Social and Mobile Apps: The Escalating Cost of Non-Compliance

The simple starting point is for firms to ask themselves these questions:

Do you really know what tools are being used by your employees to communicate with the market and collaborate internally?
The pandemic and hybrid work have reduced visibility into how individuals are getting their jobs done and makes tools that are familiar and comfortable like mobile apps more likely to cross over from personal lives into business activities. This caught some firms off guard, but others had already been experiencing a shift as younger employees and clients had been pushing firms toward supporting new communications tools such as WhatsApp and other social apps.

Is your benefit/risk/cost equation still accurate?
In comparison to the $200 million fine, regulators have not previously identified deficiencies for social media and text with such ferocity. Fines have historically been much smaller and centered on email, WORM format, text, or generally “electronic communications.” Larger fines were typically seen with long-running deficiencies in recordkeeping. Since 2021, fines have spiked, and the SEC is conducting sweep exams. The combined effect of more retail investors in the market, who prefer using newer tools, which attract scammers and fraud, has gotten the attention of regulators.

Most firms will evaluate the benefits they would gain by allowing use of new tools against the cost and risk of them being used inappropriately. They need to reign in unapproved channels and tackle policies and procedures for the channels they’re using.

How frequently and systemically are you monitoring for use of prohibited networks?
Many firms have defined processes to periodically inspect for the use of prohibited tools (e.g., looking for breadcrumbs indicating that a specific platform like Discord is being used), but practices remain ad-hoc and semi-automated. Every firm should have front-line policies to look for outside business activities (OBA) or other potential conflicts of interest that are likely happening on dark-corner platforms. The adage holds that those with intent on wrongdoing will go where they believe they can avoid detection (just ask my teenagers).

When was the last time you updated your acceptable use and retention policies?
For many firms, reviewing retention policies is not the most exciting way to spend one’s day, but communications policies can easily become out of date or even unintentionally biased towards central IT-controlled tools that we used back in the office. Additionally, firms may not be updating those policies based upon new features or capabilities of tools that they already support (e.g., auto-generated transcripts, whiteboards, bots, etc.). It may be time for firms to make sure that policies are aligned with how business is being conducted today

What training and attestation programs are in place to ensure employees know what to do?
Training on the appropriate use of emerging tools should not be static – it should be specific to the tools being used, the role of the individual using them, with clear consequences laid out for activities that are prohibited. Many firms did not have the ability to take this step at the outset of the pandemic, but with the likely future of hybrid work lying ahead of us, now is the time.