14 ms·

Banks hit with millions in fines for using Signal and WhatsApp

253 points by ikue 3y ago

pipo234 3y ago
Are US bank employees prohibited from discussing financial matters using anything but official channels (email, paper?) per se OR is this about using other channels and failing to preserve records of the conversations?
- polygamous_bat 3y ago
  AFAIK you are allowed to use any channel as long as you preserve records of the conversation. However, meeting the standards for preservation is quite difficult, which is why employees of financial institutions are generally told not to communicate outside person-to-person, or channels vetted by their company (and lawyers thereof).
  - pipo234 3y ago
    Thanks! That makes a lot of sense.
  - SilasX 3y ago
    So ... you aren't obligated to preserve records of the conversation if the channel is "in person", then.
    - deleted 3y ago
      [deleted]
    - TimTheTinker 3y ago
      Right - or if it's over the phone.
      - xhkkffbf 3y ago
        What if I dictate into my phone and What's App sends it as text? Purely to save bandwidth of course.
        pasc1878 3y ago
        That is one of the things that the banks are being fined for.
      - freetanga 3y ago
        I um unsure about current status in the States, but in Europe all conversations with a client over the phone where you might discuss commercial terms need to be recorded. Banks just cover their backs, and for customer facing positions all phone calls, no matter if through landlines (or IP telephony) or cell are recorded, either by the PBX software or by the carrier. Employees are reminded not to use these lines for personal reasons (imagine an employee using the phone line to discuss their health with their doctor, and the employer just recorded extremely sensitive information from an employee), but the alternative means a strong fine from the regulators (usually the local AML authority).
    - freetanga 3y ago
      Mostly not. But many interactions such as a Risk and Audit Committee are required to have minutes and signed by all participants. This is usually for all sessions which shape and oversee key policies such as Risk, AML, Audit, etc…
  - Sunspark 3y ago
    Such a waste of time trying intently to regulate and control communication. People will just get a second private device that is not managed by the organization, and if there is a mutually beneficial advantage to doing so, the other party will do the same as well. This has been going on forever, I remember when they kicked up a huge fuss when they found out that people were doing direct pin-to-pin messages on the blackberry (was not logged for boss to read at the time).
    - fidotron 3y ago
      Isn't this an argument that doing anything that is illegal but beneficial to the conspirators should be left alone? If it were totally allowed and widespread how would there be any pretence of fairness in the markets? Of course you could say that at least then people would be appreciating the reality of the situation . . .
    - edmundsauto 3y ago
      It’s actually a bit of a trap - if you are caught using secondary devices, it speaks to intent. Similarly, when you deposit money at a bank and they ask you to certify these are not proceeds of a crime: they aren’t expecting to catch people at that step. But if they catch you later, boom you defrauded a bank by lying and have additional charges.
      - ghostpepper 3y ago
        How is this different from having laws on the books that ensure all citizens are breaking the law at any given time? Doesn't feel like how laws are meant to be used
        edmundsauto 3y ago
        Because it applies to certain regulated industries and people who work in those industries. It’s not wide ranging.
      - Sunspark 3y ago
        It's not illegal to own a personal device, it's also not illegal to be friends with your coworkers if you trust them. There is no "intent" here. What you are describing is an organized criminal conspiracy which is illegal no matter what device or system you're using. What I am talking about here is whether the employer should get to listen in to all your calls and read all your emails and text messages. Why do you think they like BYOD so much? Because they can get a window into your personal life, what apps you have installed, etc.
  - veave 3y ago
    It's a bit weird that even though they can communicate person-to-person, where records won't be kept, they are supposed to keep records of electronic communication.
    - joosters 3y ago
      Not really. How on earth could that ever be implemented?
      - loeg 3y ago
        In person conversations could be required to be recorded with a portable voice recording device (like a tape deck or phone). Same for phone calls. The regulatory authorities exempt those communications for now, but it isn't clear that there is any kind of consistent standard / reasoning.
    - polygamous_bat 3y ago
      Well, it's incredibly hard to scale fraud only through person-to-person communications. It's not impossible, but think about the scale that online communication would allow.
      - misja111 3y ago
        This has nothing to do with scaling. How do you picture that, some employee would broadcast sensitive information to a WhatsApp group, in order to reach as many others as possible at once? The offense here is that no effort was done to keep records of the communication. It would have been ok to use WhatsApp if they somehow would have archived all communications. Records of communications have to be kept so that auditors can verify that no inside trading secrets were communicated to others, for instance.
      - bonestamp2 3y ago
        Now I understand why some of the banks wanted people back in the office as soon as possible. Trying to support their commercial real estate bags is likely another.
  - dundarious 3y ago
    Also, compliance teams want live or near-live access, and do run dynamic filters on that live content. I can’t imagine a non-criminal* compliance team accepting a solution that is T+1 or that depends on manual action from the employee. * I’m barely using hyperbole
- ikue 3y ago
  It is a record keeping issue from what they discussed and the same thing was said in an article at ComputerWorld. https://www.computerworld.com/article/3668574/banks-face-a-whatsapp-reckoning-as-regulators-clamp-down-on-messaging-apps.html https://www.computerworld.com/article/3668574/banks-face-a-w...
- loeg 3y ago
  So the law as written regards keeping records of inter-office memoranda, but the regulators have cheerfully expanded the scope of this to include essentially all communication by bank employees (except maybe phone calls).
  - Sunspark 3y ago
    No, it includes calls now. Traditional calls over copper telephone lines are not recorded, but digital calls over MS Teams or whatever are recorded and kept for review. You still need a secondary device if you want to have a private conversation.
    - pasc1878 3y ago
      No for bank traders all phone calls are recorded and have been done since at least the 1990s
- whycome 3y ago
  We're in a time where these tools have replaced face to face conversations -- and those previous conversations never required record keeping.
- ajross 3y ago
  No, that's just what the outrageous clickbait headline[1] fooled you into thinking. The banks aren't being fined for using Signal or WhatsApp or any particular technology, they're being fined for failing to keep records of regulated communication they're required by law to present for auditing. Obviously if you use tools that don't keep records, you need to find a way to save it yourself. [1] Bad in the CNBC original, but actually truncated here on HN to remove the explanatory clause. The original reads "Banks hit with $549 million in fines for use of Signal, WhatsApp to evade regulators’ reach"
FirmwareBurner 3y ago
Ha, in Europe WhatsApp is even used by doctors and teachers to discuss patient/student matters, and even some government offices use it. It's wild how entrenched it is in every aspects of society, from social to business. Goes to show you how far good UX, simplicity and ease of use can take you.
- bombolo 3y ago
  Never heard of it. Perhaps not in the entire europe?
  - FirmwareBurner 3y ago
    Can't speak for the entire Europe obviously, usage varies from country to country, but where I've been it's pretty well entrenched for bot social and business.
    - denton-scratch 3y ago
      WhatsApp is widely used by UK ministers to communicate with potential donors, lobbyists and other politicians. I don't know why it's allowed; in-person meetings are supposed to have a civil servant present and taking notes. WhatsApp gets them off the FOI hook.
      - brox 3y ago
        Case in point: The ongoing Covid-19 inquiry request for access to government WhatsApp messages: https://www.ft.com/content/208263bf-b6bb-4ea6-8e6b-ee2e522ac786 https://www.ft.com/content/208263bf-b6bb-4ea6-8e6b-ee2e522ac...
      - developer93 3y ago
        I thought it doesn't, the law just doesn't seem to be enforced properly?
      - caycep 3y ago
        is it feasible to have a reg where WhatsApp is allowed, as long as a copy of the transcript post-decryption goes to the national archives or whatnot?
segmondy 3y ago
So long as the fine is affordable, they will keep using it. Folks in the Finance industry using these apps are doing so for a reason.
- joosters 3y ago
  I think the record is pretty good for banks switching behaviour after being fined for a specific failing. They do know that if they get caught doing the exact same thing again, the punishment will be more costly. It's far cheaper (and more deniable) to find a slightly different way round the regulations, see if/when you get fined for that, then move on to something else again...
- bennyelv 3y ago
  In my experience it's simply down to convenience rather than malice. You have all your colleagues phone numbers, you know that a whatsapp is going to fire a notification that will get noticed whereas an email may not. Or that email will go to the "work phone" which isn't sitting on the sideboard somewhere rather than in the person's pocket. That said, there aren't any banks that don't have a comprehensive employee training program on security and compliance, so "I didn't realise" isn't going to be a valid excuse. That's not to say that there isn't any deliberately malicious use going on, but it's unlikely that malicious use would be uncovered.
qwerty456127 3y ago
No person on Earth (except a very reasonably suspected terrorist perhaps, because he could use that for an attack trigger) should be ever denied privacy. What if I worked at a bank and had to text something urgent to my dear? I would find it asolutely unacceptable for anybody to ever read that, no matter how innocent and banal our conversatioun would be. To me that would be equivalent to tapping into my brain and eavesdropping on my very thoughts.
- richbell 3y ago
  As per the article, the issue is that employees were using encrypted messaging apps for work purposes. This is strictly forbidden by regulations, or at least failing to preserve your communications is.
  - qwerty456127 3y ago
    I see... This sounds reasonable for some environments. But I doubt the banks are going to differentiate these, they will probably just ban private messengers altogether.
    - 1MachineElf 3y ago
      As someone who currently performs information risk management for a financial institution, I'll say that private messaging doesn't need to be banned per-se. It's just that all company business is the responsibility of the leadership, so ultimately, business communications needed to be reserved for business communication platforms over which leadership can enforce policy. Privacy is a component of this. These banks needed processes and controls to ensure their requirements are being met: Records of electronic communication, technical security controls to ensure the privacy of protected communication, approved communication mediums/channels for different classifications of information, periodic reviews on the adequacy of these controls, etc. Sometimes the restriction of things like WhatsApp, Signal, etc. are seen as an affront to individual privacy. That's not what this is about. This is about preventing a lot of dangerous scenarios, like: 1. Employees at your bank do something evil that's also against the law, but because they used Signal/WhatsApp, no records of the communication can be used as evidence in court. 2. The bank has invested millions upon millions into an information security program. Someone decides to use Signal/WhatsApp to share sensitive account numbers. Signal/WhatsApp ends up with a vulnerability that exposes the information, rendering the InfoSec program protections ineffective. 3. Like #2, but the information in WhatsApp/Signal is super important. The employees who kept it there all leave and/or get into fatal accidents. How will that impact the bank? 4. Your manager starts a group chat for the team via text message and conversations about work occur. Turns out someone in the conversation is involved with a scandal. Because you talked about work stuff outside of the approved comms channels, your personal phone can now be taken and used as evidence in a court (even if they can't pull the encrypted messages from it!) It's just better for everyone to keep work communications in one place that the company has control over, and your personal device/apps totally separate from it.
jszymborski 3y ago
Sounds like this is less about Signal/WA and more about them not archiving methods. They could in theory run _e.g._ `sigtop` every couple of months and encrypt it (e.g. age or veracrypt). It's a complicated workflow but I imagine they have a pipeline for emails that isnt much less complicated, but also isnt E2EE.
- developer93 3y ago
  WhatsApp at least has the possibility to back up messages, maybe signal too.
  - jszymborski 3y ago
    It's harder on Signal but there are tools to do it on desktop. https://github.com/tbvdm/sigtop https://github.com/tbvdm/sigtop
nickpinkston 3y ago
Cost of doing business - just a really expensive phone plan for collusion.
- bratgpttamer 3y ago
  "Think of it as an investment!"
enterthematrix 3y ago
This headline is clickbait. The issue is banks not preserving records, something that the rules are ABUNDANTLY clear on.
- richbell 3y ago
  The full headline is "...to evade regulators’ reach", which is much clearer.
  - ikue 3y ago
    I had a problem with including the full headline because only so many characters could be used in the title of the post.
    - yorwba 3y ago
      Banks fined millions for using chat apps to evade regulators
    - richbell 3y ago
      That makes sense. The title character limit seems to be a cause of frequent confusion.
      - ikue 3y ago
        It does and the limit makes it come off as clickbait-y which I don't like.
        WarOnPrivacy 3y ago
        Personally, I sympathize. Rewriting headlines here (when necessary) can be tough; it isn't a given that the optimal one will reveal itself.
    - psychphysic 3y ago
      You could have used "Banks fined millions evading regulation with Signal & WhatsApp" News headlines have rules they use to make for shorter sentences. They'd probably write "Banks fined millions, delete records, use E2E apps"
gmd63 3y ago
"We are pleased to resolve this matter" Nobody should ever be "pleased" with knowingly breaking the law. When will we ever get serious about law enforcement for this type of crime?
- ot1138 3y ago
  It's not a law. It's a regulation. There is a difference.
- OO000oo 3y ago
  > When will we ever get serious about law enforcement for this type of crime? No sooner than the day we abolish the profit motive.
- dahfizz 3y ago
  Using WhatApp is not a "crime". There were no laws broken. This is just some regulators giving out fines because they can't spy on employee's private messages. If bureaucrats were on my ass about something so stupid, I would be very pleased once the matter was resolved.
  - deleted 3y ago
    [deleted]
  - gmd63 3y ago
    It's a rule that upon being broken allows the SEC to fine you, which is why they are paying a bunch of money. Are you saying that we should not be able to require banks of a certain size to keep records, so that the highway patrol officers of finance can economically pull you over when you're speeding? Or should we allow everyone to use fuzzbusters effectively making the law pointless?
    - dahfizz 3y ago
      > Are you saying that we should not be able to require banks of a certain size to keep records No. I'm saying this is just some boring, annoying regulation, and your grandstanding about wanting people to feel bad about breaking laws is misguided.
Traubenfuchs 3y ago
What‘s the solution for the banks here? Officially prohibiting those messenger apps but off-the-record recommending them on private phones to dodge regulators?
- pasc1878 3y ago
  No the traders would have to use approved messing apps. The banks don"t like not knowing as it is easiest to defraud the company you are working for.
imwillofficial 3y ago
Yeah I’m sure it was all totally innocent /s
Vicinity9635 3y ago
>$549 million Big headline grabbing number. But what % of their quarterly profit is that? Slap on the wrist, I suspect.
- mulmen 3y ago
  Net income for Q2 of 2023 was reported as (this is Wells Fargo...) $4,938,000,000 so $549,000,000 is a little over 10%. https://www08.wellsfargomedia.com/assets/pdf/about/investor-relations/earnings/second-quarter-2023-earnings.pdf https://www08.wellsfargomedia.com/assets/pdf/about/investor-...
dreamcompiler 3y ago
At this point I cannot understand why anybody would use Wells Fargo as their bank. WF has proven repeatedly that they are pretty much the opposite of what everybody thinks a good bank should be. Repeated law violations; repeated screwing-over of their customers. Why are they still in business?
- jermaustin1 3y ago
  As a WF customer... its lock-in. The amount of work I would need to do to switch banks thanks to bill pay, auto-drafts, etc, is not worth the headache.
  - clairity 3y ago
    now that physical branches are not really a differentiator of big banks, a couple hours of your time spread out over a couple months is totally worth the switch to a credit union in lower fees, better service, and supporting a more local economy. it's completely, undeniably worth it. unless you're a real big shot (worth millions in assets to the bank) who doesn't have to deal with the dehumanizing aspects of corporate "customer service", there is zero reason to be with anything other than a small local bank/credit union.
    - donatj 3y ago
      FWIW the handful of times I've dealt with WF customer service they've been helpful and friendly solving my problems easily. My credit union on the other hand could not understand why I wouldn't give them my card number over the phone whenthey called me.
      - dieselgate 3y ago
        I don’t think the issue is their customer service not being helpful it’s just that the bank is so predatory. Things like high fees ($10/month) for checking accounts being below a threshold or opening up bogus accounts for people.
  - 3y ago
ReptileMan 3y ago
How can they prove that business was discussed if records are not preserved
- mulmen 3y ago
  RE: Loan application Mr. Smith, please review the updated terms on WhatsApp.
  - ReptileMan 3y ago
    We are talking about inter company communication. No one on wall street should be that stupid to mention something like this in email
    - deleted 3y ago
      [deleted]
- bratgpttamer 3y ago
  Presumably the same way my math teacher marked answers wrong when I didn't show my work.
kolbe 3y ago
All the government needs to do to get HN on board with criminalizing encrypted communications is to implicate a bank. Bear in-mind, the SEC didn't find any actual criminal activity here. The banks just failed to retain the conversations that took place by their employees via encrypted channels (a necessary feature of encrypted communication).
- psychlops 3y ago
  It's up to the reader to speculate how much criminal activity took place in the conversations they failed to retain. I, for one, am certain it was all just brokers gabbing about American Idol.
  - kolbe 3y ago
    You realize these are just people, right? People who work at banks are people like you and me. They can use iMessage to talk about whatever they want. Should we assume every single Google employee talking to another person in tech using iMessage was talking about how to subvert democracy or dark patterning a new scam? Or are they talking about what time dinner is, who's picking up the kids today, look at this meme, etc...
jgalt212 3y ago
Dumb question: If these apps offer end-to-end encryption, how is anyone getting caught?
- lbwtaylor 3y ago
  Lots of ways: - A banker answers honestly when interviewed by the regulator because they decide it's better for the Bank to take the fine than lie to regulator and risk personal criminal charges (unlikely, but why take that risk?). - Regulator asks for evidence of some documentation (like trade confirmation), compliance asks banker, banker doesn't have it and admits it was over this app. - Whistleblower or other source makes regulator believe there are prohibited communication and regulator demands phones be turned over. - Other similar banks are caught in violation, and regulator does sweep of similar banks and demands phones be turned over. The regulator has the ability to shut down the bank. The bank can easily tell the banker to turn over an unlocked phone or face legal action. The banker then turns over the phone.
  - jgalt212 3y ago
    I'd delete all my messages before doing any of that. I'm not one for deceiving the regulators, but for lack of a better term when it comes to compliance, they cannot handle the truth.
    - lbwtaylor 3y ago
      For what it's worth, that's a path towards obstruction charges.
skrowl 3y ago
[dead]
1MachineElf 3y ago
Reposting my comment here: https://news.ycombinator.com/item?id=37050595 https://news.ycombinator.com/item?id=37050595 As someone who currently performs information risk management for a financial institution, I'll say that private messaging doesn't need to be banned per-se. It's just that all company business is the responsibility of the leadership, so ultimately, business communications needed to be reserved for business communication platforms over which leadership can enforce policy. Privacy is a component of this. These banks needed processes and controls to ensure their requirements are being met: Records of electronic communication, technical security controls to ensure the privacy of protected communication, approved communication mediums/channels for different classifications of information, periodic reviews on the adequacy of these controls, etc. Sometimes the restriction of things like WhatsApp, Signal, etc. are seen as an affront to individual privacy. That's not what this is about. This is about preventing a lot of dangerous scenarios, like: 1. Employees at your bank do something evil that's also against the law, but because they used Signal/WhatsApp, no records of the communication can be used as evidence in court. 2. The bank has invested millions upon millions into an information security program. Someone decides to use Signal/WhatsApp to share sensitive account numbers. Signal/WhatsApp ends up with a vulnerability that exposes the information, rendering the InfoSec program protections ineffective. 3. Like #2, but the information in WhatsApp/Signal is super important. The employees who kept it there all leave and/or get into fatal accidents. How will that impact the bank? 4. Your manager starts a group chat for the team via text message and conversations about work occur. Turns out someone in the conversation is involved with a scandal. Because you talked about work stuff outside of the approved comms channels, your personal phone can now be taken and used as evidence in a court (even if they can't pull the encrypted messages from it!) It's just better for everyone to keep work communications in one place that the company has control over, and your personal device/apps totally separate from it.
donatj 3y ago
The whole record keeping requirement for written correspondence generally seems completely unreasonable. Presumably telephone calls, zoom calls and in person meetings aren't recorded? Why should that be different if it's written?
- DANmode 3y ago
  > Presumably telephone calls, zoom calls and in person meetings aren't recorded? Of course they are. No offense: Where have you been?
  - betaby 3y ago
    Since when they are all recorded? It definitely wasn't the case ~15 years ago.
    - DANmode 3y ago
      Way too much storage sitting in Utah for the conversations to not be kept for at least some time. Obviously I can't show you.
  - donatj 3y ago
    > Where have you been? Working in education the last 10 years. I mean all of that seems really unreasonable if that's the case. Where I work they took my work phone away because I wasn't using it enough. Now if I need to make a call, it's just with my cell phone. No way that's being recorded. > in person meetings Presume you don't sit down at the table and set up mics before you start talking?
- hsjqllzlfkf 3y ago
  > Presumably telephone calls, zoom calls and in person meetings aren't recorded? Why do you presume that? Where I work every call is recorded.
  - betaby 3y ago
    How much data is that? Where it's stored? How's that achieved for the company provided IPhones?
omgJustTest 3y ago
> Wells Fargo, the fourth-biggest U.S. bank by assets and a relatively small player on Wall Street, racked up the most fines on Tuesday, with $200 million in penalties. > “We are pleased to resolve this matter,” said Wells Fargo spokeswoman Laurie Kight. Unfortunate, penalty appears not big enough. As another key responsibility, these individuals are forbidden from insider trading... which if they are not keeping records is basically not possible to police.
bartchamdo 3y ago
This won’t be fixed until bank executives are jailed. Otherwise they make more money than they are fined, so what is the incentive to stop?
- balderdash 3y ago
  or the fines are actually levied against the offending parties and leadership as opposed to sticking it to the shareholders
- jcims 3y ago
  I work at a bank. I could send some bullshit MNPI to a coworker via whatsapp and get my boss fired? Sweet!
  - DANmode 3y ago
    Burden of proof should (and often does) require: Intent, pattern of doing business this way.
  - bratgpttamer 3y ago
    "work at a bank" != "banking executives" "some bullshit MNPI to a coworker" != billion-dollar collusion/schemes "fired" != "jailed" I'm afraid I'll never understand this class of refutation that categorically misunderstands every component of a sentence.
balderdash 3y ago
If anyone is a glutton for punishment there are overlapping records requirements, but this is the one that is the one that is probably most relevant to those in the securities industry https://www.finra.org/rules-guidance/key-topics/books-records#electronic-communications https://www.finra.org/rules-guidance/key-topics/books-record... "Firms may not permit the use of any type of electronic communication if they are unable to satisfy the applicable recordkeeping requirements with respect to that particular type of electronic communication."
MengerSponge 3y ago
Wells Fargo gross profit for the twelve months ending June 30, 2023 was $80.279B. Billion, with a B. A $0.5B fine is both a lot and nowhere near enough. I imagine a smaller fine would be a more effective deterrent if it was directed at the C-suite instead of the whole corporation. Maybe a little jail time too, as a treat.
- in3d 3y ago
  Wrong. That’s revenue, not profit.
BaseballPhysics 3y ago
To the surprise of no one, Matt Levine has written about this a few times (there's some other linked issues in here as well): https://www.bloomberg.com/opinion/articles/2023-08-08/don-t-do-deals-on-linkedin https://www.bloomberg.com/opinion/articles/2023-08-08/don-t-... His is a pretty balanced take and raises some interesting points: > I have argued that the SEC has aggressively expanded the recordkeeping requirements. In the olden days, almost all communication was informal and not recorded, and only formal decisions were memorialized in typed and carbon-papered memos, so the SEC had access only to a pretty limited slice of communications. Now, vastly more informal communication is text-based, and texting is a substitute for conversation, not for formal memos. The rest of the piece and some of his related commentary in the area is worth a read.
- mvdtnz 3y ago
  I don't see a downside to expanding the record keeping requirements. Record keeping is easier than ever and frankly banks haven't proven themselves worthy of our trust. Sounds great to me.
  - lotsofpulp 3y ago
    I assume being able to have face to face off the record conversations providing plausible deniability to participants is one of the big reasons finance and other related businesses like to be in Manhattan.
    - Terr_ 3y ago
      Perhaps also a factor in why some managers prefer to manage employees in-person rather than remotely. When it comes to avoiding the record, it doesn't have to be lofty corrupt/ish deals or schemes, but also cases like certain anti-union threats, or even plain personal power-tripping.
      - red-iron-pine 3y ago
        definitely a factor. e.g. the C-level one-liner email that consists of "lets have a chat about this" doesn't even have to be anything malicious, such as not wanting to socialize an idea until it's fully-baked or hiring for a new VP role
monkeywork 3y ago
Work in the sector and once the investigations / fines came out massive notifications went out across the board reminding everyone not to use unapproved comms. Was this used for nefarious purposes - possibly - but more likely it was general communications between team members using a platform that is more comfortable to them than either 1st party tools or something approved like teams. 99.9% of this was likely reminders for meetings, attendance and coverage messages, a message to a team member who timezone shifted from you and may be off any you need an answer etc. I'd guess most people involved didn't even consider the record keeping because their day to day jobs don't involve actual trading info, and the "encryption" of those services likely made them feel a more comfortable than they should. Not trying to excuse the behavior - yes the record keeping is important - but I think it's also important to realize this was likely largely innocent.
- alx__ 3y ago
  This is a pretty weak excuse. It's not hard to keep your work comms in the approved software. I would tell people to fuck off if they wanted to invade my personal device with work chatter. Boundaries are good
  - monkeywork 3y ago
    great - however you are one person, the large banks involved here have staff of a few hundred thousand each across several countries and with various backgrounds and norms, many who are also friends and have contact with each other outside of office hours. I agree, one needs to keep work comms on approved software, I'm simply stating that while it's fun to be like "oohh big bad bank was hiding secret convos" it was more likely "janet i'm out today can you take the meeting with svp of <insert corp>" Put another way context matters in terms of how the public should react to the news, not so much the result (fines) or the regulations / requirements.
    - alx__ 3y ago
      Literally the only reason to use Signal is to talk about unionizing, drugs, or shady biz deals. Texting your coworker, would the usual path, not some secondary software that requires both people to set up ahead of time.
freeboty 3y ago
[dead]
juliangmp 3y ago
Just a few millions? Doubt they'll even notice
voytec 3y ago
Jail time is a penalty that can't be transferred over to customers.
JustLurking2022 3y ago
Worked in an investment bank, although not in a client facing role, and it's not quite as simple as it seems - if your client reaches out with a question via text or WhatsApp, technically you should redirect them to use your bank's secure messaging app of choice. The problem is no one has ever heard of Symphony, doesn't want to install it so they can ask a simple question, and the user experience is meh at best. If you do the right thing, clients would likely perceive you as difficult to work with and perhaps go elsewhere. To done extent, the inevitable fines might be seen as a necessary cost of doing business. So a pretty severe crackdown was necessary to ensure everyone is properly incentivized to inflict this pain upon clients.
bratgpttamer 3y ago
Okay, hear me out: force banks to adopt blockchain, but just for their DMs.

253 points by ikue 3y ago

Are US bank employees prohibited from discussing financial matters using anything but official channels (email, paper?) per se OR is this about using other channels and failing to preserve records of the conversations?

polygamous_bat 3y ago
AFAIK you are allowed to use any channel as long as you preserve records of the conversation. However, meeting the standards for preservation is quite difficult, which is why employees of financial institutions are generally told not to communicate outside person-to-person, or channels vetted by their company (and lawyers thereof).
- pipo234 3y ago
  Thanks! That makes a lot of sense.
- SilasX 3y ago
  So ... you aren't obligated to preserve records of the conversation if the channel is "in person", then.
  - deleted 3y ago
    [deleted]
  - TimTheTinker 3y ago
    Right - or if it's over the phone.
    - xhkkffbf 3y ago
      What if I dictate into my phone and What's App sends it as text? Purely to save bandwidth of course.
      - pasc1878 3y ago
        That is one of the things that the banks are being fined for.
    - freetanga 3y ago
      I um unsure about current status in the States, but in Europe all conversations with a client over the phone where you might discuss commercial terms need to be recorded. Banks just cover their backs, and for customer facing positions all phone calls, no matter if through landlines (or IP telephony) or cell are recorded, either by the PBX software or by the carrier. Employees are reminded not to use these lines for personal reasons (imagine an employee using the phone line to discuss their health with their doctor, and the employer just recorded extremely sensitive information from an employee), but the alternative means a strong fine from the regulators (usually the local AML authority).
  - freetanga 3y ago
    Mostly not. But many interactions such as a Risk and Audit Committee are required to have minutes and signed by all participants. This is usually for all sessions which shape and oversee key policies such as Risk, AML, Audit, etc…
- Sunspark 3y ago
  Such a waste of time trying intently to regulate and control communication. People will just get a second private device that is not managed by the organization, and if there is a mutually beneficial advantage to doing so, the other party will do the same as well. This has been going on forever, I remember when they kicked up a huge fuss when they found out that people were doing direct pin-to-pin messages on the blackberry (was not logged for boss to read at the time).
  - fidotron 3y ago
    Isn't this an argument that doing anything that is illegal but beneficial to the conspirators should be left alone? If it were totally allowed and widespread how would there be any pretence of fairness in the markets? Of course you could say that at least then people would be appreciating the reality of the situation . . .
  - edmundsauto 3y ago
    It’s actually a bit of a trap - if you are caught using secondary devices, it speaks to intent. Similarly, when you deposit money at a bank and they ask you to certify these are not proceeds of a crime: they aren’t expecting to catch people at that step. But if they catch you later, boom you defrauded a bank by lying and have additional charges.
    - ghostpepper 3y ago
      How is this different from having laws on the books that ensure all citizens are breaking the law at any given time? Doesn't feel like how laws are meant to be used
      - edmundsauto 3y ago
        Because it applies to certain regulated industries and people who work in those industries. It’s not wide ranging.
    - Sunspark 3y ago
      It's not illegal to own a personal device, it's also not illegal to be friends with your coworkers if you trust them. There is no "intent" here. What you are describing is an organized criminal conspiracy which is illegal no matter what device or system you're using. What I am talking about here is whether the employer should get to listen in to all your calls and read all your emails and text messages. Why do you think they like BYOD so much? Because they can get a window into your personal life, what apps you have installed, etc.
- veave 3y ago
  It's a bit weird that even though they can communicate person-to-person, where records won't be kept, they are supposed to keep records of electronic communication.
  - joosters 3y ago
    Not really. How on earth could that ever be implemented?
    - loeg 3y ago
      In person conversations could be required to be recorded with a portable voice recording device (like a tape deck or phone). Same for phone calls. The regulatory authorities exempt those communications for now, but it isn't clear that there is any kind of consistent standard / reasoning.
  - polygamous_bat 3y ago
    Well, it's incredibly hard to scale fraud only through person-to-person communications. It's not impossible, but think about the scale that online communication would allow.
    - misja111 3y ago
      This has nothing to do with scaling. How do you picture that, some employee would broadcast sensitive information to a WhatsApp group, in order to reach as many others as possible at once? The offense here is that no effort was done to keep records of the communication. It would have been ok to use WhatsApp if they somehow would have archived all communications. Records of communications have to be kept so that auditors can verify that no inside trading secrets were communicated to others, for instance.
    - bonestamp2 3y ago
      Now I understand why some of the banks wanted people back in the office as soon as possible. Trying to support their commercial real estate bags is likely another.
- dundarious 3y ago
  Also, compliance teams want live or near-live access, and do run dynamic filters on that live content. I can’t imagine a non-criminal* compliance team accepting a solution that is T+1 or that depends on manual action from the employee. * I’m barely using hyperbole
ikue 3y ago
It is a record keeping issue from what they discussed and the same thing was said in an article at ComputerWorld. https://www.computerworld.com/article/3668574/banks-face-a-whatsapp-reckoning-as-regulators-clamp-down-on-messaging-apps.html https://www.computerworld.com/article/3668574/banks-face-a-w...
loeg 3y ago
So the law as written regards keeping records of inter-office memoranda, but the regulators have cheerfully expanded the scope of this to include essentially all communication by bank employees (except maybe phone calls).
- Sunspark 3y ago
  No, it includes calls now. Traditional calls over copper telephone lines are not recorded, but digital calls over MS Teams or whatever are recorded and kept for review. You still need a secondary device if you want to have a private conversation.
  - pasc1878 3y ago
    No for bank traders all phone calls are recorded and have been done since at least the 1990s
whycome 3y ago
We're in a time where these tools have replaced face to face conversations -- and those previous conversations never required record keeping.
ajross 3y ago
No, that's just what the outrageous clickbait headline[1] fooled you into thinking. The banks aren't being fined for using Signal or WhatsApp or any particular technology, they're being fined for failing to keep records of regulated communication they're required by law to present for auditing. Obviously if you use tools that don't keep records, you need to find a way to save it yourself. [1] Bad in the CNBC original, but actually truncated here on HN to remove the explanatory clause. The original reads "Banks hit with $549 million in fines for use of Signal, WhatsApp to evade regulators’ reach"

FirmwareBurner 3y ago

Ha, in Europe WhatsApp is even used by doctors and teachers to discuss patient/student matters, and even some government offices use it. It's wild how entrenched it is in every aspects of society, from social to business. Goes to show you how far good UX, simplicity and ease of use can take you.

bombolo 3y ago
Never heard of it. Perhaps not in the entire europe?
- FirmwareBurner 3y ago
  Can't speak for the entire Europe obviously, usage varies from country to country, but where I've been it's pretty well entrenched for bot social and business.
  - denton-scratch 3y ago
    WhatsApp is widely used by UK ministers to communicate with potential donors, lobbyists and other politicians. I don't know why it's allowed; in-person meetings are supposed to have a civil servant present and taking notes. WhatsApp gets them off the FOI hook.
    - brox 3y ago
      Case in point: The ongoing Covid-19 inquiry request for access to government WhatsApp messages: https://www.ft.com/content/208263bf-b6bb-4ea6-8e6b-ee2e522ac786 https://www.ft.com/content/208263bf-b6bb-4ea6-8e6b-ee2e522ac...
    - developer93 3y ago
      I thought it doesn't, the law just doesn't seem to be enforced properly?
    - caycep 3y ago
      is it feasible to have a reg where WhatsApp is allowed, as long as a copy of the transcript post-decryption goes to the national archives or whatnot?

segmondy 3y ago

So long as the fine is affordable, they will keep using it. Folks in the Finance industry using these apps are doing so for a reason.

joosters 3y ago
I think the record is pretty good for banks switching behaviour after being fined for a specific failing. They do know that if they get caught doing the exact same thing again, the punishment will be more costly. It's far cheaper (and more deniable) to find a slightly different way round the regulations, see if/when you get fined for that, then move on to something else again...
bennyelv 3y ago
In my experience it's simply down to convenience rather than malice. You have all your colleagues phone numbers, you know that a whatsapp is going to fire a notification that will get noticed whereas an email may not. Or that email will go to the "work phone" which isn't sitting on the sideboard somewhere rather than in the person's pocket. That said, there aren't any banks that don't have a comprehensive employee training program on security and compliance, so "I didn't realise" isn't going to be a valid excuse. That's not to say that there isn't any deliberately malicious use going on, but it's unlikely that malicious use would be uncovered.

qwerty456127 3y ago

No person on Earth (except a very reasonably suspected terrorist perhaps, because he could use that for an attack trigger) should be ever denied privacy. What if I worked at a bank and had to text something urgent to my dear? I would find it asolutely unacceptable for anybody to ever read that, no matter how innocent and banal our conversatioun would be. To me that would be equivalent to tapping into my brain and eavesdropping on my very thoughts.

richbell 3y ago
As per the article, the issue is that employees were using encrypted messaging apps for work purposes. This is strictly forbidden by regulations, or at least failing to preserve your communications is.
- qwerty456127 3y ago
  I see... This sounds reasonable for some environments. But I doubt the banks are going to differentiate these, they will probably just ban private messengers altogether.
  - 1MachineElf 3y ago
    As someone who currently performs information risk management for a financial institution, I'll say that private messaging doesn't need to be banned per-se. It's just that all company business is the responsibility of the leadership, so ultimately, business communications needed to be reserved for business communication platforms over which leadership can enforce policy. Privacy is a component of this. These banks needed processes and controls to ensure their requirements are being met: Records of electronic communication, technical security controls to ensure the privacy of protected communication, approved communication mediums/channels for different classifications of information, periodic reviews on the adequacy of these controls, etc. Sometimes the restriction of things like WhatsApp, Signal, etc. are seen as an affront to individual privacy. That's not what this is about. This is about preventing a lot of dangerous scenarios, like: 1. Employees at your bank do something evil that's also against the law, but because they used Signal/WhatsApp, no records of the communication can be used as evidence in court. 2. The bank has invested millions upon millions into an information security program. Someone decides to use Signal/WhatsApp to share sensitive account numbers. Signal/WhatsApp ends up with a vulnerability that exposes the information, rendering the InfoSec program protections ineffective. 3. Like #2, but the information in WhatsApp/Signal is super important. The employees who kept it there all leave and/or get into fatal accidents. How will that impact the bank? 4. Your manager starts a group chat for the team via text message and conversations about work occur. Turns out someone in the conversation is involved with a scandal. Because you talked about work stuff outside of the approved comms channels, your personal phone can now be taken and used as evidence in a court (even if they can't pull the encrypted messages from it!) It's just better for everyone to keep work communications in one place that the company has control over, and your personal device/apps totally separate from it.

jszymborski 3y ago

Sounds like this is less about Signal/WA and more about them not archiving methods. They could in theory run _e.g._ `sigtop` every couple of months and encrypt it (e.g. age or veracrypt). It's a complicated workflow but I imagine they have a pipeline for emails that isnt much less complicated, but also isnt E2EE.

developer93 3y ago
WhatsApp at least has the possibility to back up messages, maybe signal too.
- jszymborski 3y ago
  It's harder on Signal but there are tools to do it on desktop. https://github.com/tbvdm/sigtop https://github.com/tbvdm/sigtop

nickpinkston 3y ago

Cost of doing business - just a really expensive phone plan for collusion.

bratgpttamer 3y ago
"Think of it as an investment!"

enterthematrix 3y ago

This headline is clickbait. The issue is banks not preserving records, something that the rules are ABUNDANTLY clear on.

richbell 3y ago
The full headline is "...to evade regulators’ reach", which is much clearer.
- ikue 3y ago
  I had a problem with including the full headline because only so many characters could be used in the title of the post.
  - yorwba 3y ago
    Banks fined millions for using chat apps to evade regulators
  - richbell 3y ago
    That makes sense. The title character limit seems to be a cause of frequent confusion.
    - ikue 3y ago
      It does and the limit makes it come off as clickbait-y which I don't like.
      - WarOnPrivacy 3y ago
        Personally, I sympathize. Rewriting headlines here (when necessary) can be tough; it isn't a given that the optimal one will reveal itself.
  - psychphysic 3y ago
    You could have used "Banks fined millions evading regulation with Signal & WhatsApp" News headlines have rules they use to make for shorter sentences. They'd probably write "Banks fined millions, delete records, use E2E apps"

gmd63 3y ago

"We are pleased to resolve this matter" Nobody should ever be "pleased" with knowingly breaking the law. When will we ever get serious about law enforcement for this type of crime?

ot1138 3y ago
It's not a law. It's a regulation. There is a difference.
OO000oo 3y ago
> When will we ever get serious about law enforcement for this type of crime? No sooner than the day we abolish the profit motive.
dahfizz 3y ago
Using WhatApp is not a "crime". There were no laws broken. This is just some regulators giving out fines because they can't spy on employee's private messages. If bureaucrats were on my ass about something so stupid, I would be very pleased once the matter was resolved.
- deleted 3y ago
  [deleted]
- gmd63 3y ago
  It's a rule that upon being broken allows the SEC to fine you, which is why they are paying a bunch of money. Are you saying that we should not be able to require banks of a certain size to keep records, so that the highway patrol officers of finance can economically pull you over when you're speeding? Or should we allow everyone to use fuzzbusters effectively making the law pointless?
  - dahfizz 3y ago
    > Are you saying that we should not be able to require banks of a certain size to keep records No. I'm saying this is just some boring, annoying regulation, and your grandstanding about wanting people to feel bad about breaking laws is misguided.

Traubenfuchs 3y ago

What‘s the solution for the banks here? Officially prohibiting those messenger apps but off-the-record recommending them on private phones to dodge regulators?

pasc1878 3y ago
No the traders would have to use approved messing apps. The banks don"t like not knowing as it is easiest to defraud the company you are working for.

imwillofficial 3y ago

Yeah I’m sure it was all totally innocent /s

Vicinity9635 3y ago

>$549 million Big headline grabbing number. But what % of their quarterly profit is that? Slap on the wrist, I suspect.

mulmen 3y ago
Net income for Q2 of 2023 was reported as (this is Wells Fargo...) $4,938,000,000 so $549,000,000 is a little over 10%. https://www08.wellsfargomedia.com/assets/pdf/about/investor-relations/earnings/second-quarter-2023-earnings.pdf https://www08.wellsfargomedia.com/assets/pdf/about/investor-...

dreamcompiler 3y ago

At this point I cannot understand why anybody would use Wells Fargo as their bank. WF has proven repeatedly that they are pretty much the opposite of what everybody thinks a good bank should be. Repeated law violations; repeated screwing-over of their customers. Why are they still in business?

jermaustin1 3y ago
As a WF customer... its lock-in. The amount of work I would need to do to switch banks thanks to bill pay, auto-drafts, etc, is not worth the headache.
- clairity 3y ago
  now that physical branches are not really a differentiator of big banks, a couple hours of your time spread out over a couple months is totally worth the switch to a credit union in lower fees, better service, and supporting a more local economy. it's completely, undeniably worth it. unless you're a real big shot (worth millions in assets to the bank) who doesn't have to deal with the dehumanizing aspects of corporate "customer service", there is zero reason to be with anything other than a small local bank/credit union.
  - donatj 3y ago
    FWIW the handful of times I've dealt with WF customer service they've been helpful and friendly solving my problems easily. My credit union on the other hand could not understand why I wouldn't give them my card number over the phone whenthey called me.
    - dieselgate 3y ago
      I don’t think the issue is their customer service not being helpful it’s just that the bank is so predatory. Things like high fees ($10/month) for checking accounts being below a threshold or opening up bogus accounts for people.
- 3y ago

ReptileMan 3y ago

How can they prove that business was discussed if records are not preserved

mulmen 3y ago
RE: Loan application Mr. Smith, please review the updated terms on WhatsApp.
- ReptileMan 3y ago
  We are talking about inter company communication. No one on wall street should be that stupid to mention something like this in email
  - deleted 3y ago
    [deleted]
bratgpttamer 3y ago
Presumably the same way my math teacher marked answers wrong when I didn't show my work.

kolbe 3y ago

All the government needs to do to get HN on board with criminalizing encrypted communications is to implicate a bank. Bear in-mind, the SEC didn't find any actual criminal activity here. The banks just failed to retain the conversations that took place by their employees via encrypted channels (a necessary feature of encrypted communication).

psychlops 3y ago
It's up to the reader to speculate how much criminal activity took place in the conversations they failed to retain. I, for one, am certain it was all just brokers gabbing about American Idol.
- kolbe 3y ago
  You realize these are just people, right? People who work at banks are people like you and me. They can use iMessage to talk about whatever they want. Should we assume every single Google employee talking to another person in tech using iMessage was talking about how to subvert democracy or dark patterning a new scam? Or are they talking about what time dinner is, who's picking up the kids today, look at this meme, etc...

jgalt212 3y ago

Dumb question: If these apps offer end-to-end encryption, how is anyone getting caught?

lbwtaylor 3y ago
Lots of ways: - A banker answers honestly when interviewed by the regulator because they decide it's better for the Bank to take the fine than lie to regulator and risk personal criminal charges (unlikely, but why take that risk?). - Regulator asks for evidence of some documentation (like trade confirmation), compliance asks banker, banker doesn't have it and admits it was over this app. - Whistleblower or other source makes regulator believe there are prohibited communication and regulator demands phones be turned over. - Other similar banks are caught in violation, and regulator does sweep of similar banks and demands phones be turned over. The regulator has the ability to shut down the bank. The bank can easily tell the banker to turn over an unlocked phone or face legal action. The banker then turns over the phone.
- jgalt212 3y ago
  I'd delete all my messages before doing any of that. I'm not one for deceiving the regulators, but for lack of a better term when it comes to compliance, they cannot handle the truth.
  - lbwtaylor 3y ago
    For what it's worth, that's a path towards obstruction charges.

skrowl 3y ago

[dead]

1MachineElf 3y ago

Reposting my comment here: https://news.ycombinator.com/item?id=37050595 https://news.ycombinator.com/item?id=37050595 As someone who currently performs information risk management for a financial institution, I'll say that private messaging doesn't need to be banned per-se. It's just that all company business is the responsibility of the leadership, so ultimately, business communications needed to be reserved for business communication platforms over which leadership can enforce policy. Privacy is a component of this. These banks needed processes and controls to ensure their requirements are being met: Records of electronic communication, technical security controls to ensure the privacy of protected communication, approved communication mediums/channels for different classifications of information, periodic reviews on the adequacy of these controls, etc. Sometimes the restriction of things like WhatsApp, Signal, etc. are seen as an affront to individual privacy. That's not what this is about. This is about preventing a lot of dangerous scenarios, like: 1. Employees at your bank do something evil that's also against the law, but because they used Signal/WhatsApp, no records of the communication can be used as evidence in court. 2. The bank has invested millions upon millions into an information security program. Someone decides to use Signal/WhatsApp to share sensitive account numbers. Signal/WhatsApp ends up with a vulnerability that exposes the information, rendering the InfoSec program protections ineffective. 3. Like #2, but the information in WhatsApp/Signal is super important. The employees who kept it there all leave and/or get into fatal accidents. How will that impact the bank? 4. Your manager starts a group chat for the team via text message and conversations about work occur. Turns out someone in the conversation is involved with a scandal. Because you talked about work stuff outside of the approved comms channels, your personal phone can now be taken and used as evidence in a court (even if they can't pull the encrypted messages from it!) It's just better for everyone to keep work communications in one place that the company has control over, and your personal device/apps totally separate from it.

donatj 3y ago

The whole record keeping requirement for written correspondence generally seems completely unreasonable. Presumably telephone calls, zoom calls and in person meetings aren't recorded? Why should that be different if it's written?

DANmode 3y ago
> Presumably telephone calls, zoom calls and in person meetings aren't recorded? Of course they are. No offense: Where have you been?
- betaby 3y ago
  Since when they are all recorded? It definitely wasn't the case ~15 years ago.
  - DANmode 3y ago
    Way too much storage sitting in Utah for the conversations to not be kept for at least some time. Obviously I can't show you.
- donatj 3y ago
  > Where have you been? Working in education the last 10 years. I mean all of that seems really unreasonable if that's the case. Where I work they took my work phone away because I wasn't using it enough. Now if I need to make a call, it's just with my cell phone. No way that's being recorded. > in person meetings Presume you don't sit down at the table and set up mics before you start talking?
hsjqllzlfkf 3y ago
> Presumably telephone calls, zoom calls and in person meetings aren't recorded? Why do you presume that? Where I work every call is recorded.
- betaby 3y ago
  How much data is that? Where it's stored? How's that achieved for the company provided IPhones?

omgJustTest 3y ago

> Wells Fargo, the fourth-biggest U.S. bank by assets and a relatively small player on Wall Street, racked up the most fines on Tuesday, with $200 million in penalties. > “We are pleased to resolve this matter,” said Wells Fargo spokeswoman Laurie Kight. Unfortunate, penalty appears not big enough. As another key responsibility, these individuals are forbidden from insider trading... which if they are not keeping records is basically not possible to police.

bartchamdo 3y ago

This won’t be fixed until bank executives are jailed. Otherwise they make more money than they are fined, so what is the incentive to stop?

balderdash 3y ago
or the fines are actually levied against the offending parties and leadership as opposed to sticking it to the shareholders
jcims 3y ago
I work at a bank. I could send some bullshit MNPI to a coworker via whatsapp and get my boss fired? Sweet!
- DANmode 3y ago
  Burden of proof should (and often does) require: Intent, pattern of doing business this way.
- bratgpttamer 3y ago
  "work at a bank" != "banking executives" "some bullshit MNPI to a coworker" != billion-dollar collusion/schemes "fired" != "jailed" I'm afraid I'll never understand this class of refutation that categorically misunderstands every component of a sentence.

balderdash 3y ago

If anyone is a glutton for punishment there are overlapping records requirements, but this is the one that is the one that is probably most relevant to those in the securities industry https://www.finra.org/rules-guidance/key-topics/books-records#electronic-communications https://www.finra.org/rules-guidance/key-topics/books-record... "Firms may not permit the use of any type of electronic communication if they are unable to satisfy the applicable recordkeeping requirements with respect to that particular type of electronic communication."

MengerSponge 3y ago

Wells Fargo gross profit for the twelve months ending June 30, 2023 was $80.279B. Billion, with a B. A $0.5B fine is both a lot and nowhere near enough. I imagine a smaller fine would be a more effective deterrent if it was directed at the C-suite instead of the whole corporation. Maybe a little jail time too, as a treat.

in3d 3y ago
Wrong. That’s revenue, not profit.

BaseballPhysics 3y ago

To the surprise of no one, Matt Levine has written about this a few times (there's some other linked issues in here as well): https://www.bloomberg.com/opinion/articles/2023-08-08/don-t-do-deals-on-linkedin https://www.bloomberg.com/opinion/articles/2023-08-08/don-t-... His is a pretty balanced take and raises some interesting points: > I have argued that the SEC has aggressively expanded the recordkeeping requirements. In the olden days, almost all communication was informal and not recorded, and only formal decisions were memorialized in typed and carbon-papered memos, so the SEC had access only to a pretty limited slice of communications. Now, vastly more informal communication is text-based, and texting is a substitute for conversation, not for formal memos. The rest of the piece and some of his related commentary in the area is worth a read.

mvdtnz 3y ago
I don't see a downside to expanding the record keeping requirements. Record keeping is easier than ever and frankly banks haven't proven themselves worthy of our trust. Sounds great to me.
- lotsofpulp 3y ago
  I assume being able to have face to face off the record conversations providing plausible deniability to participants is one of the big reasons finance and other related businesses like to be in Manhattan.
  - Terr_ 3y ago
    Perhaps also a factor in why some managers prefer to manage employees in-person rather than remotely. When it comes to avoiding the record, it doesn't have to be lofty corrupt/ish deals or schemes, but also cases like certain anti-union threats, or even plain personal power-tripping.
    - red-iron-pine 3y ago
      definitely a factor. e.g. the C-level one-liner email that consists of "lets have a chat about this" doesn't even have to be anything malicious, such as not wanting to socialize an idea until it's fully-baked or hiring for a new VP role

monkeywork 3y ago

Work in the sector and once the investigations / fines came out massive notifications went out across the board reminding everyone not to use unapproved comms. Was this used for nefarious purposes - possibly - but more likely it was general communications between team members using a platform that is more comfortable to them than either 1st party tools or something approved like teams. 99.9% of this was likely reminders for meetings, attendance and coverage messages, a message to a team member who timezone shifted from you and may be off any you need an answer etc. I'd guess most people involved didn't even consider the record keeping because their day to day jobs don't involve actual trading info, and the "encryption" of those services likely made them feel a more comfortable than they should. Not trying to excuse the behavior - yes the record keeping is important - but I think it's also important to realize this was likely largely innocent.

alx__ 3y ago
This is a pretty weak excuse. It's not hard to keep your work comms in the approved software. I would tell people to fuck off if they wanted to invade my personal device with work chatter. Boundaries are good
- monkeywork 3y ago
  great - however you are one person, the large banks involved here have staff of a few hundred thousand each across several countries and with various backgrounds and norms, many who are also friends and have contact with each other outside of office hours. I agree, one needs to keep work comms on approved software, I'm simply stating that while it's fun to be like "oohh big bad bank was hiding secret convos" it was more likely "janet i'm out today can you take the meeting with svp of <insert corp>" Put another way context matters in terms of how the public should react to the news, not so much the result (fines) or the regulations / requirements.
  - alx__ 3y ago
    Literally the only reason to use Signal is to talk about unionizing, drugs, or shady biz deals. Texting your coworker, would the usual path, not some secondary software that requires both people to set up ahead of time.

freeboty 3y ago

[dead]

juliangmp 3y ago

Just a few millions? Doubt they'll even notice

voytec 3y ago

Jail time is a penalty that can't be transferred over to customers.

JustLurking2022 3y ago

Worked in an investment bank, although not in a client facing role, and it's not quite as simple as it seems - if your client reaches out with a question via text or WhatsApp, technically you should redirect them to use your bank's secure messaging app of choice. The problem is no one has ever heard of Symphony, doesn't want to install it so they can ask a simple question, and the user experience is meh at best. If you do the right thing, clients would likely perceive you as difficult to work with and perhaps go elsewhere. To done extent, the inevitable fines might be seen as a necessary cost of doing business. So a pretty severe crackdown was necessary to ensure everyone is properly incentivized to inflict this pain upon clients.

bratgpttamer 3y ago

Okay, hear me out: force banks to adopt blockchain, but just for their DMs.