It’s just about 3 p.m. on a Friday, and a trader is working from home. His demeanor is a bit more casual compared to Monday morning, and he decides to leave his desk briefly to grab a beer from his refrigerator, return to work and hop onto a video conference call with his colleagues. Unfortunately for this trader, his actions are being surveilled using Citycom Solutions’ ARC Surveil solution, and the beer bottle will be flagged.

This scenario is hypothetical, but Mark Whiteman, Citycom’s chief executive officer, says that the presence of alcohol bottles while working is a signal that the vendor has been asked to deploy to its ARC Surveil compliance offering for audio and video communications. “It may seem crazy, but we’ve been asked for that because if people are working in an isolated environment by themselves, it’s a Friday afternoon, it gets to three o’clock, they’ve had a busy week, there is a temptation to do something you wouldn’t do in the office.”

As a result of the pandemic, video conferencing platforms like Zoom, Microsoft Teams, Google Meet, and Cisco Webex have become an everyday part of the job, whether working from home or working in the office but still communicating with someone remote. Five years ago, these platforms were not sophisticated enough to handle the volume of video calls that we see today. Today, as long as someone has a computer and internet access, they can connect with clients and colleagues around the world at any time.

But here’s the rub: surveillance systems have not kept up with the video conferencing boom, and in the highly regulated markets of trading, that creates points of weakness, ripe for exploiting.

Compliant comms

Following the 2008 financial crisis, regulation including the Dodd-Frank Act in the United States and Mifid II in Europe required more stringent surveillance of trading personnel, including the recording and archiving of all conversations related to trades. Dodd-Frank stipulates that all information related to an executed trade must be retained for up to five years in secure storage. Mifid II requires records be kept and made easily accessible for up to seven years at the request of regulators. This was an expansion on the original requirement of six months in the EU.

Last December, JP Morgan Securities was fined by both the Securities and Exchange Commission and the Commodities Futures Trading Commission for a total $200 million for allowing employees to use WhatsApp and other messaging platforms for business purposes on personal devices. The use reportedly went back to 2015 and even included non-compliant use by actual compliance officers in the firm. SEC officials cited the failure of the firm to record and keep those conversations as a violation of federal laws that left the regulator unaware of conversations between brokers and clients.

When the pandemic made home the new office in March 2020, many say regulators took a “do your best” attitude due to the uncertain atmosphere. That tone has shifted now, says Chris Wooten, executive vice president of Nice Systems’ Vertical Markets group, which oversees the company’s surveillance and compliance offerings. “The regulators are saying there’s lots of different flavors out of there and different ways you can communicate, and they require that they all be captured, so all of that can be surveilled,” he says.

Shifting focus

With so many mediums to keep a watchful eye on, that’s easier said than done. Citycom, for its part, is looking to make that surveillance less complicated.

Last January, the UK-based vendor rolled out a compliance offering called Arc Surveil, which uses audio analysis and computer vision, a field of AI that allows computers to derive high-level meaning and patterns from digital images and video, to oversee video communications. Citycom primarily served its bread-and-butter space of trader voice monitoring for 10 years prior to Covid, and has several offerings under the Arc name focused on helping clients with their audio analytics. Mark Whiteman, Citycom’s chief executive officer, describes the relationship between the pandemic and digitization like “the penny that shoved all the other pennies down the line.”

The company expanded its coverage beyond audio to video so that compliance teams had a sense of both what was being said and what was being done onscreen. The computer vision analysis in the offering can be broken down into three parts: facial, object, and gesture recognition.

The facial recognition can identify the known individuals sitting in a video call as well as those who are unknown. “So the risks in a compliant arena is that we’re having a conversation that should just be between you and me, but someone could walk past, lean over and God forbid, take a picture of the screen,” Whiteman says. Arc Surveil wouldn’t be able to identify that person but can red flag them as an unknown person.

The facial recognition technology has the ability to map 78 points on a person’s face, and can confirm an individual’s identity regardless of hats, beards or masks with 99.9% accuracy, according to the vendor. It then combines that with voice biometrics and other factors such as a biometric pattern of an individual’s keystrokes. The facial recognition is so granular that it can detect a person’s blood pressure and heart rate, whether someone is lying based on their iris size, and whether someone is a “live” person or a synthetic re-creation based on muscle movements and “natural” reactions.

The object recognition can pick up items like pens, mobile phones, cameras, and bottles of alcohol. Whiteman says the system can be trained to recognize genuine objects as well as gestures. A trader could be speaking positively about their position on stock while simultaneously shaking their head “no,” reinforcing a need for both audio and video analytics to play a role in surveilling communications.

Yu Kong, a professor at the Rochester Institute of Technology (RIT), says there can still be shortcomings of a machine performing facial or object recognition. “For recognizing a person’s face, the lighting condition can be changed over time, and the machine needs to be able to recognize [that] no matter if we have a strong light or we don’t have enough light,” he says. Additionally, the varying sizes of people and the aging process can pose challenges to long-term success as well, he says.

Early days

In April 2020, financial messaging vendor Symphony Communications unveiled its Meetings offering, which it described as a more secure and compliant option for financial services organizations to hold online meetings. Today, the company also has an integration with Zoom and is currently working on integrations with other video platforms used by financial firms.

While Symphony currently doesn’t operate in the video analytics space, they do offer recording abilities for customers using Meetings that can then retain the information and take it to their retention solution.

Michael Lynch, chief product officer for Symphony, says that determining what should be considered an electronic communication is important as firms navigate these new technologies. If someone sits in front of a wall full of sticky notes or moves their hands during a call, does that need to be electronically retained?

“I think firms are adopting or will adopt analytics from a best-practices point of view to stay ahead of it,” Lynch says. “But I would also expect over time that regulators will start putting more requirements around video retention, not just screen sharing and whiteboarding.” (Whiteboarding refers to the process of brainstorming that can be done in person or remotely. If done remotely, it can involve drawing, placing virtual sticky notes, sending files or typing notes.)

Software vendor Nice Actimize, a division of Nice Systems, has rolled out recording offerings for both Microsoft Teams and Zoom under its NTR-X solution. The solution archives and manages the data coming from those conversations and can then apply audio analytics to transcribe audio as well as run natural language-processing analysis to classify communications. The vendor also offers trade surveillance solutions that can understand what trades and deals were done.

Steve LoGalbo, director of compliance product management at Nice, says that the company is in a research and development phase with its video analysis capabilities. Potential use cases include the sharing of sensitive documents on a screen, detecting what applications are being shared as well as object and facial recognition.

LoGalbo says that analytics in video is behind those in audio and written communication due to the massive volume of data. “The data that video generates is massive, so that first challenge was trying to manage the new volumes of data that we’re now generating and creating,” he says. He contributes the shift to cloud-based platforms for compliance abilities as a major factor in being able to expand and grow data volumes.

Nice has also built out anomaly detection models that create profiles of how individuals are communicating. These models can detect and record the number of emails someone sends per day, the number of video and phone calls made, and the number of chat messages sent. Unusual behavior can then be pinpointed when someone doesn’t appear to be sending as many chats as their peers or using communication channels differently.

But he also notes that it’s still early days when it comes to deeper, more robust forms of video surveillance.

A long road ahead

Customer engagement vendor Verint rolled out its compliance recording integration for Zoom on April 11, adding to its offering for Microsoft Teams. Philip Fry, vice president of financial compliance at Verint, says platforms like Teams and Zoom have general archiving solutions, but they’re not built for the specific regulatory needs of capital markets firms. “They’re built for a wider enterprise market; they’re not built for financial compliance,” he says.

Fry says it’s important that AI and NLP be used to continually improve the process of recording and understanding what is said in a conversation. “The reality is in the financial markets, people are talking in two, three languages in one conversation,” he says,” They’re talking, they’re doing a swap or trade and that language itself is like a tribal language.” And then, of course, there are non-verbal cues.

On the video side, Fry says there is skepticism from firms they serve due to the gray area around what regulators actually require and because they don’t believe the technology around video analysis is good enough yet. At this present time, Verint doesn’t have a single tier-1 bank client doing video-capture analysis. He points to the use of blurred and green screen backgrounds (a capability available on both Zoom and Microsoft Teams) as something that could mask non-compliant actions in the background. “How do you know there isn’t somebody else in the background listening to the call?”

Microsoft declined to comment for this story. Zoom, in a statement to WatersTechnology, said: “We recently published a blog about our archiving solution. This feature is intended for our regulated users—Zoom users in financial services institutions who are subject to regulatory oversight, including from the Securities and Exchange Commission or Financial Industry Regulatory Authority—who need to be equipped with technology designed to support compliance requirements as well as frictionless communication and collaboration. The archiving solution needs to be set up at the administrator level. The archiving solution utilizes an API connection to one of our leading archiving vendors, and is different from cloud recording, which saves video, audio, chat, and transcription files to the Zoom cloud.”