WhatsApp, a Late Form U5, and a Ninety-Day Archive
Northline Securities discovered during an internal review that three registered representatives used personal WhatsApp accounts with retail clients throughout a six-week structured-product offering: roughly 2,400 messages, none captured or retained. Separately, a representative resigned March 3 and the firm filed his Form U5 on April 20; a March 10 customer letter alleging $9,000 of unauthorized trading was entered in the complaint register but never placed in the rep's file and never reviewed by a principal; and the firm's cloud email archive permanently deletes messages after 90 days with no write-once, non-erasable storage. FINRA examiners arrive in three weeks. The CCO must decide what to disclose and whether to self-report.
1. Identify each recordkeeping and reporting failure, the governing requirement, and the deadline missed.
Read the worked answer
Off-channel messaging. Business communications must be originated, maintained and supervised: Rules 3110(b)(4) (review of correspondence), 4511 (books and records) and SEA Rule 17a-4(b)(4) (three-year preservation of communications relating to the firm's business). 2,400 uncaptured client messages means both a recordkeeping violation and a supervision failure, because no principal could ever have reviewed them. There is no cure by retrieval; the records do not exist.
Form U5. Must be filed within 30 days of termination (FINRA By-Laws, Article V, Section 3). Filed April 20 for a March 3 resignation: 48 days, roughly 18 days late. Reportable under Rule 4530 as a rule violation only if the firm treats it as such; regardless, it is visible to examiners because the filing date is in FINRA's system.
Complaint handling. Rule 4513 requires the complaint to be recorded and retained four years; Rule 3110(b) requires principal review and documentation. The $9,000 amount does not trigger the Rule 4530(a) 30-day report (threshold $15,000 or allegations of theft, forgery, misappropriation), but it does belong in the Rule 4530(b) quarterly complaint statistics. Missing principal review is the more serious failure.
Email retention. SEA Rule 17a-4(f) requires electronic records preserved on non-rewritable, non-erasable media or under the audit-trail alternative. Ninety-day deletion violates both.
2. Which of these would you self-report, and what is the risk calculus?
Read the worked answer
Sort by (a) whether the examiner will necessarily find it, and (b) whether disclosure converts a technical violation into a cover-up.
Disclose, and lead with it: the off-channel communications. Examiners routinely ask reps about messaging apps and inspect devices; 2,400 messages will surface through interviews or a client's screenshot. Concealment after discovery is what turns a recordkeeping deficiency into a supervision and candor problem, and it is what drives individual liability. Present it as a self-identified, self-remediated finding.
Disclose plainly: the late U5. FINRA already knows the termination and filing dates; there is nothing to gain from framing and everything to lose from being seen as shading it.
Disclose and remediate: the archive configuration. This is systemic, affects every communication, and cannot be explained as a single rep's mistake.
What not to do: volunteer speculation about the complaint's merits, or characterize the $9,000 letter as a service issue. Provide the log, the review memo and the outcome and let the record speak.
3. What remediation do you put in place, and what do you tell the reps about WhatsApp going forward?
Read the worked answer
Technical. Enable capture and archiving of approved mobile channels, or issue firm devices with compliant archiving; reconfigure the email archive to 17a-4(f)-compliant storage with a three-year retention period (with the ability to extend for litigation holds).
Procedural. Amend the WSPs to prohibit business communications on unapproved channels, require annual device attestations and pre-approval for any new app, and add surveillance for messaging traffic. Confirm the policy covers personal devices used for business.
People. Refer the three reps to the disciplinary process; the appropriate outcome for deliberate circumvention of a known policy is typically heightened supervision or termination, not coaching.
Reconstruction. Because the messages cannot be recovered, conduct documented interviews of the three reps and a sample of affected clients to reconstruct what was communicated about the structured product, and review the offering for any misstatements.
What you tell the reps: business communications belong on approved systems, period; using a personal app for firm business is a terminable offense and is detectable; and any rep who self-reports a current use of an unapproved channel in the next ten days will be treated as having made a good-faith error rather than a deliberate violation. That deadline is what converts a policy into evidence of a functioning compliance culture.