Understanding WhatsApp supervision

Understanding WhatsApp supervision
What financial services firms need to know about the risks of scraping software versus the benefits of an API-based integration.
JUL 19, 2023

Regulatory requirements around retaining and supervising communications across financial services firms have become more stringent, in particular after an unusually high volume of business-related communications on WhatsApp was uncovered. Regulators have put users of this popular platform on high alert, while simultaneously monitoring whether firms are adhering to recent compliance shifts.

There seems to be an inherent conflict between the mandate to retain and supervise all communications and the privacy-oriented nature. To wit, WhatsApp recently released a feature called “Locked Chats” that enables users to shield messages from the prying eyes of third parties by requiring biometric keys — face ID, thumbprints, etc. — for access.

In spite of potential risks, many firms are not ready to dismiss WhatsApp, but to succeed, they’ll need to consider the following policy strategies and solutions to mitigate risk and ensure a long-term solution.

POLICY ENFORCEMENT

While prohibition is an extant solution, many firms lack enforcement capabilities. Many advisors aren't willing to give up WhatsApp as a communication channel, which results in a culture of underground activity and erosion of internal trust. Across the industry, it’s an open secret that off-channel communications are happening at firms with prohibition policies. In fact, knowledge of this activity can even end up being a multiplier for regulatory penalties. Simply put, a policy of strict prohibition does not work.

Instead, firms must adopt a policy that demonstrates both an understanding of the need to communicate over these channels and trust in the field to fully adhere to policy. We’ve seen these types of policies gain the most widespread adoption.

DATA SCRAPERS

Another solution is to engage with third-party software that “scrapes'' the data within a phone’s WhatsApp application and processes it via traditional supervision software. While this appears to solve the issue of supervision, it is problematic for two reasons:

  • First, Meta — the company that owns WhatsApp — includes language in its terms of service, or TOS, that explicitly prohibits this. It says “You will not use (or assist others in using) our Services in ways that…involve any non-personal use of our Services.” Scraping WhatsApp for business communications (i.e. a “non-personal use”) directly violates the TOS. Further, Meta has been very proactive in enforcing its TOS, sometimes resulting in firms being removed from all of Meta’s platforms, including Facebook and Instagram. This would deal a heavy blow to firms that rely heavily on those channels.
  • Second is the issue of data privacy. The solutions require access to the user’s WhatsApp account to collect these communications. But it can be difficult to differentiate between personal and business chats, which are often mingled together. Nobody wants personal conversations to be routed to their compliance team for supervision. The new “Locked Chats” feature compounds this issue; scrapers won’t even know that those hidden folders exist, since access is constrained by a biometric key that the scraper will not have access to. This new feature makes even the retention of chats on WhatsApp personal questionable at best.

So while scrapers may reduce the risk of retaining business communications on the platform, they simultaneously increase the risk of deplatforming by breaking Meta’s TOS, and commingling personal data with business data.

WHATSAPP FOR BUSINESS API-BASED INTEGRATIONS

Alternatively, Meta has an API for integrating “WhatsApp for Business” accounts into more traditional supervisory platforms. As it relates to Meta’s TOS, this is a legitimate API-based solution that enables a firm’s employees to leverage WhatsApp without risking deplatforming. The API connector permits firms to scale supervision across a large workforce without worrying about data loss, while still enjoying the benefits of WhatsApp’s end-to-end encryption.

This integration also eliminates comingling of these conversations within the app, so there's no possibility of a personal conversation being ingested into business supervision platforms. Although API-based integration trailed the need for a legitimate supervision solution, it ultimately reduces the risk of deplatforming while ensuring that business communications in WhatsApp are being adequately supervised in the manner that the SEC expects. 

As with other aspects of compliance, it’s important to formulate an approach that mitigates the vast assortment of risks associated with enabling — or not enabling — WhatsApp as an approved channel for business communications. Without doubt, an API-enabled connection is the most reasonable approach to limiting these risks. Partnering with a technology vendor that leverages this forward-thinking option for supervising WhatsApp messages will ensure that your supervision program is robust, scalable, and business-communications-specific.

Bill Simpson is director of compliance at Hearsay Systems.

Seeking an alternative option for credit exposure? Try an interval fund

Latest News

A second stint for Gallagher at SEC gets crypto world's attention
A second stint for Gallagher at SEC gets crypto world's attention

The former SEC commissioner Daniel Gallagher, now chief legal officer at Robinhood, could be a leading contender to lead the agency if Trump regains the White House.

Finra suspends trio of ex-brokers
Finra suspends trio of ex-brokers

Churning cost customers more than $6 million, according to Finra.

Why don't nearly half of Americans have any investments?
Why don't nearly half of Americans have any investments?

Janus Henderson survey exposes lack of education, generational divides, and gender gaps in investing behaviors.

A $40 trillion opportunity for financial advisors
A $40 trillion opportunity for financial advisors

The best investment advisors can make now is in their tax-planning knowledge.

Advisors’ wallets and hearts have to agree before selling their firm
Advisors’ wallets and hearts have to agree before selling their firm

Advisor-owners must acknowledge from the start that the keep/sell decision is a multi-faceted and difficult choice to make.

SPONSORED Destiny Wealth Partners: RIA Team of the Year shares keys to success

Discover the award-winning strategies behind Destiny Wealth Partners' client-centric approach.

SPONSORED Explore four opportunities to elevate advisor-client relationships

Morningstar’s Joe Agostinelli highlights strategies for advisors to deepen client engagement and drive success