Having said that, there's no allegation or evidence given that these side channels were used particularly or mainly to hide illegal activity. Using official communications systems can be clunky and inconvenient, and it's also possible this was done more to hide activity from potential rivals within the organisation than from regulators, although I'm sure that happened too. We don't really know.
I think people on "the outside" completely underestimate how true this is. If you've never worked at a 100K employee firm, and especially a bank.. its unimaginable. It sets up a lot of weird incentives, particularly for some rules/processes to seem very arbitrary and rigid. This is because the sample size is so big, they end up worrying about the worst thing the worst person could do.
Inevitably this leads to backdoors and side channels to work around the standard processes because these processes make doing your job insufferably more difficult.
For years we had chat apps which were horribly slow on desktop and had no mobile app, while we all had iPhones/Androids in our pockets.
An anecdote would be that at one bank I worked, releasing a new version of our application required filling out a change request form. This form was a desktop app which was multi-page, multi-tab, with pop-up modals. There were radio buttons, checkboxes, drop down selectors, and free form text fields. Once certain parts were completed, you couldn't go back and correct them if wrong and had to start again. We had 1-2 out of 20 devs good at filling out the form, and it took 45 minutes. We then had to chase 5+ MD-level (don't read email / chat / etc) to click the approve button between then & when we wanted to release. We budgeted a week to chase these guys. Again if we failed to get approvals it went back to square 0 and start over on the form again.
I've spent 20+ years with various banks and it is obvious when i read comments about "banks" those writing have near-zero experience.
Expanding on the change control for just a second.
Imagine that one arm of the bank (Say ATM's) only releases updates once per year and so they can spend days filling out the CR's, chasing approvals, etc.
Their change is also very visible outside the bank and needs to be carefully vetted. They then create "processes and controls" around this.
Now, imagine working for "Capital Markets" where you need to update your system constantly to stay competitive, but also have the banks change process enforced on you?
You need change management, but the banks processes are overwhelming and inflexible...
This "one size does not fit all" pattern is very common in Banks (i would imagine in any large org?).
I've been on the receiving end of compliance rules around various communications (for example being forbidden from ever writing "ISO" because it's a heavily regulated but also exceptionally important order type) that did nothing to protect markets, other participants, or the firm I was working at.
My experience with various financial regulators was that they were far more interested in finding ways to slap someone with some random rule violation as opposed to meaningfully trying to protect consumers/markets, so if the most the SEC can come up is that there were record keeping violations I wouldn't read too much into it.
This is mostly an outdated and now probably overreaching law, written in 1948 when most conversations happened face to face and written memos were more significant/official. An employee using Whatsapp to ask if someone wants to get a drink after work or talk about last night's basketball game isn't exactly sinister, but the interpretation is that all of that needs to be done on the recorded, audited channels.
They could still just talk face to face if they wanted to coordinate crimes, the SEC isn't making every bank employee wear a microphone yet.
I once worked on a phone app which would give internal users the ability to make certain transactions while away from the desk. It was the mobile version of something they had on their work PC.
Compliance's concern was it could be used while overseas where subject to other regulators. It was pointed out to compliance that these same users were using these same phones to make voice calls to execute the same transactions, for decades.
Having to enter the information in electronically rather than over a phone call is demonstrably better from a record keeping & being compliant perspective. It turned into a case of bringing existing practices more "into the light" was actually considered worse than the status quo.
There wouldn't be. That's the entire point of using chat.
> They could still just talk face to face if they wanted to coordinate crimes, the SEC isn't making every bank employee wear a microphone yet.
Of course they could. We can at least keep corruption moderately inconvenient.
Given what we know about insider trading on Wall Street (and LIBOR etc), most likely there was a lof of incriminating discussions. And there does seem to be some evidence in the case of Nomura.
https://dealbreaker.com/2022/09/make-sure-to-delete-that-inc...
"The head of a trading desk routinely directed traders to delete messages on personal devices and to use Signal, including during the CFTC's probe."
1000% this was done in-person, not in any electronic medium Probably by telling his right-hand-man or sub-heads who then distributed the message in-person, non-electronically as well
We live in a pretend society.
These types of fines are so the SEC can pretend that they're not a worthless sack of shit.