Earlier this year, the UK Prudential Regulation Authority (PRA) published a Final Notice against Wyelands Bank Plc (Wyelands). With Wyelands winding down, the PRA issued the bank with a public censure in place of a fine. The breaches identified in the Final Notice, dated 4 April 2023, principally related to breaches of the large exposure rules caused by a failure on Wyelands' part to identify that counterparties to a number of structured finance transactions were connected to its corporate group. 

While naturally there is a detailed discussion of a number of failings in the Final Notice, it is perhaps the PRA's criticisms about Wyelands' record-keeping systems and controls, particularly where the use of an out of band communications app (in this case, WhatsApp) and personal devices are concerned, that have the widest relevance. The use of the out of band communications app and other non-firm-approved messaging services, including Signal and Telegram, but also personal email accounts is an area of interest for regulators across the globe, most notably so far in the US but also in a number of other European jurisdictions. The PRA and Financial Conduct Authority (FCA) are increasingly turning their attention in this direction and we are seeing more frequent use of their supervisory and enforcement powers in connection with this issue. 

The record-keeping issues identified in Wyelands' case (alongside issues with staff correctly filing emails to client files) related largely to a lack of policies and procedures to: (i) manage the use of the out of band communications app for business-related communications; (ii) retain business-related messages on mobile devices (whether issued by Wyelands or owned personally); and (iii) retrieve business-related messages from mobile devices in a timely manner. The bank's directors and senior executives regularly communicated via the out of band communications app (including with external parties) and the lack of policies and procedures meant Wyelands had inadequate oversight of these communications (and consequently incomplete records).

With the exception of certain obligations placed on firms around the period of time for which certain records must be kept, the PRA and FCA requirements in relation to record-keeping lack precision. Firms are given scope to implement systems and controls that meet certain principles in a way that best suits the circumstances of that firm. The primary concern of the regulators is that they can effectively supervise (and, if necessary, investigate) a firm.

That being said, there are a number of steps that all firms should consider in relation to the use of private messaging services and other non-firm-approved messaging platforms, including:

• implementing (as well as reviewing and, where appropriate, updating) policies around the use of personal devices and/or non-firm-approved messaging services for business-related communications. This should in almost all instances include prohibitions on the use of non-firm-approved messaging services to discuss business – with possible exceptions related to business continuity need (for example, in the event that systems go down or in a cyber-attack scenario) or for administrative or logistical messages (for example, to ask a colleague if they are able to attend a meeting). For completeness, policies should also note that non-business-related chats with colleagues on non-firm-approved platforms are permitted; 
• having in place procedures (which are regularly reviewed) to allow for the retrieval of messages sent on mobile devices. This is simpler for firm-issued devices. However, for personally-owned devices, firms could require the use of a variety of apps which allow for both messages to be exchanged securely and for the easier retrieval of any messages that have been sent; 
• monitoring communications and files to identify any evidence that private messaging services are being used. For example, notable gaps in the communications stored on a client file may be indicative of other channels of communication being used – by taking steps to review files in this manner, firms may be able to identify the use of private messaging services before regulatory intervention becomes necessary; and 
• using incentives and disincentives to encourage the right behaviour in employees. It is difficult for firms to completely prevent their employees from using non-firm-approved platforms. However, by taking disciplinary outcomes relating to the use of non-firm-approved devices or platforms into account when it comes to bonus payments or other benefits, firms may be able to limit the extent to which their employees are communicating using platforms over which firms have no oversight or control.

In the early days of the pandemic, out of band communications apps and other private messaging solutions were seen as necessary to ensure business continuity in the face of a workplace that changed dramatically overnight. There may not be much that can be done about historic use of private messaging services (other than identifying potential breaches and seeking to voluntarily obtain copies for record-keeping purposes). However, firms should now have fully integrated systems and controls in place to allow for staff to communicate both internally and externally in a remote or hybrid working environment. This is particularly true given the increased regulatory scrutiny in this area.