What are the compliance requirements for financial services firms?

The financial services industry faces particularly stringent communications recordkeeping requirements. These regulations make no exception for the technical characteristics of specific platforms—if employees conduct business via iMessage, those communications must be captured, retained, and produced upon regulatory request.

SEC Rule 17a-4

SEC Rule 17a-4 requires broker-dealers to retain all business-related communications for specified periods, generally 3-6 years, in a format that is non-rewriteable and non-erasable. This rule was written decades ago for paper records but has been interpreted to apply to all electronic communications, including text messages and instant messaging platforms like iMessage. The "non-rewriteable and non-erasable" requirement creates particular challenges for iMessages since they can be easily deleted with no forensic trace.

FINRA Rule 4511

FINRA Rule 4511 requires member firms to make and preserve books and records, including electronic communications, for regulatory examination. This rule applies broadly to any communication that relates to the firm's business. The challenge with iMessage is that the platform provides no built-in archiving or retention mechanisms—firms must implement their own capture solutions.

MiFID II Requirements

In Europe, MiFID II requires comprehensive recording of telephone conversations and electronic communications relating to transactions. This regulation applies to all communication channels used for business purposes, explicitly including messaging applications. The extraterritorial reach of MiFID II means that U.S. firms operating in European markets must comply with these requirements as well.

Recent Enforcement Actions

The consequences for non-compliance are severe. Since 2022, the SEC and FINRA have issued over $2.7 billion in fines for off-channel communication violations, primarily involving WhatsApp and iMessage. Notable cases include Deloitte receiving a $200,000 FINRA fine after iOS updates disabled their iMessage blocking system, resulting in 676,000 unarchived business communications. Major banks including Bank of America and Morgan Stanley faced individual fines ranging from $125 million to $200 million for similar violations.

Compliance Solutions

Financial institutions typically address iMessage compliance through enterprise mobile device management (MDM) systems that capture messages in real-time, third-party compliance archiving solutions like MirrorWeb, Smarsh, or Global Relay, or policies prohibiting business communications via personal messaging apps. However, enforcement reality shows these policies are often violated, making proactive technical controls necessary. For smaller firms without enterprise MDM, tools like TextKeep can support periodic manual export and archiving, though this approach requires disciplined processes to ensure completeness.