How a UK brokerage archives client WhatsApp conversations under SYSC 9 and ICOBS, sets a retention policy, handles personal devices and exports evidence for the FOS.
The question is never "do we use WhatsApp" — most UK brokerages already do. The question arrives as an email from the Financial Ombudsman Service asking for the business file on a complaint, and the file has a hole where a conversation took place on a handler's phone eighteen months ago. This article deals with that hole: what the Handbook requires, how to set a retention policy that covers messaging, what to do about personal devices, and how to produce an export that an adjudicator can actually use.
SYSC 9.1.1R is short: a firm must arrange for orderly records to be kept of its business and internal organisation, including all services and transactions, sufficient to enable the FCA to monitor compliance and to ascertain that the firm has complied with its obligations to clients. For investment firms the chapter adds fixed minimum periods and a rule that records be held in a medium that allows future reference and prevents alteration. General insurance intermediaries are outside those specific rules, but the same expectations are the sensible benchmark, because "orderly" and "sufficient to ascertain compliance" cannot be met by a chat that only one employee can see.
ICOBS then adds content-specific records: what was disclosed about the firm's status and remuneration, the demands and needs statement, what was sent at renewal and when, cancellation rights. If any of those things were discussed or delivered on WhatsApp, the thread is part of the record the rule refers to. The Consumer Duty reinforces this from the other side: a firm must be able to evidence that its communications supported understanding, which it cannot do for messages it cannot retrieve.
The fix is structural rather than disciplinary: one WhatsApp Business number per firm or office on Meta's official platform, all staff replying from a shared inbox, and a written rule that client conversations do not take place on personal numbers. Firms that have done the first two steps find the third enforces itself, because the shared inbox is where the context is. The organisational side is covered in our article on the shared inbox under Consumer Duty; this one is about what happens to the messages afterwards.
Most brokerages have a retention policy written for paper and email. Extend it rather than rewrite it. The table below is a working structure, with periods to be set by the compliance function against the Handbook and the Limitation Act rather than adopted as given:
| Record | Where it lives | Indicative retention | Basis to check |
|---|---|---|---|
| Client conversations on WhatsApp (service, renewal, claims) | Firm archive exported from the messaging platform | Same as the client file, commonly six years after the relationship ends | SYSC 9, ICOBS, limitation periods |
| Complaint correspondence, including WhatsApp messages relating to the complaint | Complaints file | At least three years from receipt of the complaint | DISP 1.9 |
| Consent and opt-out records for WhatsApp contact | Customer record | For as long as the firm relies on them, plus a period to defend claims | UK GDPR, PECR |
| Marketing campaigns and templates sent | Campaign log | Aligned with consent records | PECR, Consumer Duty |
| Access and audit logs (who read or sent what) | Platform audit log | Aligned with the conversation archive | SYSC 9, UK GDPR accountability |
Two details matter more than the numbers. First, retention must be enforced at the archive, not on the phone: messages deleted from a handset must still exist in the firm's copy. Second, the policy should state that the firm can export a complete conversation with timestamps and author within a set number of working days, and someone should test that export once a year.
When a complaint is referred, the Financial Ombudsman Service asks the firm for its file and its view. The complaint rules in DISP give the firm eight weeks to issue a final response, after which the customer generally has six months to refer the matter to the ombudsman. Since 2019 the FOS has also handled complaints from small businesses, so commercial brokers are not exempt. An adjudicator looks for what the client was told, when, and whether it was clear. A WhatsApp export that helps looks like this:
In ORIS every WhatsApp message is stored against the customer with its status, and the audit logs under the Compliance settings record staff actions. Conversations are viewable per customer in the shared inbox; for a complaint file, the firm assembles the export from the platform's data alongside its own documents, since ORIS does not integrate with broker management or complaints systems beyond CSV export. What the platform guarantees is the part that personal phones cannot: the thread exists, it is complete and it is attributable.
More on the regulatory side for other markets is collected under compliance and regulation.
No. SYSC 9.1.1R requires orderly and sufficient records without a fixed period for non-investment firms. Firms set their own periods in a retention policy, typically aligned with the client file and with limitation periods for claims, and apply them consistently to messaging.
They can be submitted, but an adjudicator can weigh them less than a complete, timestamped export from a firm-controlled account. Partial screenshots that omit context invite the argument that something else was said.
Where the client relationship is live, ask the employee to export the thread to the firm and move the client to the firm number. Document the transfer. For departed employees the record is usually lost, which is the reason to act now.
No. The FOS asks the firm for its file and the customer for theirs. The firm decides what it supplies, and a complete export with a clear covering note is in its interest.
The Handbook does not set a number of days for this, but the firm's own policy should, and the FOS's timetable for evidence is short. A few working days from request to complete export is a reasonable internal standard.
Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.
A marketing message sent to a segment of your book is a financial promotion. What ICOBS 2.2, the Consumer Duty and FG24/1 require inside a WhatsApp message.
PROD 4 makes your commission part of what the customer pays. What a small UK brokerage has to assess, review and be able to show — and where the proof sits.
IHK registration under §34d GewO, VVG advice and documentation duties, GDPR consent: what a German brokerage should settle before using WhatsApp.
