April 7, 2025



The U.S. Securities and Exchange Commission (SEC) and other financial regulators are investigating regulated entities regarding their employees’ use of personal messaging apps and other "off-channel" electronic platforms.

The SEC has raised concerns about unregulated off-channel communications, which pose risks around compliance, transparency and data security.

Employers who violate SEC rules may be subject to hefty fines.

Here’s why it matters for your business:

Data security risks

Messaging apps, like WhatsApp and Skype, often store sensitive information, including conversations, attachments and client details.

Compliance challenges

For businesses in regulated industries, unmonitored communication channels can lead to non-compliance with various laws and regulations.

Transparency and accountability

Off-channel communications can make it difficult to maintain an audit trail, complicating internal investigations or compliance checks.

Productivity concerns

Unregulated messaging apps might not only introduce risks but also distract employees.

Reputation management

Misusing personal messaging apps for work can blur the lines between personal and professional behavior, potentially leading to inappropriate or unprofessional interactions that harm your brand.

That's why you need a robust phone and social media policy

Your policy should cover:

Approved and prohibited tools

Define which communication platforms are acceptable for business use. For example, you might allow email, Teams or Slack for work conversations, but prohibit apps like WhatsApp or Skype.

Productivity and appropriate use

Outline expectations for personal phone use during work hours. Will you allow employees to check their phones during the entire workday or only during breaks? Are there any special considerations for hybrid or remote working scenarios?

Social media use

Clarify whether social media is permitted during work hours and specify acceptable use for roles that require it, such as managing company social media accounts. If your employees are posting on your company’s behalf, ensure that they understand copyright rules, fair use and what information is considered confidential and proprietary.

Risks and safety

Stricter rules should be included to prioritize safety for roles like drivers or those operating machinery. Conduct a risk assessment to identify where phone use might pose hazards. Be aware of related compliance requirements for commercial driver’s licenses (CDL) drivers.

Company-issued phones

If your business provides mobile devices, state what counts as acceptable use. Specify whether personal calls or app downloads are allowed and highlight security measures to protect company data.

Disciplinary measures

Clearly define what constitutes a policy breach and the consequences for employees who don’t comply. For clarity, refer to your Employee Discipline Policy or Procedures.

We can help you to clarify what your phone and social media policy should include to protect your business.

Get in touch with us for a confidential chat today.