SFC Record-Keeping for WhatsApp: How HK Brokerages Archive Client Chats (2026)

For a Hong Kong securities brokerage, WhatsApp is where clients already are. They ask for quotes, confirm instructions and chase settlement on the same app they use for everything else. The question for a Head of Compliance is not whether to allow it — clients will message regardless — but how to allow it without breaching the record-keeping obligations the Securities and Futures Commission (SFC) has set out since 2018.

This guide explains what the SFC’s record-keeping requirements mean for instant messaging, how long each type of client record must be kept, why personal WhatsApp on a staff phone is the single biggest gap, and the operating model that turns WhatsApp into a channel your compliance team can defend.

The payoff of governed messaging

Banning WhatsApp outright pushes conversations into the shadows — onto personal phones you cannot see. Governing it does the opposite: it captures the demand your clients are already showing.

• 71% of consumers are more likely to buy from a business they can message — a signal your front office cannot afford to ignore. (Meta + Kantar)
• 69% prefer messaging a business over calling it — the channel your clients reach for first. (Meta + Kantar)
• ~68% read rate on opt-in WhatsApp messages — why time-sensitive market updates actually land. (WhatsApp benchmark data)

重點摘要

• The SFC permits brokerages to receive client orders through instant messaging — but only if the firm has full control over the recording and retention of those messages.
• Instant-messaging order messages must be kept for at least two years; client agreements and business records for seven years under the Keeping of Records Rules (Cap. 571O).
• Records must be reliable, centrally managed and fully accessible to the SFC on demand without unnecessary delay.
• Personal WhatsApp on a staff member’s phone cannot meet these tests, because the firm has no control over what is recorded or retained.
• A governed business-messaging platform — capture on a firm-controlled account, retention by policy, and a full audit trail — is how brokerages close the gap.

The obligations sit across several instruments. Here is the regime at a glance:

None of this bans messaging. It sets the conditions under which a brokerage can use it. If you are weighing up how financial-services teams put WhatsApp to work in the first place, our overview of how financial-services teams in Hong Kong and Singapore use WhatsApp is a useful companion. As an Official Meta Technology Partner, imBee helps 10,000+ enterprises across 60+ industries run exactly this kind of governed messaging.

On 4 May 2018 the SFC issued a circular to intermediaries titled “Receiving client orders through instant messaging.” It defines instant messaging (IM) as electronic communication that lets users immediately exchange text and files across mobile or computer platforms, and it names the obvious examples: WhatsApp and WeChat. The circular did not prohibit these tools. It set the terms of use.

The core condition. Staff must not make, send or receive electronic communications relating to client orders unless the intermediary has full control over the recording and retention of those order messages. That single clause is the hinge on which everything else turns — and it is the clause a personal WhatsApp account fails.

Retention and accessibility. All order messages must be fully recorded and properly maintained for a period of not less than two years, and the records must be reliable and fully accessible to the SFC on demand without unnecessary delay. Messages, accounts and the devices used to store and process them should be centrally managed to reduce error and the risk of record tampering.

The circular frames its expectations around five control areas that a brokerage should be able to evidence:

• Centralized record-keeping — order messages captured and stored centrally, not scattered across personal handsets.
• Security and reliability — safeguards against unauthorised account access and cybersecurity attacks, with validated client identities.
• Effective compliance monitoring — the ability to supervise and review IM conversations, not merely archive them.
• Internal policies and procedures — written rules for which channels are approved and how staff must use them.
• Client awareness — clients understand how their instructions are received and recorded.

The SFC was explicit that it “will not hesitate to take regulatory action” against intermediaries that use IM to receive client orders without sufficient measures in place. For a licensed corporation, the compliance question is therefore not whether messages are being kept, but whether the firm — not the individual employee — is the one keeping them.

“How long do we keep it?” has different answers depending on the record. The safe operating rule most Hong Kong brokerages adopt is to standardize on the longest applicable period rather than track each clock separately — but it helps to know where the numbers come from.

The individual minimum periods:

Order instructions carry an extra duty. Under paragraph 3.9 of the SFC Code of Conduct, a licensed person must record and immediately time-stamp the particulars of agency and internally generated orders, and use a telephone recording system where instructions arrive by phone. If an order is taken on a mobile outside the usual place of business, the staff member is expected to call the firm’s recording system immediately and log the time and details. WhatsApp order messages sit inside this same discipline: the instruction and its timing must be captured, not just the fact that a chat happened.

Where the records physically live. Section 130 of the Securities and Futures Ordinance requires prior written SFC approval before using any premises to keep records or documents. When a firm keeps regulatory records exclusively with an external electronic data storage provider, the SFC’s 2019 guidance adds its own conditions — covered in the next section on how to archive properly.

Because the seven-year clock on client agreements outlasts every other period, most compliance teams simply retain all client-conversation records for seven years. It is the simplest defensible policy, and a governed platform lets you set it once. The full retention schedule is in the Keeping of Records Rules (Cap. 571O).

The most common way a brokerage falls out of line is also the most innocent: a relationship manager gives a good client their personal WhatsApp number. It feels like service. Under the 2018 circular, it is a control failure — because the firm has no control over what that personal account records or retains.

No firm control over recording or retention. On a personal account, messages can be deleted, disappearing-message timers can be switched on, and the firm has no systematic way to capture the conversation. That is the precise opposite of the “full control” the circular requires.

Records walk out the door with the employee. When a staff member leaves, their phone — and every client conversation on it — leaves too. There is no central store to hand to the SFC on demand, and no way to reconstruct an order trail after the fact.

No audit trail, no supervision. Compliance monitoring assumes someone can review conversations. A personal app offers no supervisory view, no searchable archive and no evidence that monitoring ever took place.

Data-governance exposure. Client personal data on an employee’s personal device also sits awkwardly against the Personal Data (Privacy) Ordinance (Cap. 486) and the six data-protection principles the Privacy Commissioner for Personal Data enforces — the firm cannot demonstrate where the data is, who can see it, or how it is secured.

The fix is not to ban messaging and hope staff comply. It is to give them an approved, governed channel that is easier to use than their personal phone — so the compliant path is also the convenient one. To understand the mechanics, it helps to know the difference between the consumer WhatsApp Business app and the WhatsApp Business Platform (API): only the Platform gives a firm the centralized control the SFC expects.

Meeting the SFC’s expectations is less about a single archiving tool and more about an operating model. Five building blocks turn WhatsApp from a liability into a governed channel.

1. Capture on a firm-controlled account. Move client messaging off personal apps and onto the WhatsApp Business Platform, connected to a business account the firm owns and controls. Every conversation is captured centrally the moment it happens — the “full control” condition satisfied by design rather than by staff discipline. Our WhatsApp Cloud API guide explains how the Platform differs from the phone app.

2. Retain under one policy. Set a single retention period — most brokerages choose seven years to cover the longest obligation — and apply it to the central store, so no record depends on an individual remembering to keep it.

3. Supervise and monitor. Give compliance a searchable, exportable view of conversations across every channel, so monitoring is something you can evidence, not just assert.

4. Control access and keep an audit trail. Scope who can see what with role-based permissions, and log every action, so you can show the SFC not only the messages but who touched them and when.

5. Handle external storage correctly. If regulatory records are kept exclusively with an external electronic data storage provider (EDSP), the SFC’s 31 October 2019 circular applies: designate at least two Managers-In-Charge in Hong Kong as EDSP MICs (a single MIC or Responsible Officer may be accepted case by case), and notify the SFC’s Licensing Department. Section 130 of the SFO still governs where records are kept.

This is where a platform like imBee fits. As an Official Meta Technology Partner, imBee unifies WhatsApp, WeChat and other channels in one governed inbox, with centralized capture, records held under your retention policy, permissioned access and audit trails — backed by an ISO/IEC 27001-certified security programme. The firm, not the employee, holds the records. That is the control institutions answering to the SFC are expected to have.

Before a single client is onboarded to WhatsApp, a Head of Compliance should be able to tick off the items below. Treat it as a readiness gate, not a wish list.

• Approved-channel policy. A written policy naming which messaging channels are approved for client business, and an explicit prohibition on using personal accounts for client orders.
• Centralized capture. Confirmation that every approved channel routes into one firm-controlled system, with no side doors.
• Retention configured. A single retention period (seven years is the simplest defensible choice) applied to all client-conversation records.
• Supervision in place. A named owner, a monitoring cadence, and the tooling to search, review and evidence that reviews happen.
• Access controls. Role-based permissions so staff see only what they should, with an audit log of who accessed what.
• EDSP notification. If records sit with an external provider, MICs designated and the SFC’s Licensing Department notified, per the 2019 circular.
• Client consent and awareness. Onboarding language that tells clients how their instructions are received and recorded — and, for any marketing messages, consent that meets the PDPO’s direct-marketing rules.
• Staff training. Everyone who touches client messaging trained on the policy, with periodic refreshers and a sign-off record.

Most of these are governance decisions, but they depend on the underlying platform being able to enforce them. Data governance — knowing where records are, who can see them, and how they are secured — is where messaging tools most often fall short. A platform built for regulated APAC businesses should make each checklist item something you configure once and evidence continuously, rather than something you chase staff to honour. Firms running large opt-in programmes should also review how broadcast messaging is governed under the same policy.

What are the SFC’s record-keeping requirements?

The SFC requires licensed corporations to keep complete, reliable records of their business and client communications, accessible to the regulator on demand. Under the Keeping of Records Rules (Cap. 571O), client agreements and business records are kept for seven years, and records of client orders for at least two years.

Can Hong Kong brokerages use WhatsApp with clients?

Yes. The SFC’s 2018 instant-messaging circular permits receiving client orders through WhatsApp and WeChat — but only if the firm has full control over the recording and retention of those order messages. Personal WhatsApp accounts, which the firm cannot control, do not meet that condition.

How long must WhatsApp order messages be kept?

At least two years. The 2018 circular requires all order messages received through instant messaging to be fully recorded and properly maintained for a period of not less than two years, and to remain reliable and fully accessible to the SFC on demand without unnecessary delay.

Does the SFC allow order-taking on personal WhatsApp?

Only if the firm has full control over recording and retention — which a personal account cannot provide. In practice, client orders should run through a firm-controlled business-messaging platform, not an employee’s personal phone. The circular warns the SFC will act against firms without sufficient controls.

What is the difference between the WhatsApp Business app and the WhatsApp Business Platform?

The WhatsApp Business app is a consumer app on a single phone. The WhatsApp Business Platform (formerly the API) connects a firm-controlled business account to software like imBee, enabling centralized capture, retention and audit across a team — the control the SFC’s record-keeping expectations require.

Do these rules apply to WeChat and other messaging apps?

Yes. The SFC’s circular defines instant messaging broadly and names WhatsApp and WeChat as examples, so the same recording, retention and control expectations apply to any IM channel a brokerage uses to receive client orders — including LINE, Telegram and Facebook Messenger.

What is an external electronic data storage provider (EDSP)?

An EDSP is a third party — typically a cloud provider — that a licensed corporation uses to keep regulatory records. Under the SFC’s 2019 circular, firms storing records exclusively with an EDSP must designate Managers-In-Charge in Hong Kong and notify the SFC’s Licensing Department.

How does imBee help brokerages meet SFC record-keeping expectations?

imBee, an Official Meta Technology Partner, unifies WhatsApp, WeChat and other channels in one governed inbox — with centralized capture, records held under your retention policy, permissioned access and audit trails, backed by an ISO/IEC 27001-certified security programme. The firm, not the employee, holds the records.

imBee powers customer conversations for 10,000+ enterprises across 60+ industries. To see governed WhatsApp messaging on your own workflows, book a demo.

參考資料與延伸閱讀

• Securities and Futures Ordinance (Cap. 571) — e-Legislation
• Securities and Futures (Keeping of Records) Rules (Cap. 571O)
• SFC — Receiving client orders through instant messaging (4 May 2018)
• SFC — Use of external electronic data storage (31 Oct 2019)
• Securities and Futures Commission of Hong Kong
• Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615)
• PCPD — Office of the Privacy Commissioner for Personal Data
• ISO/IEC 27001 — information security management
• WhatsApp Business Platform — official site
• Meta — WhatsApp Business Platform documentation
• Meta Business Partner directory