Editor’s Note: Off-channel communications enforcement is crossing the Atlantic, and HaystackID is moving to meet it. On June 15, the company introduced COMET, a tool that captures employees’ business messages on personal devices on a recurring schedule, then put it at the center of a European push timed to LegalTechTalk in London. The hook is the gap between U.S. and European enforcement: regulators in Washington have collected billions since 2021, while the Financial Conduct Authority, BaFin, and ESMA are only beginning to press the same recordkeeping demands under MiFID II.
For cybersecurity, data privacy, compliance, and eDiscovery professionals, the stakes are concrete. The messages a surveillance team captures today are the disclosures a legal team produces tomorrow, which makes the collection method a defensibility question, not a checkbox. Firms operating in regulated European markets should map where their off-channel exposure sits and how that data would survive a regulator’s request.
Watch the FCA’s next multi-firm findings and the first European penalty that mirrors a U.S. sweep; that is the signal the cycle has begun in earnest.
Content Assessment: Europe's off-channel reckoning: HaystackID bets COMET on a messaging crackdown crossing the Atlantic
Information - 93%
Insight - 92%
Relevance - 92%
Objectivity - 90%
Authority - 92%
92%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Europe's off-channel reckoning: HaystackID bets COMET on a messaging crackdown crossing the Atlantic."
Industry News – eDiscovery Beat
Europe’s off-channel reckoning: HaystackID bets COMET on a messaging crackdown crossing the Atlantic
ComplexDiscovery Staff
Disclosure: ComplexDiscovery OÜ’s Editor and Managing Director, Rob Robinson, also serves as chief marketing officer of HaystackID. This article is based on a press release issued by HaystackID on June 15, 2026.
HaystackID introduced a tool on June 15 for capturing employees’ business messages on personal phones, wagering that European regulators will press the off-channel enforcement that has cost Wall Street billions since 2021.
The wager is specific. For four years, U.S. firms have paid for what their bankers typed into WhatsApp and texted off the record. Now the company is positioning for the moment when those same demands land on regulated firms in London, Frankfurt, and across the European Union.
Why Europe is the next front
The pattern in the United States is by now well documented. Since December 2021, the Securities and Exchange Commission and the Commodity Futures Trading Commission have charged over 100 firms for failing to preserve business communications sent through personal messaging apps. A single 2022 sweep produced $1.8 billion in penalties across 16 firms. Industry tallies since put combined SEC, CFTC, and FINRA off-channel penalties above $3.5 billion.
European authorities have started down the same road, though from a different statutory base. Under Article 16(7) of the second Markets in Financial Instruments Directive, known as MiFID II, investment firms must record telephone and electronic communications tied to client orders and keep them for five years. Germany’s BaFin enforces the obligation through national securities law. In the United Kingdom, the Financial Conduct Authority published a multi-firm review in August 2025 of 11 wholesale banks that identified 178 breaches of firms’ internal communications policies in the prior 12 months, with 41 percent involving directors or senior managers.
The European Securities and Markets Authority reported that MiFID II penalties across the bloc reached 44.5 million euros in 2024, a 143 percent jump over the prior year. The numbers remain a fraction of U.S. totals. HaystackID is betting the gap closes.
“European regulated firms already have strict recordkeeping obligations, and off-channel communications enforcement adds greatly to this complexity,” said John Wilson, chief information security officer and president of forensics at HaystackID. “The records compliance teams capture today are the disclosures legal teams rely on in the regulatory investigations and civil litigation that follow.”
What COMET is built to do
The product, branded HaystackID Compliance Oversight for Mobile Electronic Transmissions, or COMET, performs targeted, scheduled, recurring collection of business mobile communications. The company casts it as a sister offering to its Mobile Elite Discovery and Analysis Lab, the MEDAL suite it launched in early 2024 for mobile device collection in investigations and litigation.
The distinction matters for buyers. MEDAL was built for the reactive moment, the investigation or lawsuit already underway. COMET is aimed upstream, at compliance and surveillance officers who must capture communications on a recurring schedule before any dispute exists. Wilson said the company chose to introduce it at LegalTechTalk because the European legal community is where the next two- to three-year enforcement cycle will be argued and disclosed.
That framing connects compliance capture to downstream discovery, a connection compliance officers should weigh now rather than after a regulator calls. Records gathered for surveillance today become the evidence produced in litigation tomorrow, and the collection method either holds up or it does not.
The AI governance question
HaystackID is folding the launch into a wider European push organized around artificial intelligence in legal and compliance work. The company plans to demonstrate generative AI tools for investigations, a privacy platform it says identifies personally identifiable information exposure in a single scan, and an end-to-end response workflow for data subject access requests under European privacy law.
The demand driver is regulatory, not technological. The disruption AI is bringing to the workplace is driving a sharp rise in data subject access requests, or DSARs, and other regulatory actions across Europe, said Jeff Shapiro, managing director for Europe at HaystackID, who joined the company in February 2026 to lead its expansion on the continent. Organizations deploying AI for investigation and compliance, he said, must do so within localized boundaries that protect personal data.
Independent analysts read the same convergence. “We are seeing a rapid shift from traditional models and static controls to more agile processes that require greater integration between the compliance and legal obligations, particularly in highly regulated industries and markets,” said Ryan O’Leary, research director for privacy and legal technology at IDC. The global market for security governance, risk, and compliance services will reach about $22.8 billion by 2029, according to an IDC forecast cited in the company’s announcement.
A wider European bet
The COMET launch sits inside a larger commitment. HaystackID is also attending RelFest London the same week to support customers running Relativity e-discovery platforms, a partnership it has held since 2014. Wilson is scheduled to speak on June 17 on a conference panel about cross-functional cyber governance, joined by Anju Malik, associate general counsel at Omnicom, and Komal Gupta, chief innovation officer at Cyril Amarchand Mangaldas.
“The European market has unique regulatory and privacy challenges that require excellence in both technology and services,” said Chad Pinson, chief executive of HaystackID. The company said it intends to increase its investments across Europe.
For compliance leaders watching the U.S. enforcement record, the practical question is not whether recordkeeping obligations exist, but how aggressively European and UK regulators will test firms’ controls for off-channel communications. Which firms will have that answer ready before an examiner asks, and which will be reconstructing it under scrutiny?
News sources
- Has off-channel gone off the boil? The UK FCA releases findings of review into use of unapproved communication channels by wholesale banks staff (Herbert Smith Freehills Kramer)
- FCA survey finds 178 WhatsApp policy breaches with over 41% from senior staff (Global Relay)
- What’s Up With WhatsApp? Regulators Recently Fine Firms $1.8 Billion in Aggregate for Off-Channel Communications (Katten Muchin Rosenman LLP)
- Multi-firm review into off-channel communications (Financial Conduct Authority)
- MiFID II Recording Obligations: Requirements and Penalties (2026) (Truescreen)
- HaystackID Expands European Leadership and Global Advisory Reach with Appointment of Jeff Shapiro (PR Newswire)
- LegalTechTalk 2026: Europe’s Event for Legal Transformation (LegalTechTalk)
- HaystackID Advances Mobile Workflows with MEDAL Suite Focused on Assessment, Integration, and Review (PR Newswire)
Assisted by GAI and LLM Technologies
Additional Reading
- HaystackID brings AI privacy and discovery stack to Dublin as European compliance pressure mounts
- The New Face of Discovery: HaystackID’s CoreFlex Brings AI, Slack, and Enterprise Data into One Legal Workflow
- Show Your Work: HaystackID Brings eDiscovery Rigor to AI Governance
- Redefining Global Advisory: How Jeff Shapiro’s London Leadership Anchors HaystackID’s 2026 European Strategy
- HaystackID Names Chad Pinson CEO as Hal Brooks Becomes Executive Chair
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.





























