Video Conferencing Compliance for Finance and Legal Teams: Risks, Requirements, and Solutions

Somewhere in your firm right now, a video call is happening that a regulator, a judge, or opposing counsel would very much like a copy of. Maybe it is an investment committee deciding whether to greenlight a deal built on information that has not been made public yet. Maybe it is outside counsel walking a general counsel through litigation strategy that only works if it stays privileged. Either way, the call is probably running on whatever video tool the company already has a license for, because nobody stopped to ask whether that tool was built for this.

That is not hypothetical. It is the default state of most finance and legal organizations in 2026. Video conferencing exploded during the pandemic as an operational necessity, and five years later, plenty of firms are still running board meetings, client advisory sessions, and privileged legal calls through the same consumer grade platform they use for weekly stand ups. The tool has not changed. What has changed is how much regulators, courts and clients now expect firms to be able to answer what happened on that call, who was on it, what was shared, and where the recording, if there was one, lives.

This piece is about closing that gap. It is written for compliance officers, general counsel, IT leaders and risk teams who need to understand, in plain language, what the rules actually say about video conferencing, where the real exposure sits, and what a platform needs to do, specifically, to be trustworthy for this kind of work.

Two industries, two almost opposite problems

It helps to say this plainly up front, because finance and legal compliance often get lumped together as if they want the same thing from a video platform. They do not, not exactly.

A regulated financial firm generally must prove that a business communication happened and was properly captured, supervised and retained. If a broker discussed a trade recommendation over video chat and nobody archived the chat transcript, that is a recordkeeping violation, full stop, regardless of whether the advice itself was sound. The regulatory posture assumes communications will be produced on request, and firms are punished for failing to keep the record, not usually for what the record contains.

A law firm has close to the opposite obligation. Attorney client privilege exists specifically to protect the confidentiality of legal advice, and that protection can be weakened or waived if the communication is not kept reasonably confidential. Where a bank needs to prove a conversation happened and preserve it, a firm handling privileged matters often needs to make sure a conversation cannot be read by anyone who should not have access to it, including, in the strongest version of that goal, the platform vendor itself.

Put those two mandates next to each other and you get a genuinely useful test for any video platform serving both industries: can it capture, supervise and retain what regulators require for regulated business communications, while also offering a mode where content is genuinely unreadable to the vendor for privileged work? Most platforms were not designed with that distinction in mind at all. They default to one posture, usually maximum data collection for product and analytics purposes, and call it a day.

What goes wrong on an ordinary call

Before getting into rule numbers, it is worth walking through the concrete, unglamorous ways video conferencing creates exposure for finance and legal teams, because the risk rarely announces itself.

The call itself is the least of it, usually. Live videos are transient by nature; spoken words disappear the moment they are said unless something records them. The real exposure tends to show up in everything attached to the call: chat messages sent during the meeting, files shared or screen shared, auto generated transcripts, cloud recordings, and the calendar invite that quietly lists every participant and, sometimes, the agenda.

Chat is an unmanaged side channel. A relationship manager fields a sensitive client question in the meeting chat while the main conversation continues. A junior associate pastes a settlement number into a group chat during a call. That message now exists somewhere, on a server, possibly outside the jurisdiction anyone thought to check, and it is rarely captured by whatever recordkeeping process was built around the meeting recording itself.

Auto transcription creates a permanent, searchable copy of things people assumed were spoken and gone. Many platforms now transcribe every call by default and store that transcript in the cloud indefinitely, including calls nobody intended to be a permanent record. For a firm managing privilege, that is a serious problem, a searchable transcript of a strategy call is exactly the kind of artifact that gets requested in discovery.

Screen sharing exposes more than the intended slide. Anyone who has watched a colleague accidentally share their entire desktop, complete with an open email thread or a spreadsheet with someone else’s numbers on it, knows this risk is not theoretical. It happens constantly, and once it happens on a recorded call, it is recorded too.

Recordings multiply the number of places sensitive material lives. A single one-hour board meeting, once recorded, transcribed and auto shared to a cloud folder, can turn into four or five separate copies of the same sensitive discussion, each with its own access controls, retention settings, and export capability, and each one is a separate thing someone has to remember to govern.

Cross border routing creates jurisdictional exposure nobody signed up for. A European asset manager whose calls are processed on servers in the United States has, whether anyone framed it this way or not, exposed those calls to a different legal system, different subpoena powers, and different data protection expectations than the ones the firm’s own compliance program was built around.

None of these failures require a hacker. They require an ordinary video tool doing exactly what it was designed to do, capture as much as possible, store it centrally, and make it easy to access, which is precisely backwards from what regulated finance and privileged legal work need.

The rulebook for finance: what regulators require

Let us get specific, because vague talk about compliance helps nobody signing a vendor contract.

SEC Rule 17a-4 governs how broker dealers preserve electronic business records. In plain terms, it requires that records be kept in a format that cannot be altered or deleted during the retention period, commonly described as write once, read many, or WORM storage, and that those records be indexed and retrievable for regulators on request. The rule predates video conferencing by decades, but it has been consistently interpreted to apply to any electronic communication tied to the firm’s business, which absolutely includes chat messages, shared documents and recordings generated during a video meeting.
FINRA Rule 4511 works alongside 17a-4 and requires member firms to preserve books and records, including electronic communications, in that same non-rewritable, non-erasable format, for the periods FINRA specifies by record type.
FINRA Rule 3110 adds to the supervisory layer: firms must review the communications they are required to keep; not just store them and hope nobody asks.

FINRA has been direct about how this applies to video specifically. In guidance issued during the shift to remote work, FINRA clarified that firms are generally not required to record a live video or audio conversation with a customer just because it happened over video. But the moment that meetings use chat, instant messaging, or presents slides or other written material, those written communications fall under the same recordkeeping and supervision requirements as any other business communication. That is a distinction worth sitting with: the call itself may not need to be achieved, but almost everything that typically happens around the call, the chat, the shared deck, the follow up message, usually does.

MiFID II, the European framework governing investment firms, takes a stricter position for certain categories of communication. Firms subject to MiFID II are generally required to record telephone conversations and retain copies of relevant electronic communications, including those tied to order taking and execution, for a period commonly set at five years, with an obligation to periodically monitor those records for compliance purposes. For European finance firms, video conferencing that touches order related discussions is not a gray area, it is squarely inside the recording obligation.

The enforcement backdrop makes all this concrete rather than theoretical. In 2024 the SEC ordered a group of firms, including several well-known wealth management names, to pay close to four hundred million dollars combined in penalties tied to widespread failures to retain required communications, largely stemming from staff using unapproved messaging channels that were never captured by the firm’s archiving systems. More recently, FINRA found a digital brokerage firm hundreds of thousands of dollars after more than twenty-two million business related electronic messages went unretained because of a technical failure in the firm’s archiving pipeline. FINRA’s own annual regulatory reports have flagged, repeatedly, that firms continue to struggle with detecting business being conducted on unapproved platforms and with writing supervisory procedures that specify which channels are permitted and how they are monitored.

Read together, the regulatory message for finance is consistent. It is not enough to pick a video tool that seems secure. Firms need a platform where every communication channel tied to a meeting, chat, shared files, recordings, is either captured in an archivable, non-alterable format or explicitly and deliberately excluded from business use, with supervision procedures that say so in writing.

The rulebook for legal: privilege, confidentiality and competence

Legal compliance runs on a different, older foundation: professional responsibility rules that predate the internet but have been steadily reinterpreted to cover exactly this kind of technology decision.

Attorney client privilege protects confidential communications between a lawyer and client for the purpose of seeking or providing legal advice. The key word is confidential. Courts have long held that privilege can be weakened or waived if communication was not kept reasonably confidential, and while accidentally including a third party on a video call is treated differently than deliberately publishing a memo, firms cannot simply assume the platform they chose has no bearing on that analysis. If a video vendor stores an unencrypted, indefinitely retained transcript of a privileged strategy session, that transcript becomes a document that exists and can be sought in discovery. If the vendor is later compelled to produce records, that transcript is exposed. This is exactly the situation privilege is meant to prevent.

Professional ethics rules add a second, independent layer. Most bar associations, following the lead of the ABA Model Rules, now interpret the duty of competence to include a duty of technological competence, meaning lawyers are expected to understand, at a reasonable level, the risks associated with the technology they use to handle client matters. That does not require a partner to understand cryptographic protocols, but it does mean a firm that adopts a video platform without asking basic questions about where data is stored, who can access it and how long it is retained, is arguably falling short of a standard regulators and bar associations increasingly expect.

There is also the more mundane, but no less real, duty of confidentiality itself, the obligation to make reasonable efforts to prevent unauthorized access to or disclosure of client information. Reasonable efforts are a moving target, but it clearly includes things like encrypting sensitive communications, controlling who can access shared documents, and not defaulting to indefinite cloud storage of every privileged conversation a firm has ever had.

The practical upshot for legal teams is close to a mirror image of the finance picture. Where a bank needs a defensible record that a communication happened, a law firm often needs a defensible answer to a very different question: if the platform vendor received a subpoena tomorrow, what could they hand over. For privileged work, the best answer is nothing readable, because the vendor never held a decryption key in the first place, not merely a promise that the vendor would decline to look.

Where finance and legal agree

Despite the different starting points, finance and legal compliance converge on the same practical requirements once you get past the recordkeeping question, because both are fundamentally about being able to demonstrate control over sensitive information.

Both need to know, precisely, who accessed a given document or meeting and when, because both may eventually need to answer a regulator or a court about exactly that. Both need role-based access rather than everyone getting the same level of visibility into every deal or matter. Both need a defensible position on where data physically resides, because cross border data flows create exposure for a bank under GDPR the same way they create exposure for a firm worried about foreign compelled disclosure of privileged material. And both need a platform vendor that is honest, specifically and technically honest, about what is and is not protected, because vague marketing claims about being encrypted or secure are functionally useless to a compliance officer trying to fill out a risk assessment.

For any finance or legal organization operating in or serving clients in the European Union, GDPR sits on top of everything discussed so far, and it changes the calculus in an important way. GDPR is not primarily concerned with whether communication is encrypted, it is concerned with the lawful basis for processing personal data, the role the vendor plays as a data processor, and where that data travels.

A video platform that processes call data, chat content, or documents involving EU residents is a data processor under GDPR, which means the controller, your firm, needs a data processing agreement with that vendor spelling out how data is handled, retained and protected. Transfers of that data outside the EU raise a separate and thornier question, because regulators have made clear that routing EU personal data through infrastructure operated by a company subject to broad foreign legal process, even with contractual safeguards in place, is a genuine legal risk, not just a theoretical one.

This is where data residency and self-hosting stop being nice to have and start being a real compliance lever. A firm that can host its video platform, meetings, recordings, deal room documents, entirely within EU infrastructure, or on its own servers, removes an entire category of cross-border transfer risk from the table. It is a materially simpler compliance story to tell a regulator: the data never leaves, because we run the platform ourselves, or because our vendor’s EU instance genuinely never routes traffic outside the region.

The archiving trap: capture everything versus capturing nothing

Here is the tension that trips up a lot of otherwise well-intentioned compliance programs. Finance regulation generally pushes firms toward capturing more, recording calls, archiving chats, retaining transcripts, because the failure mode regulators punish is under capture. Legal ethics and privilege push in the opposite direction, toward capturing less, because the failure mode that damages a client is over capture, a permanent, discoverable record of something that was supposed to stay confidential.

A platform built only for finance will tend to record everything by default, which is exactly wrong for a privileged legal call. A platform built only for confidentiality will refuse to keep any record at all, which is exactly wrong for a supervised broker dealer conversation that regulators expect to be archivable.

The only workable answer is a platform that treats this as a deliberate, per session choice rather than a fixed default baked into the product. A regulated advisory call should default to capture, transcript, recording, chat log, all retained in an archivable format your compliance team controls. A privileged strategy session should be run in a mode where no server-side system, including any AI notetaker, transcription service or the vendor itself, can read the content at all. Getting this backwards in either direction creates real exposure, and a platform that only offers one mode is quietly forcing that mistake on some portion of your calls no matter which mode it defaults to.

Common failure patterns compliance teams keep running into

A few patterns show up repeatedly when finance and legal organizations try to retrofit compliance onto a video tool that was not built with it in mind.

The first is shadow usage. Compliance approves one platform, and staff, frustrated by clunky sharing or slow load times, quietly move sensitive conversations to a messaging app or personal video account nobody is monitoring. FINRA’s own examination findings call this out directly, weak detection of business conducted on unapproved platforms is one of the most persistent recurring failures regulators identify. The fix is rarely more restrictive policy language; it is picking a sanctioned platform good enough that people do not want to leave it.

The second is confusing encryption in transit with end-to-end encryption. A platform that encrypts data between your device and its servers, which is standard and necessary, is still fundamentally different from one where the vendor itself cannot decrypt the content at all. Sales materials often blur this distinction, describing transport layer encryption in language that implies the stronger guarantee. A compliance officer who does not push for specific architecture is signing off on a claim that sounds stronger than it is.

The third is treating recording as the whole compliance story and ignoring everything else attached to a meeting. Chat logs, shared documents, screen recordings and calendar metadata all need the same retention and access discipline as the core call, and they are frequently handled by entirely different systems with entirely different, and often weaker, controls.

The fourth is assuming a vendor’s general security certifications answer the specific question you have. A SOC 2 report says a great deal about a vendor’s internal controls and processes. It says very little, on its own, about whether that vendor holds the decryption keys to your privileged legal calls, or whether your firm’s data ever leaves the region you assumed it stayed in. Ask the specific question. A general certification is not a substitute for a specific answer.

What compliant video conferencing requires, layer by layer

Pulling all of this together, here is what a video platform genuinely needs to offer finance and legal teams, described honestly, layer by layer, rather than as one blanket claim.

Messaging that is genuinely ended to end encrypted and server blind by default. Chats exchanged during and around meetings should be encrypted such that the vendor holds no key capable of reading it, built ideally on an open, independently audited standard rather than a proprietary black box. This matters enormously for privileged legal chat and for any sensitive side conversation happening during a regulated call, though it is worth being precise that end to end encryption protects the content of a message, not the metadata around it, who was in the conversation and when is typically still visible to the service, and any risk assessment should treat that distinction honestly rather than glossing over it.

Meeting media that is encrypted in transit at minimum, with a genuine end to end option for the calls that need it. Standard transport encryption, using protocols like DTLS and SRTP, protects a call against network eavesdropping and should be the floor for every meeting, not an upgrade. For the small subset of calls where even the platform operator should not be able to access the media, an actual per frame or client-side end to end encryption mode should exist as a deliberate, opt in choice, not something buried in marketing copy as if it were the default.

Access controlled, NDA gated document and deal rooms. Finance and legal work both revolve around sharing documents with parties outside the firm, a prospective buyer, an expert witness, a limited partner reviewing a teaser. Those documents need revocable permissions, enforced NDA acceptance before access is granted, and view only modes with visible watermarking to deter re-sharing and screenshots. It is worth being honest that document access control is a different guarantee than end to end encryption, the platform can typically still access document content technically to enforce those permissions, and a rigorous risk assessment should record that distinction rather than assume otherwise.

Comprehensive, exportable audit logging. Every login, every NDA acceptance, every document view, every meeting join, should be logged in a way compliance and legal teams can export and review. This is the backbone of both regulatory supervision obligations and any defensible answer to who accessed what and when, whether the question comes from a regulator, a court, or a client’s own security review.

A data processing agreement that specifies retention and processing. Not a generic term of service page, an actual DPA that names what data is processed, how long it is retained, and what happens to it when a firm offboards. This is a GDPR requirement for any EU exposed data and good practice regardless.

A real choice about deployment boundaries. For the most sensitive work, the strongest posture removes the vendor as a party with access to infrastructure at all, either by self-hosting the platform on infrastructure the firm already controls, or by using a single tenant, region locked instance where the operator has made specific, verifiable commitments about where data lives and who can access it. This is the single control that most directly answers the subpoena test, if the vendor received legal process demanding the content, what could they produce, and for privileged legal work in particular, the honest answer needs to be nothing readable.

A deliberate exception for AI features around sensitive sessions. AI notetaking and transcription are genuinely useful for training sessions, sales calls, and routine business meetings, and they should be available and encouraged there. But for a genuinely end to end encrypted session, a privileged legal call, an unannounced deal discussion, no AI processing should be technically possible at all, because if a server-side system could transcribe the meeting, it was never actually end to end encrypted in the first place. A platform that offers this as a real architectural choice, rather than a policy promise layered on top of a system that could technically still process everything, is offering something meaningfully different from one that just says trust us.

Encryption, precisely: the distinction that matters

It is worth pausing on encryption specifically, because it is the single most misused word in this entire category, and getting it wrong in a risk assessment is a genuinely common way firms end up with less protection than they believed they had.

Encryption in transit protects data as it moves between your device and the vendor’s servers. It is table stakes, every reputable platform has it, and it defends against a real threat, someone intercepting traffic on the network. But it says nothing about what the vendor itself can see once that data arrives at their infrastructure. A vendor with data encrypted only in transit can, in principle, read your meeting content, because they hold the keys on their own servers.

End to end encryption is architecturally different. It means the data is encrypted on your device before it ever leaves, using keys the vendor does not hold, and decrypted only on the recipient’s device. The vendor’s servers, in this model, only ever handle ciphertext, meaningless scrambled data they cannot read even if compelled to try. This is the guarantee that matters for privilege and for the subpoena test described earlier.

The honest complication is that very few real platforms apply end to end encryption uniformly across every feature. Messaging might be genuinely end to end encrypted by default. Meeting video might be encrypted in transit to a relay the firm can control through self-hosting, with a separate, deliberate end to end mode available for the calls that need it. Documents in a shared deal room might be access controlled and encrypted in transit but not yet end to end encrypted client side, because the platform needs to technically process them to enforce permissions and watermarking. None of this is a scandal, it is simply how real systems work, but it is exactly the kind of nuance a vendor should lay out plainly, layer by layer, rather than letting one word, encrypted, do all the marketing work for features that protect very different things.

Any compliance officer evaluating a platform should ask, specifically, for each of these four things: is messaging end to end encrypted by default, is meeting media encrypted in transit at minimum with an end to end option available, are shared documents access controlled with NDA gating and audit logs, and can the entire platform be self-hosted or run in a single region for the matters that demand it. A vendor that can answer all four precisely, including admitting where a guarantee does not yet extend, deserves more trust than one that answers with a single confident word.

Building a checklist your risk committee will approve

Turning all of this into something a procurement process can be used; here is a working checklist that maps directly the risks above.

Server-blind messaging: Require default on, server blind end to end encrypted messaging so privileged and sensitive chat exchanged around meetings cannot be read by the platform operator.
In-transit media floor: Require meeting media encrypted in transit as an absolute floor, with a genuine end-to-end mode available for the calls that need the strongest protection.
NDA-gated deal rooms: Require NDA gated deal rooms or client portals with role based, revocable access, so sensitive documents are never shared more broadly than intended and access can be cut off instantly when a matter concludes.
Watermarked view-only mode: Require view only modes with per viewer watermarking for any document that might be forwarded or screenshotted by someone outside the firm.
Comprehensive audit logs: Require comprehensive, exportable audit logs covering logins, document access, NDA acceptance and meeting attendance, because that log is your evidence when a regulator or opposing counsel asks what happened.
Signed DPA: Require a signed data processing agreement that specifically addresses retention periods and data handling on offboarding.
Self-hosting or single-tenant boundary: Require the option to self-host or to run on a single tenant, region locked instance, so the most sensitive matters never touch shared, multi-tenant, cross border infrastructure at all.
Architectural AI isolation: Require that AI notetaking and transcription features can be fully disabled for genuinely encrypted sessions, and confirm that disabling is architectural, not just a checkbox in a settings menu that leaves the underlying capability intact.
Feature-level transparency: And require the vendor to publish, in plain language, exactly which of these guarantees applies to which feature, rather than a single blanket claim about being secure.

Any vendor that hesitates on the last item, the honest, layer by layer breakdown, is telling you something important. Precision here is not a nice extra, it is the entire point, because a compliance program built on a vague promise is not actually a compliance program.

A day in life: two calls, two very different requirements

It is worth grounding this in two concrete scenarios, because the abstractions above land differently depending on what kind of call is happening.

Picture an investment committee at a mid-sized fund reviewing a potential acquisition. The deal memo and financial model sit in a role gated deal room, visible to partners but not yet to anyone outside the firm. A prospective limited partner is invited to review a teaser folder only after accepting an NDA through the platform itself, and every document view, download attempt, and NDA acceptance is logged for the eventual compliance file. The committee discussion happens over video with encryption in transit as the baseline, and because this deal involves genuinely market moving, non-public information, the sensitive portion of the call runs in an end-to-end encrypted mode so that even the platform operator only ever sees ciphertext. Everything about this call is designed around the assumption that it may eventually need to be reconstructed, who saw what, who said what was disclosed to whom, and when.

Now picture outside counsel walking a general counsel through litigation strategy for an active dispute. Nothing here should exist as a readable record anywhere except in the minds of the people on the call and whatever notes they choose to take themselves. The call runs fully end to end encrypted, chat included, with AI notetaking and transcription entirely disabled by the platform’s architecture rather than by a policy setting someone could override. If the platform vendor received a subpoena tomorrow related to an unrelated matter, there would be nothing to produce, because nothing readable was ever created or stored on their side in the first place. That is the entire point of the exercise.

These are not two different platforms. They are the same platform, used deliberately in two different modes, chosen based on what the conversation requires, which is exactly the flexibility finance and legal compliance both genuinely need and rarely get from tools built for one use case and stretched to cover the other.

Rolling this out without breaking how people work

None of these matters if the rollout makes people’s jobs harder in ways they will route around, which brings the conversation back to the shadow usage problem raised earlier. A few practical steps make adoption stick.

Start by mapping communications to sensitivity rather than applying one policy to everything. A routine client check-in call does not need the same controls as a board discussion of an unannounced transaction and treating them identically either over-restricts the routine call or under-protects the sensitive one. Set defaults that fail safe rather than relying on people to remember to turn protections on, server blind messaging enabled by default, view only and watermarking on by default in shared document rooms, recording off unless someone deliberately chooses it for a call that should be archived. Decide the deployment boundary deliberately for your most sensitive practice areas, self-hosted or single region for privileged legal work and unannounced deal activity, standard hosted with full archiving for routine supervised business communications that regulators expect to be captured. And keep the audit trail retained and genuinely exportable, not just theoretically available, so your compliance team can produce it on short notice rather than discovering during an examination that the export function does not work the way anyone assumed.

Training matters here too, and it works better when it is specific rather than generic. Telling staff to be careful is not a control. Telling staff exactly which platform to use for which category of conversation and making the sanctioned platform genuinely as easy to use as the shadow alternative people would otherwise reach for, is what changes behavior.

The bottom line

Video conferencing compliance for finance and legal teams is not about finding a platform that claims to be secure. It is about matching the platform’s trust model to the specific obligation in front of you, capturable and supervisable for regulated business communications where under capture is the violation, and genuinely unreadable to any outside party, including the vendor, for privileged work where over capture is the violation. Getting that distinction right requires a vendor willing to be precise, encryption described layer by layer rather than as one word, audit logs that are actually exportable, a data processing agreement that says something specific, and a real answer, not a marketing answer, to what happens if a subpoena arrives tomorrow.

Firms that get this right are not choosing a fancier video tool. They are choosing a platform whose architecture agrees with their compliance program instead of quietly working against it, which is the only version of compliant video conferencing that holds up when someone eventually asks hard questions about a specific call. To compare self-hosted security with commercial cloud providers, see our transparent pricing and deployment resources.

Legal — Secure Video Conferencing for Law Firms: A Confidentiality Checklist: A focused breakdown of the privilege specific controls legal teams should require before any platform touches privileged work.
Data Sovereignty — Data Sovereignty in Video Conferencing: Keeping Enterprise Meeting Data Within Your Borders: A deeper look at how regional hosting and cross border data flows affect regulated organizations.
Cryptography — End-to-End Encryption vs. In-Transit Encryption in Video Calls: What’s the Real Difference: The full architectural explanation behind the encryption distinctions covered here.