Compliant messaging with SMS & WhatsApp for financial services

TCPA (USA)

The primary purpose of the TCPA is to prevent consumers from receiving unwanted text messages and is enforced by the FCC. Under the TCPA, people can file lawsuits against companies who are not compliant

Compliance guidelines include:

Obtain consent:

• Businesses cannot call or send messages to consumers without their consent. Companies must obtain explicit written permission from consumers before calling or sending any messages

Provide disclosure:

• Once consumers opt-in to receive messages, businesses must disclose the full scope of their SMS communications and also provide a way for consumers to opt-out

FINRA (USA)

FINRA is concerned with protecting investors against unethical business practices and making sure that financial advisors work on their behalf. The SEC oversees FINRA.

Compliance guidelines include:

Keep records:
Firms must be able to prove they have completely preserved and supervised all business-related communications, particularly:

• Recommendations and advice
• Receipt and delivery of funds
• Purchasing or selling securities
• The performance of a managed account or securities recommendation

Prevent misuse:

Employees must not be able to:

• Send messages anonymously
• Use apps that destroy messages automatically
• Block third-party supervision

Follow up:

• Firms must prove they have conducted due diligence and follow up on potential violations of securities laws and FINRA rules

GDPR (EU)

The GDPR includes regulations meant to protect consumer privacy

Compliance guidelines include:

Privacy by design

• Only relevant and agreed upon data should be collected

Explicit consent

• You must be informed about what data is collected in a policy statement
• You must be able to opt-in or out of the policy
• You must be notified of changes to the policy

Access rights

• You must be able to retrieve the data collected on you if requested

MIFID II (UK)

The FCA is concerned with making sure that laws protecting investors. The FCA oversees MiFID II regulations

Compliance guidelines include:

Keep Records:

• Any conversation- voice call, text, messaging, email- that results in a financial transaction
• Must be retained for 5 years
• Must be controlled to prevent tampering (alteration or deletion)
• Properly surveil and do due diligence to ensure compliance with FCA COBS 11.8 rules

Singapore MAS (CN)

The Monetary Authority of Singapore (MAS) and the SGX oversee mobile phone recording requirements.

Compliance guidelines include:

Keep Records:

• Any communication- voice call, text, messaging, email- about orders or trades, regardless if they result in a transaction
• Must be retained for 5 years
• Must be controlled to prevent tampering (alteration or deletion)
• Must be kept confidential
• All communication should be retained for at least 2 months

Explicit consent:

• Clients must be informed that the communication is recorded

Client Identification rule:

• Firms must provide the identities of ultimate beneficial owners (UBOs) to MAS or law enforcement if requested

Critical features to look for in a compliant messaging application for financial services

Privacy by Design

Meeting compliance requirements for data security, e-discovery, and industry standards for SMS and WhatsApp without endangering employee privacy becomes complicated in the mobile environment, especially with the preference for using personal devices for work purposes (BYOD).

• Get an application that keeps the business and personal data completely separate
• Employees don’t have to risk exposing or implicating their personal data when they opt-in to use the phone for work
• Employees can easily distinguish between business and personal calls at the Caller ID screen
• Employees can set up a separate voicemail for receiving business calls; letting them freely express themselves in their personal voicemail

Opt-in/Opt-out

It’s critical to capture and respect client consent for SMS and WhatsApp by sending an initial message letting the client know who wants to message them, the type of messages to expect, and how to stop messages if they’re not desired

• Get an application that handles Opt-In and Opt-Out messages
• Crafting a good Opt-In message is important for increasing Opt-In rates, craft your opt-in messages and adapt them to what’s working for your business
• Capture and archive the results of Opt-In and Opt-Out in the management portal where administrators can easily search and retrieve them
• Identify which users in your organization require Opt-In/Opt-Out and set it up for that group; it will be automatically taken care of whenever your employee messages a new contact and require no action on their part

Message capture and archive

You need a recording solution for SMS and WhatApp that is secure, cost-effective, easy to implement and scale, and easily integrates with your compliance archive

• Get an application that securely and completely captures ALL messages, regardless of connection type
• Identify which users in your organization require message capturing and archive and set it up for that group; it will be automatically taken care of whenever your employee messages with their contacts and requires no action on their part
• Managing recording at the organizational level also prevents employees from selectively turning recording on and off, which could lead to a breach of compliance
• Get an application that monitors access and can prove the data has been unaltered by employees, administrators, and third parties as they traverse the platform per FINRA and MIFID II
  
• Messages should be securely and easily transferred to your compliance archive

Nice-to-have features to look for in a compliant messaging application for financial services

Lexicon alerts

It’s helpful to set up a dictionary of terms that will be redacted or blocked, such as profanity, abusive language, or sensitive information such as credit card numbers and social security numbers. Find an application that prevents breaches of your communication policy by identifying text and patterns of text for whether they arise from clients to employees or employees to clients.

Support for mobile and desktop

Look for a solution that grants the convenience of mobile messaging to clients, and the ergonomics of the desktop to your frontline, helping improve the user experience while increasing overall productivity.

CRM Integration

CRM systems, such as Salesforce or NextJ, provide a suite of tools that help track and store client information; being able to integrate your compliant messaging application means less manual entry and more productivity.

Quick Text Templates
Surprise and delight your users with a solution that can automate client outreach with automated texts that frequently used on a daily basis.

Example 1:

Example 2:

Enterprise Mobility Management (EMM) Integration

EMM systems such as Microsoft Intune or BlackBerry UEM provide a suite of security and application management tools that protect business data across corporate applications, such as browsers, email, calendar, and office applications; being able to deploy your compliant messaging application the same way keeps things simple for IT.

For more use cases check out A Leader’s Guide to Client Acquisition and Retention with Compliant Mobile Messaging.