This is most evident with WhatsApp. Many people working in the financial services industry already know that the end-to-end encryption messaging tool is ubiquitous and widely used to keep in touch with colleagues, clients and contacts. But while company policies largely prohibit the use of WhatsApp, financial regulators have stayed away from an outright ban. Instead, they have issued guidance requiring companies to ensure that the instant messaging tools used by their employees are supervised and in compliance with already existing record-keeping rules such as MiFID II.

Last year, the FCA stated that firms need to “take reasonable steps to prevent an employee or contractor from making, sending or receiving relevant telephone conversations and electronic communications on privately-owned equipment which the firm is unable to record or copy.” Similarly, the SEC issued guidance in late 2018 reminding companies of their responsibility to monitor electronic messaging and encouraged them to “stay abreast of evolving technology.”

Ensuring that these guidelines are adhered to has been complicated by the fact that many companies have brought in outright or partial bans on unmonitored instant messaging tools while also adopting bring-your-own-device (BYOD) policies. Largely implemented to cut costs, these BYOD policies mean businesses are now less able to police which communications apps and platforms their employees are using. This means that they now do not have the oversight they need to ensure that employees are adhering to the bans.