Messaging compliance for regulated trade

The short answer

Regulated companies face clear legal duties to preserve transaction records, verify client identities, and protect personal data. Because trading discussions have moved from formal email servers to mobile messaging apps, firms often fail these retention standards without realising it. Meeting these obligations takes an append-only archive that captures messages upon receipt, applies legal holds, and keeps a real export trail.

This article describes how firms in regulated trades usually handle messaging records. It is not legal advice. The duties that apply to you depend on your sector, your licences and your country, and the wording of a national implementing law can change the retention period or the lawful basis you rely on. Take the checklist at the end to your own counsel and have them mark it up against your licence.

The gap nobody planned

When companies ran internal mail servers, automated archiving operated by default through network journaling rules and scheduled backups. Legal teams pulled message archives whenever auditors asked for them, and nobody had to plan for it.

Mobile messaging bypassed that infrastructure entirely when staff began conducting business through chat apps on personal handsets. Employees downloaded WhatsApp to message colleagues, suppliers, and clients directly. What began as an informal shortcut became the primary trading channel for international commerce. Because these direct message streams do not pass through corporate mail servers, firms built high-volume trading operations with no record-keeping systems in place.

Retention rules and data minimisation

Regulated sectors work under strict record-keeping rules:

• Financial trading in the EU. MiFID II Article 16(7) requires investment firms to record electronic communications related to the reception, transmission, and execution of client orders. These records are retained for five years, or up to seven years if a competent supervisory authority asks for them.
• Broker-dealers in the United States. SEC Rule 17a-4 sets a three-year retention period for general business communications. US regulators keep an active enforcement posture against firms that permit off-channel messaging on unarchived personal apps.
• Anti-money laundering rules. The EU AML framework, implemented in Belgium via the Law of 18 September 2017 and updated by the 2024 EU AML package taking effect in 2027, requires obliged entities like diamond traders and precious metal dealers to retain transaction records and customer due diligence files for five years following the end of a commercial relationship.
• Cross-border diamond trade. Council Regulation (EC) No 2368/2002 implements the Kimberley Process Certification Scheme in the EU. Physical shipment documentation has to reconcile with the underlying commercial discussions, which frequently happen over instant messaging.

These retention rules create tension with the General Data Protection Regulation. GDPR Article 5(1)(c) sets data minimisation, while Article 5(1)(e) sets storage limitation. Article 17 gives individuals the right to erasure. Article 17(3)(b) removes that right where retention is necessary to comply with a legal obligation under EU or national law.

Firms balance the two by classifying messages based on content. Communications that document trade executions, pricing agreements, and customer identification are retained under GDPR Article 6(1)(c) to satisfy the record-keeping duty. Routine non-commercial chats pass through automated deletion rules once their operational purpose ends, which is what storage limitation asks for.

A retention schedule has three parts: a start event, a period, and a disposal step. A schedule with no disposal step is a filing cabinet, not a schedule, and it puts the firm on the wrong side of Article 5(1)(e). Disposal also depends on knowing what a message is about, which is why classification sits underneath all of this. You can examine our data retention mechanics in our conversation history documentation.

Legal hold workflows

A legal hold suspends standard disposal schedules for specific records, freezing automated deletion the moment litigation becomes anticipated and preserving files until compliance teams formally release the hold. Under United States civil litigation, the duty to preserve electronically stored information arises the moment litigation is reasonably anticipated, long before a court serves formal discovery orders. Federal Rule of Civil Procedure 37(e) provides for sanctions where parties fail to preserve digital records. Discovery procedures under FRCP 26 and FRCP 34 govern how those records are produced.

A hold that works in practice meets four operational criteria:

1. Rapid deployment. Administrators can place an employee or account under legal hold within hours of receiving notice.
2. Granular targeting. Holds apply to specific custodians, counterparties, and date ranges without freezing unrelated corporate archives.
3. Personnel resilience. Active holds stay intact when an employee leaves the company or hands back their phone.
4. Immutable retention. The hold prevents message destruction even if a user deletes the thread on their local device.

The fourth one is the hard one on messaging. The underlying platform can remove a message while your hold is in force, and the hold has no authority over Meta's servers or the other party's handset. That is the whole argument for capturing at receipt.

Production standards for eDiscovery

A request arrives with four things in it: a custodian list, a date range, a set of search terms, and a production format. Handing back unsorted mobile screenshots fails evidentiary standards and invites a procedural challenge. Threads with no boundaries, voice notes that hold the decision, and group chats where most of the traffic has nothing to do with the matter all make messaging harder to produce than email.

An evidentiary production for messaging data includes:

• Full conversation threads arranged in strict chronological order.
• Participant identification mapping phone numbers and handles to verified real-world identities.
• Universal timestamps normalised to a single timezone across all channels.
• Voice notes paired directly with their audio files and complete text transcripts.
• Cryptographic hash values, such as SHA-256, attached to the data package to prove records were not altered during export.

Review our technical export specifications in the data export documentation.

Managing personal devices in business operations

Firms cannot bypass record-keeping obligations by allowing staff to conduct business on personal hardware. If an employee negotiates a rough diamond parcel or executes a client trade on a personal phone, those messages are corporate business records under the law.

A BYOD policy that prohibits business messaging on personal devices without software controls behind it creates legal exposure. If regulatory scrutiny later shows that executives routinely dealt with clients over unmonitored apps, the written prohibition proves that management understood the requirement and failed to supervise. A policy nobody follows documents that you knew.

Monitoring personal phone accounts raises serious employee privacy problems under GDPR and domestic labour law. In several European jurisdictions, employer monitoring requires formal consultation with the works council before it starts.

The workable standard used by regulated firms is a separate business account on the employee's device. The company captures and archives the business account with the employee's knowledge, the personal account stays unmonitored, and a written policy says business is not done on the personal one.

Evidentiary issues with deleted messages

Relying on physical device backups for compliance archiving creates an evidentiary hole:

Backup-based archive:
Sender writes: "Price is 500" ---> Sender deletes message ---> Sync runs ---> Message missing from archive

Gateway-level capture:
Sender writes: "Price is 500" ---> Gateway records text (Event #1)
Sender deletes message       ---> Gateway records deletion timestamp (Event #2)
Result: Both the original price text and the deletion event remain preserved forever.

If an archive periodically syncs with a phone, any message deleted by a counterparty before the sync runs disappears from the corporate record. An archive that holds up captures traffic at the network gateway the moment it arrives. When a sender deletes a message, the system logs the deletion timestamp as an independent event while retaining the original text. For a dispute over a price, the record that somebody removed a number at 16:42 on a Friday is often worth more than the number was.

Operational compliance checklist

Use this checklist to audit your company's messaging retention practices this quarter:

1. Appoint a named compliance officer responsible for all electronic messaging archives.
2. Audit all staff to catalogue every messaging channel used for commercial discussions, including unauthorised apps.
3. Identify the specific statutory retention duties that govern your industry, such as MiFID II, AML law, or SEC rules.
4. Define written retention schedules with explicit disposal rules for every category of business communication.
5. Establish your lawful basis under GDPR Article 6 for retaining customer and employee communications.
6. Sign a data processing agreement under GDPR Article 28 with every archive and software vendor.
7. Run a test legal hold across a sample custodian account to confirm disposal halts correctly.
8. Run an end-to-end test of a subject access request under GDPR Article 15 using real customer identifiers.
9. Verify that your message data physically sits in a jurisdiction that satisfies your data residency requirements.
10. Restrict archive query permissions to authorised compliance personnel and keep an immutable access log.
11. Document an offboarding protocol that preserves and transfers message archives when employees resign.

Built-in compliance architecture

CommunicationOS provides dedicated infrastructure for regulated trading desks and enterprise operations. The platform maintains an append-only compliance archive with instant legal hold controls, full eDiscovery exports, and end-to-end audit logging.

The SOC 2 Type II audit is under way and ISO 27001 is planned, with data residency inside the European Union today. Enterprise teams manage identities via SAML SSO and SCIM provisioning, bring their own encryption keys, and transfer account ownership when staff move on.

Review our technical security guarantees in our security architecture guide and inspect our uptime commitments in the service level agreement.