What’s up with WhatsApp: the continued risks of social media

On 29 March 2017, the Financial Conduct Authority (the FCA) issued a Final Notice to Christopher Niehaus, a former investment banker at Jefferies International Limited, for sharing confidential information over WhatsApp in breach of Principle 2 of the FCA’s Principles for Businesses (due skill, care and diligence). The FCA imposed a financial penalty of £37,198 (after the 30% Stage 1 discount).

Case background

On a number of occasions, between 24 January 2016 and 16 May 2016, Mr Niehaus shared confidential information, obtained during the course of his employment, with a personal acquaintance and a friend (who was also a client of the firm).

The confidential information disclosed related to the identity of clients, details of client mandates and fees payable to the firm, client confidential information including intended acquisitions and views on profit warnings. In some cases the confidential information pertained to a competitor of the client (and friend) who received the information. The information was disclosed by means of the instant messaging application WhatsApp.

Mr Niehaus admitted the misconduct to the FCA at an early stage of the investigation. He understood that the information was confidential and that he should not have shared it. Mr Niehaus explained that his conduct was motivated by a desire to impress the recipients. Notwithstanding that the FCA concluded that the disclosure was deliberate and in breach of a position of trust, the FCA accepted that these disclosures were not made in the expectation that the recipients would deal on the basis of the information disclosure and no dealing resulted from these disclosures.

The FCA reduced the financial penalty to be imposed on Mr Niehaus by 15%, as part of its penalty assessment process (at Step 3), on the basis that he made full and early admissions in respect of the misconduct during an interview under caution which mitigated the breach. The FCA imposed a financial penalty of £53,140 on Mr Niehaus, which was reduced to £37,198 as a result of the Stage 1 30% discount.

Why is this case interesting?

• Social media - it demonstrates how individuals might use social media to disclose confidential information. Firms will need to continue to adapt to the risks which new and developing forms of social media and communications can pose if used inappropriately by employees to disclose confidential information. For example:
  • Firms should remind employees of the risks of engaging in informal communications (in any form).
  • Firms should provide clear guidance on when and what forms of social media may be used for business purposes.
  • Where firms have switched to a “bring your own device” model consideration should be given as to how a firm might access and monitor devices which are being used for both business and private purposes. For example in the event of a regulatory enquiry or investigation is the employee under an obligation to provide the firm with access to a personal device?
• Training - whilst firms are unable to monitor private communications of this nature it underscores the importance of ensuring that employees are adequately trained and provided with examples on:
  • how to identify and handle confidential information
  • what amounts to a breach of client confidentiality, and
  • how to identify and avoid competition risks (for example information which could confer an undue competitive advantage).
• Cooperation as a mitigating factor - it is very unusual for the FCA to accept the fact of cooperation with an investigation (notwithstanding that Mr Niehaus was interviewed under caution) as a mitigating factor or that such cooperation will result in a significant reduction in the financial penalty assessment (and therefore the ultimate penalty imposed).