151–160 of 247 posts
Earlier quoted context omitted.
... and the records couldn't be preserved if the employees are using Signal and WhatsApp?
Correct. Neither Signal nor WhatsApp is integrated into any corporate messaging system, so the communication flowing through those apps, is neither archived nor discoverable.
As someone who currently performs information risk management for a financial institution, I'll say that private messaging doesn't need to be banned per-se. It's just that all company business is the responsibility of the leadership, so ultimately, business communications needed to be reserved for business communication platforms over which leadership can enforce policy. Privacy is a component of this. These banks needed processes and controls to ensure their requirements are being met: Records of electronic communication, technical security controls to ensure the privacy of protected communication, approved communication mediums/channels for different classifications of information, periodic reviews on the adequacy of these controls, etc.
Sometimes the restriction of things like WhatsApp, Signal, etc. are seen as an affront to individual privacy. That's not what this is about. This is about preventing a lot of dangerous scenarios, like:
1. Employees at your bank do something evil that's also against the law, but because they used Signal/WhatsApp, no records of the communication can be used as evidence in court.
2. The bank has invested millions upon millions into an information security program. Someone decides to use Signal/WhatsApp to share sensitive account numbers. Signal/WhatsApp ends up with a vulnerability that exposes the information, rendering the InfoSec program protections ineffective.
3. Like #2, but the information in WhatsApp/Signal is super important. The employees who kept it there all leave and/or get into fatal accidents. How will that impact the bank?
4. Your manager starts a group chat for the team via text message and conversations about work occur. Turns out someone in the conversation is involved with a scandal. Because you talked about work stuff outside of the approved comms channels, your personal phone can now be taken and used as evidence in a court (even if they can't pull the encrypted messages from it!)
It's just better for everyone to keep work communications in one place that the company has control over, and your personal device/apps totally separate from it.
Earlier quoted context omitted.
Well, banks need this to prove their are not fixing price rates (e.g. as the Libor Scandal about 10y ago), and that they did their part in KYC and prevention of AML for the client, or that they not miss-sold a product in case of a legal procedure or claim. So everything is recorded, encrypted, some is monitored in near RT by engines, and only accessed by human employees when necessary. A full log of who accessed what…
> This falls under Fair Use (not sure about the exact term) under GDPR, as is a sensible way for the bank to uphold their legal obligations. The term you're likely looking for is "Legitimate Interest", but that's not quite the same. You're looking for the bigger picture. Full disclosure: I was the DPO of a gambling company and had to interpret the cross-regulation conflicts quite routinely. One of the big things with…
Ha, in Europe WhatsApp is even used by doctors and teachers to discuss patient/student matters, and even some government offices use it. It's wild how entrenched it is in every aspects of society, from social to business. Goes to show you how far good UX, simplicity and ease of use can take you.
Earlier quoted context omitted.
> Are you saying that we should not be able to require banks of a certain size to keep records No. I'm saying this is just some boring, annoying regulation, and your grandstanding about wanting people to feel bad about breaking laws is misguided.
No it isn't, the regulation is extremely important and helps keep the financial system following the law. The stakes are extremely high and monitoring records is the bare minimum we should be doing to protect ourselves from criminal financial actors. Every rule is written in blood. We recently saw guys fixing the LIBOR for a tray of leftover sushi. Thankfully we have records of that.
Not really. This rule was written when the only form of written communication was paper mail and office memos.
It wasn't written with instant messaging in mind.
Dumb question: If these apps offer end-to-end encryption, how is anyone getting caught?
Lots of ways: - A banker answers honestly when interviewed by the regulator because they decide it's better for the Bank to take the fine than lie to regulator and risk personal criminal charges (unlikely, but why take that risk?). - Regulator asks for evidence of some documentation (like trade confirmation), compliance asks banker, banker doesn't have it and admits it was over this app. - Whistleblower or other sour…
Earlier quoted context omitted.
As a WF customer... its lock-in. The amount of work I would need to do to switch banks thanks to bill pay, auto-drafts, etc, is not worth the headache.
now that physical branches are not really a differentiator of big banks, a couple hours of your time spread out over a couple months is totally worth the switch to a credit union in lower fees, better service, and supporting a more local economy. it's completely, undeniably worth it. unless you're a real big shot (worth millions in assets to the bank) who doesn't have to deal with the dehumanizing aspects of corporat…
My credit union on the other hand could not understand why I wouldn't give them my card number over the phone whenthey called me.
Why should that be different if it's written?
The whole record keeping requirement for written correspondence generally seems completely unreasonable. Presumably telephone calls, zoom calls and in person meetings aren't recorded? Why should that be different if it's written?
Of course they are.
No offense: Where have you been?
Earlier quoted context omitted.
You could have used "Banks fined millions evading regulation with Signal & WhatsApp" News headlines have rules they use to make for shorter sentences. They'd probably write "Banks fined millions, delete records, use E2E apps"
Here's a link to the actual press release: https://www.sec.gov/news/press-release/2023-149 It makes no mention of evading regulation. This fine is for a failure to retain written communications. Which is impossible to do for some of these communications channels.
Nobody working in banking is unaware of the written comms rules. Nobody using Signal or WhatsApp in that context is unaware they can't retain written comms. Can you prove intent? Probably not. Is it clear as daylight why this happened? Uh, yes.
And so the SEC hits them where it hurts at least a little bit, in the wallet.
Also, if you pay attention to the banking space... this is pretty much the usual cast of characters. There's absolutely no surprise.