to-end encryption was on. It also acknowledged that many organizations already ran secure communication platforms and authentication policies of their own, and directed its steps at cases where they did not.

The guidance was written for individuals but was read widely across industries. For one industry in particular, it landed awkwardly. It arrived while the SEC and CFTC, the regulators of the securities and derivatives markets, were still bringing cases against financial firms whose staff used unpreserved messaging apps for business. Many of those apps were exactly the kind of encrypted messengers CISA was now recommending.

Those cases had a long run behind them. In December 2021, J.P. Morgan Securities admitted that employees, including senior supervisors, had discussed securities business on personal devices through text messages, WhatsApp and personal email, and agreed to pay a $125 million SEC penalty. The CFTC announced a separate settlement for related conduct. In September 2022 the SEC announced settlements with 16 firms and combined penalties of more than $1.1 billion. In August 2024 it announced another 26 firms and $392.75 million, with lower penalties for the three that had self-reported.

So in the same season, one part of the federal government was saying “use encrypted apps” and another was fining firms because staff had used them. For compliance officers on Wall Street and beyond, it looked like a contradiction, though it turned out not to be one.

Take a wealth adviser at a mid-sized brokerage on a Monday in late December 2024. Over the weekend she read that foreign hackers may have been inside the phone networks, and that the government now recommends encrypted messaging. Her biggest client texts her every morning. Her compliance department has spent three years warning staff that texting clients on personal apps could cost the firm heavily. She wants to know, reasonably, which rule she is supposed to break.

For compliance teams at broker-dealers, CISA’s advice arrived at an awkward moment. For three years the Securities and Exchange Commission and the Commodity Futures Trading Commission had fined firms, often heavily. The cause was employees using personal messaging apps, many of them encrypted, for business communications the firms did not preserve. Now a federal security agency was telling senior people to use encrypted messaging apps.

The conflict is narrower than it looks. Recordkeeping rules never prohibited encryption. Broker-dealers must preserve business communications under SEC Rule 17a-4 and FINRA rules; investment advisers, swap dealers and futures commission merchants have their own obligations; banks that are not broker-dealers are outside Rule 17a-4 but carry other retention duties. The enforcement cases arose because communications ran on channels the firm neither controlled nor captured. CISA’s concern was channels an adversary could read. Both point to the same answer: a channel the firm controls.

That channel has three requirements, which are distinct and together sufficient. It must be secure against interception and account takeover, it must be captured and retrievable, and it must be usable enough that staff and clients actually use it.

The differences by type of firm matter from the start. A dual registrant answers to both Rule 17a-4 and the Advisers Act books-and-records rule, Rule 204-2. A credit union that offers investments usually does so through representatives registered with a third-party broker-dealer, so that broker-dealer’s preservation and supervision duties govern those conversations. A bank’s commercial lenders texting borrowers face no SEC preservation rule at all, but their messages can still be discoverable in litigation and relevant to complaint reviews.

The sections that follow start with a short primer on how a message travels and how a record is kept. They then take the three requirements in turn and show how one firm might meet all three at once. The last sections set out a rollout sequence and close with the stakes beyond enforcement, the ways these programs fail and the questions to ask.

Postcards, sealed envelopes and records

Consider what actually happens when you send a text. An ordinary SMS message travels from your phone to your carrier’s network, through the carrier’s equipment and, often, through other carriers’ networks before reaching the recipient. Along the way it is readable by the systems that handle it. SMS was built decades ago for convenience rather than secrecy, and it works like a postcard: anyone who gets inside the post office can read it. Salt Typhoon was, in effect, inside the post office.

End-to-end encrypted messaging works differently. Each phone holds a secret key. Messages are locked on the sender’s device and can be unlocked only by the recipient’s device. The carrier, and even the messaging company, carries a sealed envelope it cannot open. If an adversary taps the network, it sees traffic but not content.

Now the recordkeeping side. U.S. securities rules require broker-dealers to keep copies of business communications, including emails, chats and texts with clients, for set periods and in a form regulators can examine. The point is accountability: if a client later claims an adviser promised something, or a regulator investigates market manipulation, the record must exist. Rule 17a-4 is the SEC rule that sets those preservation requirements for broker-dealers. FINRA, the industry’s self-regulatory body, has parallel rules.

Encryption protects a message while it travels. Recordkeeping captures it at either end. A firm can have both, as long as the firm controls one of the ends. The problem in the enforcement cases lay elsewhere: the conversations happened on employees’ personal phones and personal accounts, where the firm could see nothing and keep nothing.

What encryption leaves exposed

End-to-end encryption hides what was said. It does not hide that a conversation happened. The carrier still routes traffic between two devices, and the messaging service usually knows which accounts talk to each other and when. That residue is called metadata. The November 2024 statement said the intruders had stolen customer call records, which are metadata in bulk. For a foreign service, knowing which officials or executives call which counterparts, and how often, can be nearly as useful as the content.

The ends of an encrypted conversation are also less tidy than the diagram suggests. A message is decrypted on the phone, and may then be copied to a cloud backup, a linked laptop or tablet, or a notification preview on a lock screen. On iPhones, for example, iCloud backups of messages are end-to-end encrypted only when the user turns on Advanced Data Protection. Each copy is another end. A firm designing a channel has to decide which ends it controls and which it simply trusts.

What the record has to be

Rule 17a-4 requires a broker-dealer to keep originals of communications it receives and copies of those it sends relating to its business as such. Most must be kept for at least three years, the first two in an easily accessible place. Electronic records must be stored so that alteration can be detected or prevented.

For years that meant write-once storage that could not be rewritten or erased. Amendments the SEC adopted in October 2022 added an alternative: a system that keeps a complete, time-stamped audit trail of every modification and deletion. That gave firms more freedom in choosing archives. It did not change which communications had to be kept.

Investment advisers keep certain written communications under Rule 204-2, including those relating to advice or recommendations, generally for five years. FINRA Rule 3110 requires member firms to supervise their people and review correspondence. Swap dealers and futures commission merchants keep records under CFTC rules, including Regulation 1.31. The obligations differ in scope and duration, so counsel should map each business line to its own rule set before a firm picks a single design.

Secure: protected in transit and at the account

Salt Typhoon showed that ordinary calls and SMS can be exposed inside carrier networks. End-to-end encryption protects message content even if the carrier is compromised, because only the endpoints hold the keys. For financial firms, the exposure goes well beyond executives. Traders, advisers and relationship managers communicate with clients by phone and text every day, and SMS offers no protection against a compromised network.

Security also covers the account. A messaging identity tied to a phone number can be hijacked through a SIM swap, and an SMS code sent to that number then confirms the attacker. A SIM swap happens when a criminal persuades or bribes a carrier to move a victim’s phone number onto a new SIM card the criminal controls. From that moment, every call and text meant for the victim, including login codes, goes to the attacker.

CISA’s advice to move to phishing-resistant authentication applies here. Firm-issued messaging accounts should be bound to managed devices and protected with passkeys or hardware keys, and carrier accounts for firm phones should carry a PIN. A passkey is a modern replacement for passwords: a secret stored securely on your device that proves who you are without ever being typed or sent in a form a fake site could steal. A managed device is a phone or laptop the firm can configure, monitor and, if lost, wipe remotely.

The same logic applies to customers: high-value accounts and high-risk actions such as wire setup deserve options stronger than SMS codes. If a fraudster can SIM-swap a wealthy client and receive the code that approves a new wire destination, the firm’s own controls have been bypassed through the phone company.

Account recovery is the soft spot

Many organizations upgrade the front door and leave the side door open. A staff member enrolls a hardware key, but the account still accepts an SMS code during recovery, or the old SMS factor stays registered as a fallback. CISA’s guidance noted that enrolling an authenticator app does not automatically remove SMS from an account, and that some services default to SMS during recovery. An attacker who can intercept or redirect texts will use whichever path remains.

The fix is mostly administrative. Identity teams should audit which authentication methods remain registered for each high-risk user and remove SMS where the platform allows. Recovery should run through the help desk with identity proofing, such as a video call checked against a photo on file. Help desk staff need a script and the authority to refuse. The 2023 attack on MGM Resorts, widely reported to have begun with a call to its help desk, showed how much rides on that refusal.

Firm phones or personal phones with a work profile

The cleanest model gives every client-facing employee a firm-owned phone, fully enrolled in mobile device management. The firm controls the apps, the operating system version, the backup settings and remote wipe. The cost is real: hardware, carrier plans, management licenses and support, plus staff who resent carrying two phones.

The alternative lets staff use their own phones with a separated work container, such as Android’s work profile or Apple’s user enrollment. The firm manages only the work side and cannot see personal data. That respects privacy and lowers cost. It also gives the firm less control over the device’s overall security, and staff can still open a personal messaging app beside the approved one. Firms that choose this route lean harder on usability and supervision to keep conversations on the work side.

Either way, firm phones should have the carrier PIN set, operating systems kept current, and SMS fallback turned off on platforms that would otherwise drop to plain text. CISA’s guidance listed that last setting for iPhone users, along with Lockdown Mode. Lockdown Mode is a strong setting with real usability costs, so most firms would reserve it for executives and staff with unusual exposure.

Clients and the wire room

Banks and credit unions have their own expectations here. The FFIEC’s 2021 guidance on authentication and access asked institutions to assess risk for customers and employees alike, and it cautioned that some forms of multi-factor authentication are weaker than others. For high-risk transactions, many institutions verify changes to payment instructions through a call-back to a number already on file, or through a push approval in a mobile app bound to the customer’s device.

A call-back helps only if the number on file has not itself been ported away. Requests to change a client’s phone number or email address therefore deserve the same scrutiny as requests to change wire instructions. A recent change of contact details should itself raise the risk score on any wire that follows.

Captured: preserved, searchable and supervised

Capture is what the regulators require. Messages must be preserved in a compliant archive, retrievable for examinations and litigation, and available to surveillance. Encryption in transit does not prevent this. Capture happens at the endpoint, on a managed device or through an enterprise version of the platform with an archiving integration.

The design choices carry trade-offs.

• Enterprise editions of mainstream platforms preserve the familiar user experience but depend on the platform’s archiving features.
• Capture agents on managed devices work across apps but require device management that some staff resist.
• Purpose-built firm messaging tools capture natively but ask clients to install something new.

Voice deserves the same treatment as text. Recorded lines on trading desks are routine, but mobile calls to clients often are not, and a firm that captures messages while leaving mobile voice uncaptured has moved the gap rather than closed it.

Each approach also adds a party to the chain of custody. The chain of custody is the list of everyone who handles a piece of evidence between its creation and its use; in this case, every system and vendor that touches a message on its way into the archive. The archiving vendor and any capture software become part of the security boundary, so they need the same diligence as the messaging platform. A beautifully encrypted channel that copies every message to a poorly protected archive is only as strong as that archive.

Surveillance teams need captured messages in a searchable form inside the same review tools they use for email. Firms should confirm specific configurations with counsel and compliance, because capture and retention details decide whether a channel is compliant.

A fourth option that cuts against the security advice

Some carriers and archiving vendors can capture SMS and voice traffic on firm-paid lines at the network level, with no app on the phone. That is convenient for compliance and invisible to the client. It also captures the very channel CISA told highly targeted people to stop relying on, since plain SMS is readable inside the carrier. A firm that relies on it has solved the recordkeeping problem by standardizing on the least secure transport. That may be acceptable for routine contact, but the firm should make the choice knowingly and keep sensitive conversations elsewhere.

What a complete capture includes

Modern messaging carries more than text. Edits, deletions, reactions, voice notes, images and attachments can all be part of a business communication, and group chats add membership changes. Some archives keep the first version of a message but not its later edit, or the text but not the attached term sheet. That leaves a gap that surfaces only in an examination or a dispute. Firms should test each feature they allow and record what the archive keeps.

Disappearing messages need an explicit decision. Many encrypted apps let users set messages to expire, which is sound security practice for individuals and poor recordkeeping practice for regulated firms. The approved configuration should disable expiry or guarantee capture before deletion, and the setting should be locked so users cannot change it.

Proving the archive is complete

Examiners and auditors rarely accept “the connector is on” as evidence. A stronger approach reconciles counts: messages sent and received on the platform, by user and day, compared with messages landed in the archive. Gaps open a ticket. Connectors fail when credentials expire, licenses lapse or a platform changes its interface, and a failure that runs unnoticed for months becomes the next finding. A monthly reconciliation report, signed off by an owner in compliance, is evidence a firm can show.

The settled orders point to what else gets examined. In the 2021 J.P. Morgan order, the SEC found that the firm frequently did not search employees’ personal devices when responding to subpoenas. The firm agreed to retain a compliance consultant to review its policies on personal-device communications and its framework for handling employee noncompliance. Policies, exception logs, disciplinary records and evidence of searches in response to requests all belong in the file.

The archive as a target

An archive of client conversations concentrates sensitive data. Access should be limited to the reviewers and investigators who need it, logged, and itself reviewed. Encryption at rest with keys the firm controls, strong authentication for administrators and a tested breach notification commitment from the archive vendor belong in the contract. Retention should follow the schedule, not default to forever. Keeping messages longer than required lengthens exposure without improving compliance, though legal holds can extend specific records.

Usable: good enough that nobody reaches for a personal app

The off-channel cases were, at root, a failure of usability. Staff used personal apps because clients were there and the approved tools were clumsy or absent. Prohibition without an alternative pushes behavior out of sight.

Usability starts with the client. Clients message on the app they prefer, and a relationship manager who ignores them will not keep them. Firms need a scripted, low-friction way to move a conversation onto the approved channel. They also need a method to capture what arrived before it moved, such as forwarding to the archive with an attestation, a short signed statement from the employee that the forwarded messages are complete.

Adoption should be measured, not assumed. The share of client-facing staff actively using the approved channel each week, and the number of self-reported off-channel messages, are better indicators than signed policy acknowledgments. A signed policy tells you people have read the rule. Weekly usage tells you whether they follow it.

Supervisors carry part of the load. A branch manager who texts staff on a personal phone signals that the policy is optional. Requiring managers to use the approved channel for all work coordination, and including their usage in supervisory reviews, sets the norm faster than training. So does making the approved app available on day one for new hires, before habits form.

Each requirement fails without the other two. A secure, usable channel that is not captured repeats the enforcement cases. A captured, usable channel without encryption leaves client data open to a compromised network. A secure, captured channel that nobody uses produces the off-channel behavior it was meant to stop.

Different clients, different channels

The right approved channel varies by business. A retail brokerage serving U.S. households may find that a branded app plus captured texting covers most clients. A private bank or wealth manager with international families will meet clients who live on WhatsApp, and in some markets on WeChat. An institutional sales desk talks to counterparties with their own compliance teams and approved tools, so interoperability matters more than convenience. The design should start from an honest inventory of where conversations already happen, gathered through interviews and anonymous surveys rather than assumed.

The friction budget

Every extra step costs adoption. A second phone, a login that expires every day, notifications that arrive late, or an app that cannot send a photo of a signed form will push staff back to the channel that works. The approved channel deserves the treatment of a client-facing product, with an owner, a backlog, a feedback route and a target for how quickly reported problems get fixed.

Consequences, applied evenly

Usability does not remove the need for consequences. The J.P. Morgan order described firm-wide behavior that reached managing directors and other senior supervisors, which is hard to correct when discipline falls only on junior staff. A published escalation path helps: a first self-reported lapse leads to coaching, and a repeated or concealed lapse leads to formal discipline. Some firms have tied pay to compliance with communications policy. Any approach that touches pay or employment should be designed with counsel and HR, and applied the same way at every level.

One brokerage settles the question

Suppose a regional brokerage with a few hundred advisers decides to settle the question once.

First, it chooses an enterprise messaging platform that offers end-to-end encryption and an archiving connection. Every adviser receives a firm-managed phone with the app installed, protected by a passkey, and the firm sets a PIN on every carrier account. That covers security.

Second, it connects the platform to its existing compliance archive, so messages flow into the same search and surveillance tools reviewers already use for email. It runs the archiving vendor through the same security review it gave the messaging vendor. It also extends call recording to advisers’ firm mobile phones. That covers capture.

Third, it gives advisers a short, friendly script for clients: “For your security and ours, I’ll be messaging you from our secure app from now on; here is a link to set it up.” It sets up a simple button to forward any earlier personal-app messages into the archive. It asks branch managers to run their own team chats on the new platform. And every Monday, the chief compliance officer receives a one-page report showing what share of client-facing advisers used the approved channel in the past week. That covers usability.

Each step is ordinary. Together, they turn an apparent contradiction into a single, defensible design.

Owners and costs

The program in this example has four owners. The chief information officer owns the devices, the platform and the connectors. The chief information security officer owns authentication, device policy and vendor security reviews. The chief compliance officer owns retention rules, supervision and the weekly report. Branch and desk managers own adoption in their teams. Programs without a named owner for each piece tend to stall at the hand-offs.

The costs fall into familiar lines: hardware and carrier plans, device management and messaging licenses, archive connectors and storage, and staff time for training and review. The less visible cost is surveillance load. Capturing more conversations means more keyword hits and more alerts, so reviewers need tuned rules and enough people, or the firm will capture records it never reads.

How the design changes by firm type

A small registered investment adviser may decide that the simplest compliant answer is email and recorded calls, with a ban on business texting that clients hear about at onboarding. That is a legitimate design if it is enforced. A dual registrant needs one channel that satisfies both broker-dealer and adviser rules. A bank with a wealth arm must identify which staff are registered representatives under the broker-dealer’s supervision and set their approved channel accordingly. A futures commission merchant also has CFTC rules on recording oral communications that lead to orders.

Rolling it out without losing clients

The hardest part of this program is rarely technical. It is persuading busy people, many of them clients who owe the firm nothing, to change a habit. A staged approach tends to work better than a single deadline.

Start where the risk and the volume are

Not every employee messages clients. Begin by identifying the client-facing roles that do most of it, usually advisers, traders and relationship managers, and the senior executives most likely to interest an adversary. Put the approved channel in their hands first, on firm-managed phones, with authentication already upgraded. Early users who find the tool works well become its best advocates.

Sequence the technical work before the announcement

The rollout order matters. Devices should be enrolled and authentication upgraded before the messaging app is distributed. The archive connector should be tested with seeded messages covering every allowed feature, including edits, attachments and group chats. The reconciliation report should then run cleanly for a few weeks before advisers invite clients. Announcing a channel that later proves not to capture everything creates the very record gap the program exists to close.

Make the client’s first step trivial

Clients will not read a policy. They will tap a link from someone they trust. The invitation should come from the adviser personally, explain the reason in one sentence, and take less than a minute to accept. Some clients will refuse. For them, the firm needs a clear answer: perhaps email, perhaps recorded calls, perhaps the adviser forwarding each message to the archive. What it cannot be is “carry on as before and hope.”

Close the old door gently, then firmly

For a period, advisers will receive messages on old channels from clients who have not moved. The forwarding-and-attestation process handles those. After a reasonable transition, the firm can set a date after which business conversations on unapproved channels are treated as a policy breach, with supervisors following up on any self-reported cases. Self-reporting should be encouraged, not punished, during the transition; a firm that penalizes honesty will simply stop hearing about the problem.

Keep the senior people visibly inside

Nothing undermines a messaging program faster than a senior leader who is seen to be exempt. The most effective signal a chief executive can send is to use the approved channel for every work conversation, including with the board, and to say so. The executives most likely to be targeted by intelligence services, as CISA’s guidance made clear, are also the ones whose example the rest of the firm watches most closely.

Review, then adjust

After the first few months, the weekly usage numbers will show where adoption is lagging, by branch, desk or role. Those numbers are a prompt for conversation, not a scoreboard for blame. Often the cause is practical: a feature clients want, a slow login, a team that never received phones. Fixing those is cheaper than any enforcement.

Plan for departures

Offboarding is where captured channels most often leak. When an adviser leaves, the firm needs to disable the account, preserve its history, wipe firm data from the device and tell affected clients how to reach the firm. Clients who keep texting a departed adviser’s personal number are an off-channel risk the firm can no longer supervise.

Beyond the recordkeeping cases

For financial firms, this is first a regulatory matter. Recordkeeping cases have been expensive and public, and the obligations behind them remain in force. But the stakes reach further.

• Client trust. Clients share sensitive financial details by message. If those messages travel over channels an adversary can read, the firm is exposing them.
• Fraud. SIM swaps and SMS code interception are routes to account takeover and fraudulent wires. Stronger authentication protects both staff and clients.
• Litigation. When a dispute arises, the firm that has a complete record can defend itself. The firm that does not is at the mercy of whatever the other side kept.
• Culture. Off-channel use is a habit, and habits are set by leaders. A senior executive texting from a personal phone undermines every policy below.

Firms outside financial services face versions of the same question. Health systems, law firms and government agencies all have retention duties, and all have staff who would rather use the app on their own phone.

Health systems

Hospitals have faced the same tension between clinicians’ habit of texting and the need for a secure, recorded channel. The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information in transit and to keep audit controls. For years the Centers for Medicare & Medicaid Services told hospitals not to text patient orders. In early 2024 it revised that position, allowing orders to be texted among the care team through a secure platform, as long as they reach the medical record. The design problem matches the brokerage one: encryption, capture into the record, and a tool clinicians will use.

Government agencies

Federal agencies operate under the Federal Records Act. Since a 2014 amendment, an officer or employee who uses a non-official electronic messaging account for agency business must copy or forward the message to an official account within 20 days. Encrypted apps with disappearing messages make that hard to meet. State public records laws, which vary by state, raise the same tension for state and local officials. For agencies, CISA’s advice and records law point to the same answer as for brokerages: an encrypted platform the agency controls and archives.

Where this argument is weakest

Three objections deserve an answer. First, CISA’s guidance targeted a small group of people likely to interest foreign intelligence services, not every wealth adviser. True, but the controls that defeat a state actor reading SMS also defeat the far more common criminal who SIM-swaps a client to approve a wire. The threat models differ while the control sets largely overlap.

Second, a firm-controlled archive gathers sensitive conversations into one place, which raises the payoff for an attacker. That risk is real, and it is why the archive needs the same scrutiny as the platform. Skipping capture altogether is not an option for broker-dealers or advisers.

Third, the cost may be hard to justify for a small firm. For some small advisers, a strict ban on business messaging, enforced and explained to clients, is the better answer. The three requirements still apply. Such a firm simply meets them with fewer channels.

How messaging programs fail

• Banning messaging apps outright without offering a usable alternative, which drives the behavior underground.
• Choosing an archiving tool without vetting its security, so the record becomes the weakest link.
• Capturing text but ignoring mobile voice calls.
• Counting signed policy acknowledgments as evidence of compliance.
• Exempting senior people, in practice if not on paper.
• Continuing to rely on SMS codes for staff logins and client wire approvals.
• Leaving SMS fallback on for firm phones, so encrypted messages drop to plain text whenever the encrypted service is unavailable.
• Allowing disappearing messages on the approved channel without checking that capture happens first.
• Assuming a connector works because it was configured once, with no reconciliation of message counts.
• Testing capture with plain text only, and missing edits, deletions, attachments and group membership changes.
• Offboarding staff without preserving their history or telling their clients how to reach the firm.

Phones, archives and habits

1. What channels do our client-facing staff actually use to talk to clients, and how do we know?
2. Which of those channels are encrypted end to end, and which are captured in our archive? Which are both?
3. Do we still use text-message codes for staff logins or for approving client wires? What would replacing them take?
4. What share of client-facing staff used the approved channel last week? Is that number going up?
5. What do our senior leaders use to message each other about work?

With hindsight

Salt Typhoon proved broad and persistent. Before the end of December 2024, White House officials said the count of affected U.S. telecommunications companies had risen to nine. In January 2025 the Treasury Department sanctioned a Chinese cybersecurity company, Sichuan Juxinhe Network Technology, for its role in the campaign.

In August 2025 CISA, the NSA, the FBI and partner agencies from a dozen other countries published a joint advisory (AA25-239A). It described activity since at least 2021 against telecommunications, government, transportation, lodging and military networks worldwide. The actors had mostly exploited known vulnerabilities in edge devices, including products from Ivanti, Palo Alto Networks and Cisco, and the advisory said zero-day exploitation had not been observed. They modified backbone and edge routers to keep long-term access. That confirmed that carrier channels should not be treated as private, and that the way in was ordinary unpatched equipment.

The regulatory response aimed at the carriers was uneven. In January 2025 the outgoing FCC leadership adopted a ruling that read the 1994 interception law as requiring carriers to secure their networks against unlawful access. The commission under new leadership rescinded it in November 2025, relying instead on carriers’ voluntary commitments. For the carriers’ customers, the practical position did not change: treat the network as untrusted and protect content at the ends.

On the securities side, the SEC announced another batch of off-channel settlements on January 13, 2025: nine investment advisers and three broker-dealers, $63.1 million in combined penalties, and a lower penalty for the one firm that had self-reported. Leadership changed a week later and the enforcement emphasis shifted, but the recordkeeping rules did not. A change in enforcement tone does not change the obligation to preserve business communications, and a future examination or lawsuit will still ask for the records.

Encrypted apps became targets in their own right. In February 2025 Google’s threat intelligence team reported that Russia-aligned actors were trying to take over Signal accounts by tricking users into linking an attacker’s device, often through malicious QR codes. The encryption held. The account around it was the weak point, and the fix was procedural: check linked devices regularly and distrust unexpected invitations. That episode is the reason the authentication half of CISA’s advice mattered as much as the encryption half.

Two 2025 episodes showed the requirements failing one at a time. In March, senior U.S. officials discussed military plans in a commercial encrypted group chat outside records systems. That was the security requirement met without capture: encrypted, but not recorded where the rules required. In May, TeleMessage, a vendor whose modified messaging apps archived encrypted messages for government and corporate clients, was breached.

CISA added a TeleMessage flaw to its catalog of known exploited vulnerabilities, the agency’s list of software weaknesses that attackers are known to be using, on May 12, 2025. The flaw was that the archiving back end kept unencrypted copies of messages, contrary to the vendor’s own description of end-to-end encryption. That was the capture requirement met without adequate security. Capture tools are part of the attack surface, and every system that holds a copy of sensitive conversations is a target.

CISA itself then narrowed the gap between the two camps. In November 2025 it revised the mobile guidance, extending it to people in military positions and adding advice on securing messaging apps: be wary of social engineering, verify group invitations, and review linked devices. It also said that on employer-issued devices, users should turn on disappearing messages only where records retention policies allow it and the law permits. The security agency had written the records requirement into its own advice.

The year that followed reinforced the three-part test rather than replacing it. Secure, captured and usable remain the right requirements, and each of the 2025 episodes can be read as a failure of one of them. The practical takeaway is to treat the whole chain, from the phone to the archive, as one system to be secured and tested together.