£5.41m reg fine over energy traders' WhatsApps cautions attorneys also on retention, spoliation, FOI

Electrical pylons on the Leeds-Liverpool Canal, England.
Mr T via Geograph CC BY-SA 2.0

The British gas and electric regulatory authority (Ofgem) fined investment bank Morgan Stanley £5.41m in late August for failure to record and retain traders' messages on WhatsApp.

News of the fine has shaken up the British compliance sector. The case should grab the attention of compliance attorneys, of course, but also corporate counsel and government attorneys throughout the Anglo-American legal system.

Wholesale energy traders discussed market transactions on WhatsApp on their personal devices. Rules on market manipulation and insider trading require that communications "relevant" to trading be documented and retained for Ofgem review; the messages were not.

The enforcement action therefore represents a wake-up call, but not a new standard. The case probably resonated for two reasons. First, employee use of personal devices for communication is increasingly common, if not expected, and it's difficult to police. Second, WhatsApp is known for its end-to-end encryption, a feature that makes it appealing to users, but incompatible with regulatory transparency.

I'm not a fin reg wonk, but it was those characteristics of the case that caught my attention. The enforcement action should remind corporate counsel that record retention requirements cut across devices and applications and can even follow employees home. Moreover, when records might be perceived reasonably to have potential relevance in future litigation, the cost of non-retention in spoliation can be steep.

Similarly, the enforcement action should remind government authorities that neither non-public location nor software-driven encryption countermands record retention and freedom-of-information laws. Transparency law was once vexed by problems such as proprietary access and private location; it is no longer. Just ask Hillary Clinton about her State Department emails or Donald Trump about his bathtub war plans.

The enforcement action is Ofgem, Penalty Notice: Finding That Morgan Stanley & Co. International PLC Has Breached Regulation 8 of the Electricity and Gas (Market Integrity and Transparency) (Enforcement etc.) Regulations 2013 (the REMIT Enforcement Regulations) (Aug. 23, 2023).