The New Self Regulatory Organization (SRO, soon to be called the Canadian Investment Regulatory Organization or CIRO) requires Canadian Dealer Members to keep complete and accurate records of client communications for at least seven years (Rule 3800). This requirement includes electronic communications. Dealer Members are also required to supervise their employees to ensure they are following the rules (Rule 3900). Use of unauthorized communication applications, such as WhatsApp, Signal or text message, are contrary to the Standards of Conduct (Rule 1400).
International Enforcement Trend
In the United States, the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) have entered into multimillion-dollar settlements for use of off-channel communication applications. Enforcement began last fall, when the SEC announced settlements with a dozen U.S. banks with fines totalling over US$1-billion (see our November 2022 Blakes Bulletin: SEC Crackdown on Record-Keeping Failures Offers a Warning to Canadian Securities Firms.). The SEC and CFTC are also targeting institutions based in the United Kingdom and Canada, along with major private equity firms and hedge funds.
Compliance Issues
WhatsApp and other messaging platforms allow users to delete
conversations after specified periods of time. The difficulty of
monitoring, preserving and maintaining these communications
contravenes both supervision and record-keeping requirements of
U.S. securities laws. Most of the institutions that settled with
the SEC had policies in place to prevent off-channel
communications, but they were not complying with those policies.
The failure to comply extended beyond employees. The SEC found that
communications over messaging apps were prevalent among senior
staff, including those in charge of compliance. Some of the
institutions have imposed employee-pay claw backs to help recoup
the fines.
The U.S. Department of Justice (DOJ) has also taken a stance
against corporations using third-party messaging applications to
evade investigation. In March, the DOJ issued a warning to corporations under investigation
for criminal liability. If they do not produce communications from
third-party messaging apps, the DOJ will also investigate the
corporation's policies related to messaging apps and how those
policies are communicated to employees. The DOJ expects
corporations to preserve business-related electronic data and
communications.
Enforcement in Canada
Canadian securities regulators like the SRO (CIRO) are alive to the longstanding, pervasive use of off-channel messaging apps but have yet to hand out large fines solely for unauthorized communications. Some regulators, however, have started adding unauthorized communication contraventions to other allegations of wrongdoing. Canadian firms may want to proactively review their policies surrounding the use of messaging applications and digital record-keeping to ensure that employees and senior staff are in compliance.
For permission to reprint articles, please contact the bulletin@blakes.com Marketing Department.
© 2025 Blake, Cassels & Graydon LLP.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
