The impact of the use of ephemeral messaging applications on corporate communications

Alfonso Crespo,  March 11, 2024

EY Law - According to publications of the U.S. Department of Justice (DOJ) and related to the evaluation of Corporate Compliance Programs (March 2023), ephemeral messaging applications have become ubiquitous in many markets and are an important platform for companies to achieve growth, while facilitating communication. As a result, it is necessary to be aware of the risks associated with the use of these applications, as they can affect the evaluation of the company’s compliance program, its cooperation in criminal investigations, as well as favor the opportunity to cover up fraud committed by employees within organizations.  It is important to remember that most frauds in a company are committed by two or more people acting in collusion; therefore, these types of applications facilitate communication between them, while facilitating the elimination of any type of communication, whether texts or documents.

What are ephemeral messaging applications?

They are those communication platforms that after a period of time allow to delete or automatically delete the conversations between the parties. These applications represent a challenge for companies because when not used properly, they allow the deletion of information that needs to be retained for regulatory, compliance or litigation reasons.
The legal and compliance consequences of using ephemeral messaging applications can be significant, for example, if the company is tied up in legal proceedings, lack of control and effective retention policies can lead to costly information discovery services and penalties for the company. Therefore, it is imperative that companies implement appropriate policies and controls to ensure that, as appropriate and to the extent possible, business-related electronic data and communications are accessible and retainable.

Recommendations

The Securities and Exchange Commission (SEC) highlighted its concerns related to ephemeral messaging in a Risk Alert, and determined a sample of recommendations that can be implemented by organizations, some of which are listed below:

- Have policies and procedures in place regarding the use of electronic messaging applications.

- Specifically prohibit the commercial use of applications and other technologies that allow an employee to send messages or communicate anonymously, allowing automatic destruction of messages or prohibiting viewing or backup by third parties.

- Require staff to complete training on policies and procedures regarding the prohibitions and limitations placed on the use of electronic messages and applications and the disciplinary consequences for violating them.
- Provide regular reminders to employees of what is permitted and prohibited under the company’s policies and procedures regarding electronic messaging.

- Solicit feedback from staff on what forms of messaging customers and service providers request in order for the company to assess their risks and how those forms of communication can be incorporated into company policies.

In conclusion, the implementation of effective policies and procedures related to the use of electronic communications is paramount. Companies must take proactive steps to establish effective policies and controls to enable the proper use of these applications to ensure the preservation of information essential to their operations and legal responsibilities.

ey.com