Regulatory requirements around retaining and supervising communications across financial services firms have become more stringent, in particular after an unusually high volume of business-related communications on WhatsApp was uncovered. Regulators have put users of this popular platform on high alert, while simultaneously monitoring whether firms are adhering to recent compliance shifts.
There seems to be an inherent conflict between the mandate to retain and supervise all communications and the privacy-oriented nature. To wit, WhatsApp recently released a feature called “Locked Chats” that enables users to shield messages from the prying eyes of third parties by requiring biometric keys — face ID, thumbprints, etc. — for access.
In spite of potential risks, many firms are not ready to dismiss WhatsApp, but to succeed, they’ll need to consider the following policy strategies and solutions to mitigate risk and ensure a long-term solution.
While prohibition is an extant solution, many firms lack enforcement capabilities. Many advisors aren't willing to give up WhatsApp as a communication channel, which results in a culture of underground activity and erosion of internal trust. Across the industry, it’s an open secret that off-channel communications are happening at firms with prohibition policies. In fact, knowledge of this activity can even end up being a multiplier for regulatory penalties. Simply put, a policy of strict prohibition does not work.
Instead, firms must adopt a policy that demonstrates both an understanding of the need to communicate over these channels and trust in the field to fully adhere to policy. We’ve seen these types of policies gain the most widespread adoption.
Another solution is to engage with third-party software that “scrapes'' the data within a phone’s WhatsApp application and processes it via traditional supervision software. While this appears to solve the issue of supervision, it is problematic for two reasons:
So while scrapers may reduce the risk of retaining business communications on the platform, they simultaneously increase the risk of deplatforming by breaking Meta’s TOS, and commingling personal data with business data.
Alternatively, Meta has an API for integrating “WhatsApp for Business” accounts into more traditional supervisory platforms. As it relates to Meta’s TOS, this is a legitimate API-based solution that enables a firm’s employees to leverage WhatsApp without risking deplatforming. The API connector permits firms to scale supervision across a large workforce without worrying about data loss, while still enjoying the benefits of WhatsApp’s end-to-end encryption.
This integration also eliminates comingling of these conversations within the app, so there's no possibility of a personal conversation being ingested into business supervision platforms. Although API-based integration trailed the need for a legitimate supervision solution, it ultimately reduces the risk of deplatforming while ensuring that business communications in WhatsApp are being adequately supervised in the manner that the SEC expects.
As with other aspects of compliance, it’s important to formulate an approach that mitigates the vast assortment of risks associated with enabling — or not enabling — WhatsApp as an approved channel for business communications. Without doubt, an API-enabled connection is the most reasonable approach to limiting these risks. Partnering with a technology vendor that leverages this forward-thinking option for supervising WhatsApp messages will ensure that your supervision program is robust, scalable, and business-communications-specific.
Bill Simpson is director of compliance at Hearsay Systems.
From outstanding individuals to innovative organizations, find out who made the final shortlist for top honors at the IN awards, now in its second year.
Cresset's Susie Cranston is expecting an economic recession, but says her $65 billion RIA sees "great opportunity" to keep investing in a down market.
“There’s a big pull to alternative investments right now because of volatility of the stock market,” Kevin Gannon, CEO of Robert A. Stanger & Co., said.
Sellers shift focus: It's not about succession anymore.
Platform being adopted by independent-minded advisors who see insurance as a core pillar of their business.
RIAs face rising regulatory pressure in 2025. Forward-looking firms are responding with embedded technology, not more paperwork.
As inheritances are set to reshape client portfolios and next-gen heirs demand digital-first experiences, firms are retooling their wealth tech stacks and succession models in real time.
