Deleted WhatsApp Messages in Financial Services: Advice, Suitability and Record Rules
Financial services is the sector where informal messaging has already produced very large fines — regulators in several jurisdictions have penalised firms heavily for business conducted on unmonitored channels, including WhatsApp on personal phones.
If you're a regulated firm, this isn't a productivity question. Take compliance advice for your jurisdiction; what follows is the practical shape of the problem.
Why regulators care
Most financial regulation includes communication record-keeping obligations: firms must retain records of business communications, be able to produce them, and retain them for a defined period.
The rationale is straightforward — if advice, orders or negotiations happen in a channel nobody records, then market conduct, suitability and mis-selling can't be examined after the fact.
The enforcement pattern has been consistent: fines have followed the absence of records, not proof of misconduct in them. That's an important distinction. A firm can be penalised for the gap itself.
Where WhatsApp specifically fails
Deletion by either party. A client or an adviser can remove a message for everyone, taking your copy with it. A record the participants can edit is not a record.
Personal devices. The most serious failure and the most common. Advisers using personal WhatsApp means the firm holds nothing, controls nothing and can produce nothing.
No attribution. A shared firm number gives no indication which individual said what — which is exactly what a suitability review needs.
No retention control. You can't apply a retention period or demonstrate you applied it.
Disappearing messages. A client can enable a 24-hour timer on the conversation, silently deleting your records on a schedule you didn't choose. See disappearing messages.
The specific risk moments
- Advice given informally. "Off the record" guidance in a chat is still advice, and the informal framing makes it more likely to be imprecise.
- Order instructions. A client instructs a trade by message, the market moves, and the instruction is deleted.
- Suitability discussions. A client's circumstances stated in chat, then deleted, leaving the recommendation unsupported.
- Complaint handling. A complaint raised in chat and withdrawn — but your obligations may have been triggered regardless.
- Fee and charge agreements. Agreed by message, deleted, disputed.
What a compliant setup requires
- Business numbers only. A written, enforced prohibition on conducting business on personal messaging. This is the first control and the one regulators ask about.
- Server-side capture. Messages recorded as they arrive, so deletion by either party marks the record rather than removing it. In Tenashi the message stays tagged "Deleted on WhatsApp".
- Per-individual attribution. Each adviser with their own login, so every message identifies the person who sent it.
- Defined retention. Aligned to your regulator's required period, applied consistently, and demonstrable.
- Access control and revocation. Role-based, removed on departure — see roles and permissions.
- Search and production. The ability to retrieve a client's complete communication history on request, quickly.
- Supervision. Whatever oversight your regime requires, applied to a channel where it's actually possible.
Be realistic about scope
A connected inbox captures conversations with the firm's own numbers. It does not — and must not — reach personal accounts. That's both unlawful in most jurisdictions and not what the obligation asks for.
Which means the policy control is the load-bearing one: business must happen on business numbers. Technology captures what happens there; it cannot capture what happens elsewhere. Firms that have been fined generally had a policy on paper and advisers using personal phones in practice.
If your advisers won't use the firm's channel, that's the problem to solve first. Usually they use personal WhatsApp because the firm's approved channel is worse — which is an argument for a channel clients actually answer, properly recorded, rather than for a prohibition nobody follows.
Related: compliance and record-keeping, GDPR and deleted messages, WhatsApp as legal evidence.
Pricing is flat, from $18/mo.
Get started → · See every feature
FAQ
Can regulated firms use WhatsApp with clients?
Many do, but it generally requires the communications to be captured, retained and supervisable — which the standard WhatsApp Business app doesn't provide. Requirements vary by regulator and jurisdiction, so take compliance advice for your specific regime.
Why have firms been fined over WhatsApp?
Enforcement has focused on business conducted through unmonitored channels — typically advisers using personal messaging, leaving the firm unable to produce records. The penalty followed the absence of records rather than proof of misconduct within them.
What if a client deletes a message containing an instruction?
On a phone-based setup your copy goes too, leaving an instruction you acted on with no record. With server-side capture the message is retained and tagged as deleted, which preserves both the instruction and the fact it was withdrawn.
Can we stop advisers using personal WhatsApp?
Policy is the control, and it needs enforcement rather than just documentation. In practice advisers use personal messaging when the approved channel is worse, so providing a properly recorded channel clients actually answer is usually more effective than a prohibition alone.
How long must financial communication records be kept?
It depends on your regulator — periods of five to seven years are common, and some categories run longer. The requirement is usually to retain, to produce on request, and to demonstrate consistent application.
Does capturing messages cover advisers' personal accounts?
No, and it must not. Capture applies to the firm's own numbers. Monitoring personal accounts is unlawful in most jurisdictions, which is precisely why the policy requiring business on business channels is the load-bearing control.
In financial services the gap in the record is the finding. Business numbers, captured messages, demonstrable retention. Get started.