Just like any other business record, ephemeral messages must be captured, retained, and produced

DOJ, FTC, SEC, and FINRA have clarified that ephemeral messages that disappear must still be preserved. Organizations that fail to adapt their compliance programs risk everything from civil sanctions to criminal exposure — and that risk is not fading.

Messaging that disappears by design — is now squarely in the crosshairs of U.S. enforcement authorities.

Modern business communications increasingly rely on tools that support real‑time chats, collaboration, and ephemeral messaging: messages that automatically delete after being read or after a set time. These technologies — found in tools like WhatsApp, Microsoft Teams, Signal, and others — create efficiency, but they also present significant compliance challenges when it comes to legal and regulatory preservation obligations.
 

In early 2024, major U.S. enforcement authorities — the Department of Justice (DOJ) and Federal Trade Commission (FTC) — took a definitive step to reinforce that messages that disappear do not escape preservation obligations. Meanwhile, financial regulators such as the Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA) maintain firm positions requiring that business communications, including ephemeral ones used in a corporate or broker‑dealer context, be captured and retained.
 

“What once may have been seen as a loophole — messaging that disappears by design — is now squarely in the crosshairs of U.S. enforcement authorities. The DOJ and FTC’s clear updates to preservation obligations make it clear that no method of communication is outside the scope of legal duties to preserve relevant evidence. Coupled with the SEC and FINRA’s strict recordkeeping regimes, the regulatory message is unmistakable:  Ephemeral communications must be captured, retained, and produced just like any other business record.”

DOJ & FTC position
On January 26, 2024, the DOJ Antitrust Division and the FTC jointly announced updates to the standard language used in preservation letters, second request specifications, voluntary access letters, and compulsory legal processes (including grand jury subpoenas). The updates specifically:
 

• Reinforce that companies must preserve materials from collaboration tools and ephemeral messaging platforms during investigations and litigation
• Clarify that this preservation requirement applies even to tools that allow auto‑deletion of messages
• Emphasize that messaging applications — whether ephemeral or not — are treated as sources of evidence that must be retained
• Warn that failure to preserve relevant messages could lead to civil sanctions or even criminal charges (e.g., obstruction of justice) if such deletion impedes investigations or litigation

Why does this matter?
Although regulators have long required the preservation of relevant evidence — including communications — the new guidance explicitly calls out ephemeral and collaboration tools. These updates are designed to eliminate ambiguity about whether “disappearing” or transient messages fall under traditional preservation duties.
 

Practical implications
Preservation letters now include explicit language referencing collaboration tools and ephemeral messaging.
 

During litigation or government investigation holds, organizations must suspend auto‑deletion features or adopt alternative methods to capture these communications.
 

Regulators expect meaningful compliance practices, including documented policies, employee training, and technical controls, to ensure these messages are archived and retrievable — not left to vanish.
 

Broader antitrust enforcement context
This 2024 update aligns with earlier DOJ guidance, such as the Evaluation of Corporate Compliance Programs (ECCP) update in March 2023, which directed prosecutors to consider how organizations govern personal device use, third‑party messaging platforms, and ephemeral messaging when evaluating compliance programs. Clear internal policies and mechanisms for retaining communications are part of what constitutes an effective compliance program.
 

FINRA’s current position
In the financial services sector, FINRA has long maintained that any business‑related communication must be captured, retained, and supervised — regardless of the platform or technology used. FINRA’s key principles in this area include:
 

• Capture and retention requirements apply to electronic communications — including texts, chat apps, and other digital messaging that relate to the firm’s business.
• The content of a message, not the technology used to send it, determines whether it must be preserved.
• Firms must ensure they have controls and systems in place to archive communications from all platforms where business discussions occur, including those that could otherwise auto‑

While FINRA has not issued a separate advisory specifically titled for ephemeral messaging, its longstanding recordkeeping rules (e.g., Rule 4511 under the Securities Exchange Act and relevant notices) make clear that business communications must be kept, and firms must be able to produce them during exams or investigations — irrespective of how quickly they might otherwise disappear.
 

SEC’s position on ephemeral messaging
The Securities and Exchange Commission (SEC) takes a similarly strict stance for broker‑dealers and investment advisers. The SEC’s recordkeeping rules under the Securities Exchange Act (e.g., Rules 17a‑3 and 17a‑4 for broker‑dealers, and Rule 204‑2 under the Investment Advisers Act) require that:
 

• All business‑related written communications — including messages exchanged via electronic platforms — must be retained as part of books and records.
• Failure to retain such communications has already resulted in significant enforcement actions and penalties against multiple financial institutions that failed to preserve messages sent through unapproved channels or ephemeral platforms.
• SEC leadership has described recordkeeping obligations as “sacrosanct,” particularly in light of the rapid adoption of ephemeral and messaging technologies. The SEC’s enforcement actions show that courts and regulators are unwilling to accept auto‑deletion or lack of preservation as an excuse.

Want to discuss how CellTrust’s Mobile Comms Capture platform addresses ephemeral messaging? Book 30 minutes with one of our Sales Engineers

#Recordkeeping #Collaboration #Compliance #DisappearingMessages #OffChannelcommunications #BusinessTexting #Enterprise #Government #Archiving #FinancialServices #WealthManagement #LegalTech #RegTech #FinTech #DataProtection #DOJ #SEC #FINRA #FTC