A resignation takes hundreds of client threads out of the building. What FAIS, POPIA and Meta actually allow you to recover, and the handover to run.
It usually happens on a Friday. A senior adviser hands in her notice, works out her month, and walks out with a phone in her pocket. On that handset sit eight hundred WhatsApp threads: renewal negotiations, claim updates, photographs of a damaged bakkie, ID copies, a medical questionnaire, and eleven years of small talk with a client the brokerage cannot afford to lose. None of it exists on any system the principal can open.
The commercial damage is obvious enough. The regulatory damage is quieter and often worse, because three separate regimes fire at the same moment: the FAIS rules on your register of representatives and on debarment, POPIA's rules about personal information sitting on a device you no longer control, and Meta's own rules on what can and cannot be moved between WhatsApp accounts. A resignation is the cleanest test there is of whether a brokerage runs a WhatsApp channel or merely tolerates one.
Principals tend to treat this as one problem. It is three, and each has a different fix — or no fix at all.
| What leaves | Who actually controls it | What you can still do |
|---|---|---|
| The phone number | Whoever the SIM is registered to at the network. A personal MSISDN is the adviser's, permanently. | Nothing, if it is hers. If it is a company SIM, retrieve the physical SIM before the last day — re-registering a number requires passing a verification code sent to it. |
| The conversation history | The handset, plus whatever personal cloud backup she switched on. Not a company server. | Export individual chats before departure, or accept the loss. There is no administrative recovery route after the fact. |
| The client relationship | The client, who will keep messaging the number they know. | Reach every affected client from the brokerage number with a named replacement, quickly, before a competitor does it for you. |
The history point catches most people out, and it is worth being precise about it. WhatsApp Business app conversations live in local storage on the device. Meta's own documentation for moving a number onto the Cloud API is blunt about the consequence: delete the number from the WhatsApp Business app and register it for the API, and the existing messaging history is lost — unless onboarding runs through a partner that supports business app number onboarding. What migration does preserve is the display name, the quality rating and the messaging limits. Not a single message. This is the strongest practical argument for the brokerage number rather than the personal one, and it is an argument that only becomes visible on the day somebody resigns.
Section 13 of the FAIS Act requires an authorised FSP to maintain a register of its representatives and key individuals and to keep it current. Changes to the data in that register must reach the FSCA within 15 days. A representative who leaves on the 31st is not a next-quarter administrative tidy-up; she is a register update with a deadline, and rep register accuracy is a routine item on an FSCA on-site visit.
Departures that are not amicable raise a second question. Section 14 obliges an FSP to debar a person who has materially contravened the Act or no longer meets the fit and proper requirements — and that obligation survives the resignation, provided the reason arose and became known to you while the person was still your representative. You cannot debar for something you only discovered afterwards, and you cannot start proceedings more than six months after the person ceased to be your representative. Section 14(3) also fixes the process: written notice of the intention to debar with grounds and reasons, a copy of your written debarment policy, and a reasonable opportunity to respond. Once debarred, the FSCA must be told, with the grounds and reasons following within the prescribed period. Firms lose debarments at the Financial Services Tribunal on process far more often than on facts.
If the departing person was supervising anyone, there is a third thread. Under the FSCA's supervision requirements, a representative working under supervision must have a written supervision agreement naming the supervisor. When the supervisor resigns, that agreement stops describing reality on day one, and the supervisee's competence status depends on it.
Every one of those threads is personal information, and a good number of them contain special personal information — health details on a medical questionnaire, ID numbers, financial information. Under POPIA, the brokerage is the responsible party. Section 19 requires appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of that information and to prevent unlawful access or processing. A former employee retaining a full copy of your client book on a personal device, indefinitely, after the employment relationship has ended, is difficult to describe as a reasonable organisational measure.
Where a departing adviser walks off with client data and uses it — at a competitor, or on her own account — you are not merely commercially aggrieved. You may be looking at unauthorised access to personal information, with the notification duties to the Information Regulator and to affected data subjects that follow. The Regulator's interest is in what you had in place beforehand, not in how sincerely you objected afterwards. And if you use an outside platform to run the channel, sections 20 and 21 require a written contract with that operator obliging it to maintain section 19 security measures and to tell you immediately if it has grounds to believe personal information has been accessed by an unauthorised person.
None of this needs a large project. It needs a sequence somebody owns, ideally written down before you need it.
The structural fix is unglamorous: client conversations belong to the brokerage, on a brokerage number, in a shared inbox that more than one person can open. That is also what the FAIS record-keeping obligation quietly assumes — records you must produce for five years cannot live on equipment you do not own.
This is the case ORIS is built around. Conversations sit against the customer record in Customers & Segments, next to the risk score, the engagement score and whatever opportunities the thread produced, so a replacement adviser opens a history rather than an introduction. Audit logs record who did what. The book exports to CSV when compliance or a new system needs it. What no platform can do is transfer the relationship: the departing adviser still holds it, and she will call. What a platform can do is make sure the conversation you inherit starts from a record instead of a guess — which, across a book the size of a typical South African brokerage, is the difference between a bad month and a lost year.
Only through the employment relationship, and only while it lasts. If the number and device are hers, you have no technical route in and no administrative one either. What you can do is make the export of client-related threads an express term of the employment contract and part of the exit checklist, so the request is contractual rather than a favour asked on the last afternoon.
Not automatically. POPIA does not ban processing on a personal device; section 19 requires appropriate, reasonable technical and organisational measures. A device with a screen lock, used under a written policy, with a defined process for removing the data when employment ends, can meet that. An unmanaged handset with no policy, retained indefinitely after departure, is much harder to defend if the Regulator ever asks.
Generally no. Meta's documentation states that deleting a number from the WhatsApp Business app and registering it for the Cloud API loses the existing messaging history, unless you onboard through a partner supporting business app number onboarding. Display name, quality rating and messaging limits carry over; conversations do not. Export anything you need first.
The obligation can survive the resignation, but only where the reason for the debarment arose and became known to you while the person was still your representative, and proceedings must be commenced within six months of them ceasing to be one. The section 14(3) steps — written notice with grounds and reasons, a copy of your debarment policy, a real opportunity to respond — apply exactly as they would to a current representative.
Changes to the data in your register of representatives must reach the FSCA within 15 days. Treat it as a fixed step on the exit checklist rather than something the compliance officer catches at quarter-end; register accuracy is a standard line of enquiry on an FSCA on-site visit, and a stale entry suggests the rest of the file is stale too.
Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.
Schedule 1 of the FIC Act was rewritten in 2022. Work out whether your brokerage is an accountable institution, and the duties that bind you either way.
What the FAIS CPD cycle asks of a small South African brokerage: six, twelve or eighteen hours, what actually counts, and the competence register deadline.
Commission is capped at 12,5% on motor and 20% elsewhere. When a South African brokerage may charge a fee on top, how to agree it, and what to keep on file.
