Mobile RecordingA Buyer’s Guide

In the UK, since the ruling in 2009 by the UK finance governing body the FCA (formerly FSA), Financial Institutions have had to legally comply and record all fixed line conversations.

The ruling was bought in to tackle market abuse, misconduct and help FCA monitor, investigate and prosecute such cases.

Recording telephone conversations is nothing new, ensuring recording mobile conservation is...

2

Put simply, if your business operates within the Financial Sector, you must ensure: - All recorded data is stored for 6 months in the UK

and 1 year in the US

- Reasonable steps are taken to stop staff discussing business on unrecorded devices

Regulatory complianceCall recording is nothing new. In the UK most financial organisations were already recording fixed-line communication before regulations required it.

Nevertheless, complying with new regulation is complex for IT managers due to the regional policy variations and inconsistent design of mobile networks globally.

However, every call must be recorded, whether it’s on a fixed-line or a mobile and regardless of where the caller is located.

Having a system in place to record voice and text messages – or which stops users from making unrecorded calls – is simply essential.

3

Don’t forget data and textingThe phrase ‘recording’ can be misleading. It’s not just voice calls that need to be recorded; all electronic communications are included within the scope of this regulation. That includes:

- Text messages

- Instant messages

- Email

Regulated bodiesRegulated bodies, such as banks and brokers, first spent a great deal of time lobbying regulators to delay or repeal the regulation. In some cases this lobbying was direct, whilst other bodies such as the AFME and BBA acted as mediators.

Ultimately, such lobbying was unsuccessful. Once the regulation passed it became the first time many mobile communication teams (often residing in the desktop department) and fixed-line recording teams (often residing in the network department) were brought together with the compliance department. Naturally, this presented many challenges for some companies.

The RegulatorThe market felt the regulators would provide an extension on the basis that the technology wasn’t perfect. However, regulators argued they were simply addressing an existing loophole and regulation passed relatively quickly.

The Suppliers/VendorsIn the UK, the FCA investigated suppliers’ state of readiness in a consultation paper. Although the results are not publicly available, it’s clear vendors successfully demonstrated solutions such as Truphone Mobile Recording were ready, as the FCA continued to push new regulation through.

What happened in the UKLearning from the mistakes of othersThe introduction of new FCA regulation and the technology intended to address it had a fundamental effect on all areas of the UK market. It is vital to understand this impact in order to safeguard from preventable mistakes in the future.

The IT strategist and technology conflictThe drive for mobile compliance challenged some of the primary initiatives surrounding mobile technology:

Mobility: The desire to integrate an organisation’s fixed-line infrastructure with its mobile estate through Over The Top (OTT) applications conflicted with many of the compliant recording technologies.

Cost: Many mobile compliance technologies introduced complicating factors, increasing call length and roaming spend in a way that drove up cost.

Bring Your Own Device (BYOD): The trend to provide employees with a budget to support their own technology preferences conflicts with the realities of many recording solutions. Compliance requires always-on, cannot-be-disabled solution – something most easily mandated through company-supplied devices. However, an end user could potentially disable the recording function on his or her personal device.

4

Device evolutionHistorically, the financial markets have been dominated by BlackBerry, but the picture has changed as Apple and Android’s retail success spreads into the workplace. Increasingly, staff want to bring their own phones to work.

The growing demand for BYOD means end users often carry firm-provided devices as well as personally-owned devices. IT departments are increasingly looking at cost saving opportunities to reduce their dependency on BlackBerry and are starting to support a variety of different devices.

Any mobile recording strategy therefore needs to embrace multiple devices. Whether it’s a BlackBerry, iPhone or Android device, the solution you choose needs to work across the board. Ask how your providers will support this.

5

1. By policyAny IT control can only be effective if supported by an internal business policy. Several UK firms have already adopted such a policy in the past few years, even despite the limits it could impose on staff and the unenforceability of it in practice.

In fact, Ovum estimates that as many as 17,000 phones (out of a total of 25,000) went unrecorded in the UK financial services marketplace (Turner, 2013, p.9).

If such a policy is not strictly followed and policed, the organisation could be exposed to regulatory sanctions. One solution may be to simply prevent staff communicating on mobile devices, but this runs the risk of alienating customers. Either way, compliance-by-policy is an imperfect solution to current regulation.

2. Other potential solutionsOther potential solutions include tying mobile compliance to fixed-line compliance through integration to the corporate PBX. Implementations along these lines vary, but generally rely on the presence of a data connection that may allow an OTT app (such as a VoIP client) to function. Mobile calls are then captured within the fixed-line infrastructure.

Another option is to mandate secondary dialling from a corporate PBX or conference bridge. Users dial into the company PBX from their mobile, then dial the call out.

The main issues with both of these approaches are that they are slow and cumbersome for staff, easily circumvented and are not a reliable way to capture either incoming calls or text messages.

Complying with the rules Recording calls and textsWhen it comes to deciding how to comply with new regulations, there are three main approaches:

3. By technologyThere are multiple approaches to meeting regulations through technology. The leading solutions are described below:

Application-based recording

App-based recording is designed to work with a specific type of device, such as a BlackBerry or iPhone. The software installs on the phone and then controls the call-routing functionality, re-directing calls through a server which records the content. One of the major downsides to this approach is that this process interrupts the call, resulting in up to 20 second delays to both inbound and outbound calls.

App-based recording also fails to tackle the challenges of roaming. The added complexity of capturing calls when a user travels on to another network can result in unrecorded or missed calls.

The benefit of using a handset application however is that an organisation can retain its existing mobile network operator agreement with no need to changes SIMs or hardware.

Network-based recording

Network-based recording does not use an app. Instead, calls are captured directly within the network. Typically a recording-enabled SIM is used to ensure automatic recording of all subsequent data.

Network-based recording is ideal for organisations that have multiple devices or expect to implement a BYOD strategy in the future.

Network-based recording is also ideal if users travel frequently. It taps directly into the mobile network infrastructure, meaning it can work seamlessly around the world – provided the user is connected to the same network.

Network recording can also be more cost-effective than other options. Unlike app-based recording, there are no extra calls to the recording software. You only pay for the cost of one call.

There are no call delays with network-based recording either, meaning a seamless user experience.

6

Complying with the rules Recording calls and texts

Even despite the growing availability of video-conferencing and other tools, financial industries still send employees abroad on a regular basis.

Whether staff travel within the scope of the Commodities Futures Trading Commission (CFTC) or FCA however, communications must always be recorded.

Global vs local Complying with international regulation

The next version of the EU legislation, known as Market in Financial Instruments Directive (MiFD) is likely to require electronic communication to be stored for three years.

With this similar legislation planned for other regions it’s increasingly important to choose a solution that works globally, but meets local requirements, contracts and SLAs.

Having just one solution that works globally saves dealing with multiple suppliers and means you won’t need to try to integrate a variety of different technologies with your current systems.

The global regulation marketplace

7

- User experience is key. Anything that modifies the user experience or expects the user to do something different is likely to fail. Some solutions will send media outside of country borders, introducing latency and affecting the user experience. Is the solution globally available and performing?

- If you need to deploy software, make sure it can be centrally deployed to a user’s handset. This ensures scalability and centralised control. You won’t have to install software on everyone’s phones individually.

- Choose a solution which supports all hardware and software versions your organisation uses and is likely to use. This extra step can prevent user dissatisfaction.

- Ensure you have a compliance policy to enforce any IT control. Your users must understand what happens if the technology fails.

- Think about your users and how they use their phones. Do they travel internationally or use particular features a lot? When you choose a solution, make sure it’s suitable for your users’ needs.

- Think about the benefits of deploying a managed service. Check that it is secure, resilient and redundant. Does it have a back-up connection should your main one fail?

- Check the impact of call charges as a result of introducing call recording. Is the solution introducing another call leg? Does the solution require a data connection?

- Ensure you research your firm’s mobile and expense strategy. Is your firm introducing a new mobile expense policy moving responsibility for bill payment to the employee or embracing Bring Your Own Device (BYOD)? How will this impact the mobile compliance requirements?

- Consider how many users require recording. It’s advisable to start this process as early as possible, as this process can take a long time to complete.

- Consider existing data processing, storage and analytics requirements. How does your firm record and store fixed-line calls and data today – and will those requirements change with mobile recording?

- Consult your mobile technology roadmap. What are your firm’s plans for future mobile communications technology? Are you considering converging a mobile VOIP client?

- Carry out extensive pilot schemes with real users who travel. Don’t select junior IT or business staff to test the product and service. Before you sign the contract, give it to your road warriors and allow them to experience the service.

- Decide how to retain the data. There are two main approaches – within your internal infrastructure or in the cloud. If you have the facility already, existing services may be a good option, but cloud storage can be more convenient and secure.

A Buyer’s GuideKey factors to considerWhen complying with new regulations, specifically mobile recording, you need to make sure it has minimum impact on your business operations.

In financial institutions where security and risk management are key, any storage environment must have the highest levels of security integrity. You’ll already have systems in place for recording fixed-line communications and these will have been tried, tested and rigorously audited to make sure they’re secure.

8

Vendor selectionOnce you have an idea of what you want, the key things to consider when evaluating vendors will be:

- How can the vendor support me?

- Is airtime and mobile recording integrated from a billing perspective?

- Which handsets does the vendor support?

- Who are the customer references?

Implementation & supportOnce you have chosen a solution, it’s time to deploy and support. Considerations include:

- Device management

- Porting

- Storage access

- Migration day advice

In summary

Cloud Recording On-Premise Recording

Han

dset

app

licat

ion

Pros

- Quick to deploy

- Retain existing mobile network vendor

Pros

- Integrate mobile voice and data with other data assets

- Retain existing mobile network vendor

Cons

- Creates another data silo which is not in-line with other recorded assets

- Potentially significant effect on user experience

Cons

- Longer implementation time

- Potentially significant effect on user experience

In n

etw

ork

reco

rdin

g Pros

- Quick to deploy and lower cost of ownership than on-premise

Pros

- Integrate mobile voice and data with other data assets

Cons

- Possible change to existing MNO provider

- Security is paramount to data in transit and store

Review the table below for a quick guide on which is the right type of solution for you.

9

How Truphone can helpThe Truphone Mobile Recording platform brings together the simplicity of the Truphone global network and the secure mobile recording platform. In this way, Truphone Mobile Recording offers a cost-effective, secure and hassle-free way to meet the demands of global regulators.

Truphone Mobile Recording runs on Truphone’s international network, which builds compliance into every call and text message, whether you’re in the UK, EU, US, Australia or Asia-Pacific.

Truphone Mobile Recording platform records over 250k calls and 100k SMS a month across 200 countries on a monthly basis. It has been extensively tested by leading financial services organisations to meet their strict security and data protection requirements.

With number porting and low international roaming charges, Truphone offers a secure, redundant and managed service, making it one of the strongest UK solutions in the market.

Because Truphone Mobile Recording is network-based, there’s no need to install an app. Your phone works as usual, with all the normal features like call waiting, conference calling and voicemail left intact. This means the technology doesn’t act as a barrier to communication, so you can get closer to your international contacts.

Instant, secure access to your dataThe complete Truphone Mobile Recording managed service is located in highly secure Tier 1 data centres.

Truphone Mobile Recording protects all data with state-of-the-art encryption services that only allow access with keys generated at the time of encryption. These keys ensure data is always available when you need it, though Truphone recommends nominating corporate lawyers to hold extra access keys as a back-up measure.

Once encrypted, data is only accessible through secure web portals that form part of the ONiX archiving system. These portals include three-step identity verification and use HTTPS:// security as default – though VPN access is also available as part of a hosted solution.

Benefits of Truphone Mobile RecordingFor your data - Capture all SMS and voice data

easily and securely

- Eliminate software issues with in-network approach

- Monitor data automatically, ensuring security

- Store data in either a fully hosted or on-site solution

For your staff - Call as normal, without delays

or interference

- Continue using voicemail and other handset features

- Use any handset, including BlackBerry 10 and iOS 6 devices

- Rely on business-class global support, around the clock

For your business - Stay up to date with seamless

over-the-air updates

- Boost contact-ability with multiple international numbers on one SIM

- Stay connected in over 220 countries around the world

- Fulfil the requirements of new industry regulations

10

11

Ready to learn more about how Truphone can help transform your business communications? Get in touch today.

+44 (0)20 3006 4300 business.uk@truphone.com truphone.com/uk/business/mobile-recording

truphone.com© 2014 Truphone Limited. Registered office: Simmons & Simmons LLP, CityPoint, One Ropemaker Street, London EC2Y 9SS. Registered in England & Wales No. 04187081.

90494022.

About TruphoneTruphone is the only mobile operator in the world that expands the reach of businesses beyond the borders of their home country. Truphone achieves this by providing multiple international numbers on a single SIM, enabling businesses to make international calls that are treated as local calls and providing contacts a direct way to get in touch on a local number.

Truphone Mobile Recording helps organisations record, encrypt and store all their calls using their existing IT infrastructures or in a secure managed cloud storage unit. That means they can meet corporate governance guidelines and comply with regulations like the FCA in the UK and Dodd-Frank in the US – all without making big changes to their IT setup. And because it’s based on Truphone’s global mobile network, Truphone Mobile Recording customers can enjoy clearer calls, faster downloads and lower rates in over 200 countries around the world. With headquarters in London, Truphone has offices across 4 continents and continues to expand globally. Its clients include FTSE 100 and Fortune 500 companies across multiple sectors.

12