Editor’s Note: Off-channel communications enforcement is crossing the Atlantic, and HaystackID is moving to meet it. On June 15, the company introduced COMET, a tool that captures employees’ business messages on personal devices on a recurring schedule, then put it at the center of a European push timed to LegalTechTalk in London. The hook is the gap between U.S. and European enforcement: regulators in Washington have collected billions since 2021, while the Financial Conduct Authority, BaFin, and ESMA are only beginning to press the same recordkeeping demands under MiFID II.

For cybersecurity, data privacy, compliance, and eDiscovery professionals, the stakes are concrete. The messages a surveillance team captures today are the disclosures a legal team produces tomorrow, which makes the collection method a defensibility question, not a checkbox. Firms operating in regulated European markets should map where their off-channel exposure sits and how that data would survive a regulator’s request.

Watch the FCA’s next multi-firm findings and the first European penalty that mirrors a U.S. sweep; that is the signal the cycle has begun in earnest.


Content Assessment: Europe's off-channel reckoning: HaystackID bets COMET on a messaging crackdown crossing the Atlantic

Information - 93%
Insight - 92%
Relevance - 92%
Objectivity - 90%
Authority - 92%

92%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Europe's off-channel reckoning: HaystackID bets COMET on a messaging crackdown crossing the Atlantic."


Industry News – eDiscovery Beat

Europe’s off-channel reckoning: HaystackID bets COMET on a messaging crackdown crossing the Atlantic

ComplexDiscovery Staff

Disclosure: ComplexDiscovery OÜ’s Editor and Managing Director, Rob Robinson, also serves as chief marketing officer of HaystackID. This article is based on a press release issued by HaystackID on June 15, 2026.

HaystackID introduced a tool on June 15 for capturing employees’ business messages on personal phones, wagering that European regulators will press the off-channel enforcement that has cost Wall Street billions since 2021.

The wager is specific. For four years, U.S. firms have paid for what their bankers typed into WhatsApp and texted off the record. Now the company is positioning for the moment when those same demands land on regulated firms in London, Frankfurt, and across the European Union.

Why Europe is the next front

The pattern in the United States is by now well documented. Since December 2021, the Securities and Exchange Commission and the Commodity Futures Trading Commission have charged over 100 firms for failing to preserve business communications sent through personal messaging apps. A single 2022 sweep produced $1.8 billion in penalties across 16 firms. Industry tallies since put combined SEC, CFTC, and FINRA off-channel penalties above $3.5 billion.

European authorities have started down the same road, though from a different statutory base. Under Article 16(7) of the second Markets in Financial Instruments Directive, known as MiFID II, investment firms must record telephone and electronic communications tied to client orders and keep them for five years. Germany’s BaFin enforces the obligation through national securities law. In the United Kingdom, the Financial Conduct Authority published a multi-firm review in August 2025 of 11 wholesale banks that identified 178 breaches of firms’ internal communications policies in the prior 12 months, with 41 percent involving directors or senior managers.

The European Securities and Markets Authority reported that MiFID II penalties across the bloc reached 44.5 million euros in 2024, a 143 percent jump over the prior year. The numbers remain a fraction of U.S. totals. HaystackID is betting the gap closes.

“European regulated firms already have strict recordkeeping obligations, and off-channel communications enforcement adds greatly to this complexity,” said John Wilson, chief information security officer and president of forensics at HaystackID. “The records compliance teams capture today are the disclosures legal teams rely on in the regulatory investigations and civil litigation that follow.”

What COMET is built to do

The product, branded HaystackID Compliance Oversight for Mobile Electronic Transmissions, or COMET, performs targeted, scheduled, recurring collection of business mobile communications. The company casts it as a sister offering to its Mobile Elite Discovery and Analysis Lab, the MEDAL suite it launched in early 2024 for mobile device collection in investigations and litigation.

The distinction matters for buyers. MEDAL was built for the reactive moment, the investigation or lawsuit already underway. COMET is aimed upstream, at compliance and surveillance officers who must capture communications on a recurring schedule before any dispute exists. Wilson said the company chose to introduce it at LegalTechTalk because the European legal community is where the next two- to three-year enforcement cycle will be argued and disclosed.

That framing connects compliance capture to downstream discovery, a connection compliance officers should weigh now rather than after a regulator calls. Records gathered for surveillance today become the evidence produced in litigation tomorrow, and the collection method either holds up or it does not.

The AI governance question

HaystackID is folding the launch into a wider European push organized around artificial intelligence in legal and compliance work. The company plans to demonstrate generative AI tools for investigations, a privacy platform it says identifies personally identifiable information exposure in a single scan, and an end-to-end response workflow for data subject access requests under European privacy law.

The demand driver is regulatory, not technological. The disruption AI is bringing to the workplace is driving a sharp rise in data subject access requests, or DSARs, and other regulatory actions across Europe, said Jeff Shapiro, managing director for Europe at HaystackID, who joined the company in February 2026 to lead its expansion on the continent. Organizations deploying AI for investigation and compliance, he said, must do so within localized boundaries that protect personal data.

Independent analysts read the same convergence. “We are seeing a rapid shift from traditional models and static controls to more agile processes that require greater integration between the compliance and legal obligations, particularly in highly regulated industries and markets,” said Ryan O’Leary, research director for privacy and legal technology at IDC. The global market for security governance, risk, and compliance services will reach about $22.8 billion by 2029, according to an IDC forecast cited in the company’s announcement.

A wider European bet

The COMET launch sits inside a larger commitment. HaystackID is also attending RelFest London the same week to support customers running Relativity e-discovery platforms, a partnership it has held since 2014. Wilson is scheduled to speak on June 17 on a conference panel about cross-functional cyber governance, joined by Anju Malik, associate general counsel at Omnicom, and Komal Gupta, chief innovation officer at Cyril Amarchand Mangaldas.

“The European market has unique regulatory and privacy challenges that require excellence in both technology and services,” said Chad Pinson, chief executive of HaystackID. The company said it intends to increase its investments across Europe.

For compliance leaders watching the U.S. enforcement record, the practical question is not whether recordkeeping obligations exist, but how aggressively European and UK regulators will test firms’ controls for off-channel communications. Which firms will have that answer ready before an examiner asks, and which will be reconstructing it under scrutiny?

News sources



Assisted by GAI and LLM Technologies

Additional Reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).

ComplexDiscovery also provides a ChatGPT-powered AI article assistant for its users. This feature leverages LLM capabilities to generate relevant and valuable insights related to specific page and post content published on ComplexDiscovery.com. By offering this AI-driven service, ComplexDiscovery OÜ aims to create a more interactive and engaging experience for its users, while highlighting the importance of responsible and ethical use of GAI and LLM technologies.