The head of the UK's Financial Conduct Authority (FCA) confirmed it will not introduce specific rules in relation to the use of encrypted messaging services for unauthorized business communications. The FCA’s announcement is one of the first noticeable moves toward a less prescriptive regulatory environment, and goes against most expectations.
On the face of it, this position appears at odds with US regulators, which have levied around $3 billion in fines on financial services firms since 2021 for failing record-keeping requirements in relation to the improper use of communication devices. The FCA was expected to follow suit. The comments from Nikhil Rathi should not necessarily be interpreted to indicate they won’t, just that specific rules are not planned. This is in line with the traditional principles-based approach adopted by the FCA.
The US approach clearly identifies the use of off-channel encrypted messaging as a barrier to effectively monitoring regulated activity and has enforced regulations in accordance with the perceived risk. Mr Rathi acknowledges that it remains a “significant issue” within the industry.
This type of channel can be abused by individuals with access to sensitive, non-public and confidential information, which is prevalent within financial services. It could facilitate those determined to exploit the financial system for illicit gain and then cover their tracks. In using encrypted messaging services, perpetrators can have confidence that personal messages may not be discoverable by their employer or even the authorities unless willfully disclosed, as messages can be easily or automatically deleted without the ability to recover. This denies investigators a critical source of evidence.
Supervision and enforcement of regulations in this space is difficult, hence the US approach of levying substantial fines for identified non-compliance. This compels companies to self-police their staff communication channels. The fear of US-style enforcement has caused a number of UK firms to impose their own strict policies on device use.
The FCA does require firms to monitor communications related to regulated activity and adopt robust record keeping, including the storage of communications, as well as implement effective compliance frameworks that prevent unauthorized activity. The FCA surveyed UK firms in 2024 and asked them to identify breaches of authorized use policies. Mr. Rathi said they are working on a “case-by-case basis to understand how they [firms] are monitoring these types of activities”. This indicates that the FCA are still active in this space.
It is possible that the announcement will relax internal scrutiny on the issue, but this does not appear a sensible approach. The lack of specific rules around unauthorized use of encrypted messaging does not mean that it is any less of a priority for the FCA, nor that significant enforcement activity is not forthcoming. Organizations need to maintain proper governance and compliance and this announcement shouldn’t be viewed as an opportunity to be less vigilant of unauthorized activity.
The UK’s financial watchdog has decided not to introduce rules to prevent City bankers from using WhatsApp and other encrypted apps for unauthorised business communications. Nikhil Rathi, chief executive of the Financial Conduct Authority, said its decision not to impose a blanket approach was part of a shift away from detailed rulemaking. “We’re not planning any wholesale new rules around this,” he told the Following the Rules podcast. “We don’t think firms should expect from us lots of detailed rules to try and pin down every possible scenario that they are planning for.” The City should expect “a different relationship” with the regulator, he added.
https://www.ft.com/content/d46d1242-b2c2-4dec-ae2a-e7044b4c03be
