William J. Stellmach and Elizabeth P. Gray are partners and Sean Sandoloski is counsel at Willkie Farr & Gallagher LLP. This post is based on a Willkie memorandum by Mr. Stellmach, Ms. Gray, Mr. Sandoloski, Amelia A. Cottrell, Randall Jackson and Michael S. Schachter.
The government’s ongoing effort to crack down on the use of ephemeral messaging platforms at financial institutions appears to have entered a new phase. According to press reports, the Securities and Exchange Commission (the “Commission” or the “SEC”) is requiring Wall Street banks to undertake an unprecedented review of dozens of their top executives’ and traders’ personal cell phones to determine the frequency with which these platforms are used to conduct bank business.
Apps like WhatsApp, Signal, and Telegram allow users to send messages using end-to-end encryption, which prohibits third parties from accessing data, allowing it to be read by no one other than the sender and recipient. Users can also send ephemeral or “self-destructing” messages that are deleted automatically after they are viewed or some set amount of time after they are sent.
These apps are very popular and in wide use, but their use to conduct securities trading-related business violates laws and regulations that require banks and broker-dealers to maintain and preserve communications—not to mention banks’ own policies. These rules enable the review of records by the Commission and other regulators (such as the Commodity Futures Trading Commission (the “CFTC”)), in the course of their examination and enforcement duties. Indeed, the Commission views these rules as “an integral part of the investor protection function of the Commission, and other securities regulators” because these “records are the primary means of monitoring compliance with applicable securities laws, including antifraud provisions and financial responsibility standards.” [1] This isn’t empty rhetoric. Informal messages have formed the backbone of many high-profile corporate enforcement actions over the years. [2] If communications are migrating to platforms where those messages are neither surveilled nor retained, it becomes materially more challenging for the government to bring all manner of cases.