FAIS record-keeping: how long and how to archive WhatsApp conversations

Contents

1. What the General Code of Conduct actually requires
2. Why phones, chat exports and screenshots fail the test
3. An archiving policy in five decisions
4. When the record is tested: FSCA requests and FAIS Ombud complaints
5. Frequently asked questions

Every FAIS compliance officer knows the five-year rule for advice records. Fewer have asked what it means when the advice was given in a WhatsApp thread on a representative's phone, the representative has since left, and the FAIS Ombud has just written to ask for the record of the interaction. This article takes the record-keeping duty in the General Code of Conduct and applies it to WhatsApp, conversation by conversation, so that a brokerage can answer an FSCA request within the time it has.

What the General Code of Conduct actually requires

Section 3(2) of the General Code of Conduct for Authorised Financial Services Providers and Representatives, made under the FAIS Act and supervised by the FSCA, requires a provider to have appropriate procedures and systems in place to record verbal and written communications relating to a financial service rendered to a client, to store and retrieve those records and any other material documentation, and to keep client records and documentation safe from destruction. Records must be kept for a minimum of five years after termination, to the knowledge of the provider, of the product concerned or, in any other case, after the rendering of the financial service concerned. They may be kept in an appropriate electronic or recorded format, provided they are accessible and readily reducible to writing. The provider need not hold the records itself, but must ensure they are available for inspection within seven days of a request from the Authority.

Three points in that paragraph drive everything that follows:

• "Verbal and written communications relating to a financial service." A WhatsApp exchange in which a representative explains an excess, recommends a cover level or confirms an instruction is exactly such a communication. Voice notes are verbal communications and fall under the same duty.
• "Five years after termination of the product." Not five years after the message. For a short-term policy renewed for a decade, the clock has not started. For a life or funeral policy, the conversation that led to the sale may need to be retrievable fifteen or twenty years later.
• "Accessible and readily reducible to writing." A backup file in a proprietary format that nobody can open is not a record. An export the compliance officer can produce as a readable document is.

Why phones, chat exports and screenshots fail the test

Most brokerages that use WhatsApp today keep no record at all, or keep one that would not survive the questions an inspector asks. The table below sets common practices against the Code's requirements.

Practice	Recorded?	Retrievable in 7 days?	Survives 5+ years?	Attributable to a representative?
Representative's personal WhatsApp, no export	Only on the handset	Only if the person is still employed and cooperative	No: lost with the phone or the departure	Yes, but unverifiable
Periodic chat export to email	Partially (text, no media by default)	Depends on who filed it	Possibly, with no index	Weak
Screenshots into the client file	Fragments	Yes for the screenshot, no for context	Yes	No timestamps of sufficient quality
WhatsApp Business app with cloud backup	Yes, on one device	Only through that device	Backup can be overwritten	Single user, so yes
WhatsApp Business Platform with a shared inbox and message store	Yes, server-side, every message and status	Yes, by client, date or user	Yes, with a retention policy	Yes, by named user and audit log

The last row is the one that meets the Code's wording without heroics. It is also the setup the guide to WhatsApp Business for a South African brokerage walks through. In ORIS, every inbound and outbound message, its delivery status and the user who sent it are stored against the client record, with audit logs available under Settings for the compliance function, and a CSV export for the file an inspector asks for.

An archiving policy in five decisions

A brokerage does not need a long document; it needs five decisions written down and followed.

1. Which number. Client communications about financial services happen on the brokerage's business number only. Personal numbers are for personal use. Put it in the representative's contract and the Code-required compliance manual.
2. What is a record. Everything in a client thread: text, voice notes, images of documents, PDFs, and the status of each message. Voice notes should be transcribed or summarised into the client record in writing so that the record is "readily reducible to writing".
3. How long. Five years after the product terminates, as the minimum. Many brokerages apply a single rule of five years after the end of the relationship, plus the time needed for any open complaint, because tracking termination per product across a book is error-prone. POPIA's retention principle is satisfied as long as the brokerage can point to the FAIS purpose.
4. Who can access. The representative servicing the client, the key individual, the compliance officer. Access is logged. Nobody else, and nobody on a personal device.
5. What happens on departure. The user is deactivated the same day; the conversations remain with the brokerage; the client is told who now services them. No export to the leaving representative, and a written confirmation that no client data was retained on personal devices.

When the record is tested: FSCA requests and FAIS Ombud complaints

Two situations reveal whether the archive works. The first is an FSCA request, which may be part of a thematic review or a specific investigation; the Code gives the provider seven days to make records available. A compliance officer should be able to pull every conversation with a named client, in date order, with the representative identified, within an hour, not a week.

The second is a complaint. The Code requires an internal complaints procedure, and the FAIS Ombud may consider complaints about a financial service rendered where the complainant became aware of the act or omission within three years of lodging, after the provider has had six weeks to resolve it. The decisive evidence is usually what the representative said when the cover was chosen or the claim was discussed. A retrievable WhatsApp thread has settled more than one dispute in the provider's favour; a missing one has settled others against it, because the absence of a record is itself a finding.

A short checklist for the compliance officer before the next inspection:

• Every active representative communicates with clients on the business number, and the list of users matches the representative register.
• Message storage is server-side and independent of any handset.
• A retention rule is configured and documented; nothing is deleted below the five-year mark.
• A test retrieval has been done this quarter: one client, one year, exported in under an hour.
• Departed representatives have been deactivated and their client threads reassigned.

Record-keeping is rarely the reason a brokerage adopts a shared inbox; clients and workload are. But it is the reason the key individual sleeps. Further reading on this blog under compliance and regulation covers the neighbouring obligations.

Frequently asked questions

Does a WhatsApp voice note count as a record under the General Code?

Yes. The Code refers to verbal and written communications relating to a financial service. A voice note should be stored and, to keep it readily reducible to writing, summarised or transcribed in the client record.

Can we delete conversations after five years?

After five years from termination of the product, and provided no complaint or investigation is open, the FAIS minimum has been met. POPIA then expects the brokerage not to keep personal information longer than its purpose requires, so a deletion rule is appropriate.

The representative used a personal number before we set up a business number. What do we do with those chats?

Export them to the brokerage's system while the representative is still employed, file them against the relevant clients, and confirm in writing that the personal device no longer holds client data. Then move all communication to the business number.

Is a screenshot acceptable evidence for the FAIS Ombud?

It may be admitted, but its weight is limited: no context, no guaranteed timestamp, easy to alter. A full thread exported from a system with an audit log is far more persuasive.

Does the seven-day rule for inspections apply to records held by a software provider?

The Code allows records to be held by a third party, but the FSP remains responsible for producing them within seven days of the Authority's request. The contract with the provider should guarantee export within that period.