Most communications surveillance alerts are a keyword out of context, and a few are the most important evidence a firm ever holds. The agent reads each flagged message in its full conversation, links it to the trading or customer activity around it, and drafts a context note. A surveillance analyst decides the alert, and escalations go to compliance.
What is communications surveillance, and who owns it?
Communications surveillance monitors staff communications, such as recorded calls, email and chat, for signs of market abuse, collusion, mis-selling, conflicts of interest or other misconduct. Rules in many markets require firms in trading and investment businesses to record and keep certain communications and to have arrangements to detect market abuse. Surveillance tools flag messages using lexicons or models; analysts review the flags.
The surveillance team, within compliance, owns alert review. Escalations go to a surveillance manager and, where they suggest market abuse, to the person responsible for reporting suspicious transactions and orders. Employment matters go to HR. Because the subject is staff, data protection and employment law shape what is monitored and how. Whether an AI agent can monitor staff communications for misconduct covers those limits.
What does the agent do at each step, and at what depth?
- Agent, depth 1: reads the alert and the flagged message.
- Agent, depth 1: reads the surrounding conversation. Messages before and after, other participants, and any related threads in the same period. Context is what separates a joke from a plan.
- Agent, depth 1: links to activity. Trades, orders or customer transactions by the participants around the time of the message, read from the trade surveillance or order systems within scope.
- Agent, depth 1: checks the participants. Roles, desks, information barriers, restricted lists and prior alerts.
- Agent, depth 2: drafts the context note. What the message says in context, what activity sits around it, why it might be innocent, why it might be concerning, and what is unclear.
- Person, analyst: decides. Close with reason, or escalate.
- Person, surveillance manager: reviews escalations and decides on further investigation or reporting.
- Agent, depth 1: feeds back to tuning. Patterns in false positives by lexicon term or model, for the surveillance team to consider.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Alert | Reads flag and message | 1 | None |
| Conversation | Reads full context | 1 | None |
| Activity | Links trades or transactions | 1 | None |
| Participants | Checks roles and barriers | 1 | None |
| Note | Drafts balanced context | 2 | The disposition |
| Escalation | Nothing | None | Manager decides next steps |
| Tuning | Reports false positive patterns | 1 | Changing lexicons |
Which controls apply, and what evidence does each leave?
No disposition capability. The agent cannot close alerts. Evidence: its capability list, and analyst names on every disposition. The reasons are close to those in whether an AI agent can close AML alerts: closure is a judgement a supervisor will test.
Balanced notes. Each note gives both innocent and concerning readings. Evidence: QA sampling against the note standard.
Scope respected. The agent reads only communications in the surveillance scope, for the participants and period of the alert. Personal communications outside scope are not read. Evidence: read logs tied to alerts.
Information barriers checked. Messages crossing a barrier are flagged regardless of content. Evidence: barrier checks on each note.
Tuning separated from review. Lexicon and model changes go through change control with testing; the agent only reports patterns. Evidence: change records.
What should you measure?
- Analyst time per alert.
- Escalations by analysts where the agent's note leaned innocent. Each should be reviewed.
- Alerts closed then reopened.
- False positive patterns reported and acted on.
- Coverage: channels and staff in scope that the agent can read, against the surveillance policy.
Where does it usually go wrong?
Reading the message alone. A single flagged line rarely means anything without the conversation. The agent must read the thread.
Missing coded language. People engaged in misconduct avoid obvious words. Activity linked to communications, such as a trade shortly after a call with a client, can be more telling than any word.
Over-reach into private life. Staff use work channels for personal matters. Surveillance of those messages should stay within what the policy and law allow. The agent should note when content is personal and not relevant.
Customer-facing communications forgotten. Surveillance often focuses on market abuse and misses conduct towards retail customers. In the UK, the expectations in FCA Consumer Duty and AI agent communications with customers apply to how agents and staff communicate.
Trade and communications reviewed in silos. A trade alert and a communications alert about the same person on the same day should be reviewed together; see reviewing trade surveillance alerts.
Languages and channels outside the tool. Staff switch to another language, or to a channel the surveillance tool does not capture. The agent can only review what it receives. It should flag conversations that refer to moving elsewhere, such as "call me on my mobile", because those references are themselves a signal for the analyst.
The overall stance on compliance agents is in AI compliance agents.
Where Pryme fits
In Pryme, the reviewing agent holds depth 1 on communications within the surveillance scope and depth 2 for context notes. Closing an alert is outside its role scope, so an attempt is refused and filed, and the verdict names role scope as the deciding bound. Attest certifies the note-drafting capability on the firm's own past alerts before it runs.
Questions people ask
Can the agent listen to recorded calls?
It can read transcripts produced by a speech-to-text service, within the same scope rules. Transcription errors matter, so analysts should listen to the audio for any alert they escalate.
Should staff know an agent reviews their communications?
Your monitoring notice should describe how communications are monitored, including the use of automated tools. Transparency with staff is part of lawful monitoring in most markets.
Can the agent review its own communications with customers?
Agents that talk to customers should be surveilled too, but not by themselves. Use a separate reviewing agent or people, so the checker is independent of the checked.