Smarsh: Initiation of Coverage

GAII Intelligence defines the Risk, Compliance & Surveillance market as software that applies AI to the supervisory obligations of investment firms, banks and trading venues: capturing and retaining communications and trading records, detecting misconduct and market abuse, reviewing regulated content, and evidencing those controls to regulators. Buyers are chief compliance officers, heads of surveillance and conduct risk, and the technology and records teams that support them.

Capabilities we treat as mandatory

• Complete, defensible capture: records of every in-scope channel or trading system, reconciled and retained to regulatory standards such as SEC 17a-4.
• Explainable detection: every alert or finding traceable to the policy, rule or signal that produced it, in a form a regulator can examine.
• Institutional data handling: a stated position on where client data goes, how long it is held, and whether it is used for model training.

Capabilities we treat as differentiating

• False-positive reduction: measurable cuts in alert volume without loss of true positives, with a disclosed method.
• Agentic triage: agents that disposition first-level alerts and assemble cases under human supervision.
• Holistic coverage: communications, trade and conduct data analysed together rather than in separate tools.
• AI-channel governance: capture and supervision of employees' use of AI assistants as a regulated channel.

Smarsh competes with Global Relay and Proofpoint in archiving, with NICE Actimize, Behavox and Theta Lake in communications surveillance, and with Shield and SteelEye, which add trade surveillance.

The following are the capabilities and characteristics that, in our assessment, most distinguish Smarsh within the Risk, Compliance & Surveillance market. Each is drawn from publicly documented product capability, published interviews with management, or independent review.

• Capture breadth: 100+ channels including mobile messaging, voice via CallCabinet and AI assistants.
• Installed base: 6,500+ customers and most of the largest global banks (company).
• Recognition: Gartner Leader for digital communications governance and archiving (2025) and Chartis category leader (2024).
• Agents in production: Level-one triage agent live since March 2026, plus discovery and search agents.
• Openness: Bring-your-own model and signal, data APIs and an MCP server.
• Archive depth: WORM storage for SEC 17a-4, legal hold, defensible deletion and a cold-storage tier.

The following are factors that prospective clients should weigh, and areas where our public review did not find sufficient evidence to reach a settled view. Several are common across vendors at this stage of the market and are not specific to Smarsh. We encourage prospective clients to raise each of them directly with the company; we have done the same, and will update this note as answers arrive.

• Security record: TeleMessage, acquired by Smarsh in 2024, was breached in May 2025; services were suspended and CISA listed three of its vulnerabilities as exploited. Buyers should review remediation.
• Governance disclosure: SOC 2 type, a no-training policy, subprocessors and residency beyond Canada were not located.
• Scope: No trade surveillance; trade and HR data are not fused with communications.
• Commercial terms: Opaque enterprise pricing; reviews cite exit fees and data-return friction.
• Model disclosure: Base models behind its domain-adapted LLMs are not named.
• Evidence: Efficiency claims are vendor-reported; the ROI study was commissioned.
• Ownership: Long private-equity holding period; a secondary process has been reported but not confirmed.

Smarsh Inc. was founded in 2001 by Stephen Marsh in New York and moved to Portland, Oregon in 2004. It has grown through acquisitions including Actiance (2018), Digital Reasoning (2020), Micro Focus's Digital Safe (2022), TeleMessage (2024) and CallCabinet (2025). Kim Crawford Goodman, formerly of Fiserv and American Express, has been CEO since 2020.

K1 Investment Management acquired Smarsh in 2016 and merged Actiance into it. Revenue, valuation and the size of a 2025 debt financing are not disclosed. The leadership team was refreshed in 2026 with a new CPO, CFO and Chief Growth Officer.

Company-reported figures are shown as such and are not independently verified. Verification is carried into the vendor questionnaire.

Smarsh organises its platform around capture, archive, surveillance and discovery. Figure 2 sets out our assessment of how it maps onto the compliance and surveillance workflow.

Capture

100+ channels, including mobile apps, voice and AI assistants.

Archive

Enterprise and Professional Archive with WORM, legal hold and a cold tier.

Enterprise Conduct

Communications surveillance with scenarios and cognitive models.

Agents and MCP

Intelligent Agent triage, Discovery Agent, AskSmarsh and an MCP server (2026).

Scope of the product today

We did not locate trade surveillance, a public no-training policy or residency options beyond Canada.

Smarsh describes domain-adapted language models running on Amazon Bedrock, alongside Digital Reasoning's natural-language models and a patent-pending semantic context graph linking people, organisations and messages.

Base models are not named, and no independent benchmark was located; customers can choose whether to accept model updates.

Smarsh captures more than 100 channels — email, Teams, Slack, Zoom, SMS, WhatsApp, WeChat, Signal, social, voice and AI assistants — in native format with hashing and chain of custody, and archives to WORM storage for SEC 17a-4.

Its library includes 50 packaged scenarios and newer models for non-financial misconduct; trade and HR data are not integrated.

Smarsh fits the supervision workflow of broker-dealers and banks end to end, from capture through review to discovery.

Configuration is lengthy, and trade surveillance must come from another vendor.

Smarsh shows ISO 27001, runs on AWS, offers SSO and audit logs and is pursuing FedRAMP. Figure 3 sets out what our public review located.

We would encourage buyers to request the SOC 2 report, the TeleMessage remediation record, a no-training clause and subprocessors.

The offsetting factor is scale: an installed base across most of the largest banks.

Enterprise pricing is not published; entry plans start at about $75 a month.

Buyers should negotiate exit and data-return terms up front.

Smarsh sits in the Emerging quadrant of the segment matrix, with investment utility close to the boundary and market strength held back by governance disclosure.

GAII Risk, Compliance & Surveillance coverage, 20 October 2026, scored on the segment variant of Data & Content and Workflow Fit; not directly comparable with Research & Intelligence scores.

11.1 Where Smarsh is strongest relative to peers

• Against AI-native vendors, on capture breadth and installed base.
• Against archive peers, on surveillance models and agents.
• Against point tools, on consolidation.

11.2 Areas of narrower functional focus

Smarsh has built capture and archive scale ahead of governance disclosure.

• Security: TeleMessage breach.
• Scope: no trade surveillance.
• Disclosure: SOC 2 type, training, subprocessors.
• Commercial: opaque pricing, exit fees.

Scores are on a 0–10 scale. Each dimension score is the mean of its sub-criteria, and the GAII Overall Score is the weighted mean of the six dimensions. The detailed sub-criteria scores that build each dimension are set out in Appendix A.

These are the areas where our public review did not find sufficient evidence to form a settled view. We have put them to the company and will update this note when they are answered. Prospective clients may find them a useful agenda for their own evaluation call.

• The SOC 2 report type and period.
• TeleMessage remediation and current status.
• A no-training policy for client data.
• Base models and Bedrock terms.
• Subprocessors.
• Data residency regions.
• SCIM availability.
• MNPI controls.
• Pricing and exit terms.
• Revenue and ownership plans.
• Trade surveillance plans.
• Third-party 17a-4 attestation.

This note is an assessment of a vendor against a defined framework, not a recommendation to buy or to decline. The following are the considerations we would put at the centre of an evaluation of Smarsh specifically.

If you run compliance or surveillance

• Check capture of every channel your staff use.
• Pilot the triage agent on your queues.
• Negotiate exit terms.

If you are responsible for technology or vendor risk

• Open with Figure 3; request SOC 2 and remediation records.
• Confirm residency.
• Assess MCP access controls.

If you are assessing the category rather than the company

• AI assistants are now a captured channel.
• Archive vendors are adding agents.
• Security of capture apps is under scrutiny.

Each dimension score in Section 12 is the mean of the sub-criteria below. Data & Content and Investment Workflow Fit use the Risk, Compliance & Surveillance segment variant.