How Do Regulated Firms Manage Signal Compliance?

Short Summary

Advanced privacy features make Signal a desirable choice for those who prioritize privacy and security, yet those same features make it unsuitable for meeting compliance obligations in regulated industries. This article explores how regulated firms can achieve Signal governance without breaching recordkeeping rules, what a genuine Signal governance solution requires, and how firms can build a defensible policy that enables controlled Signal use rather than relying on an outright ban.

Key Takeaways

• Signal’s privacy features pose a compliance risk: End-to-end encryption and disappearing messages mean Signal cannot store messages as required by recordkeeping regulations.
• Risk of unmanaged use: A 2025 lawsuit involving U.S. national security officials highlighted the legal repercussions of using Signal for sensitive information, where disappearing messages resulted in lost records.
• Flat bans do not work: Banning apps like Signal does not work in practice, as illustrated by a recent SEC enforcement sweep in which charged firms had policies banning unapproved apps but were failing to enforce them.
• Personal devices not covered: Mobile device management tools can block Signal on corporate devices, but they do not reach personal phones, where most unmanaged Signal use actually occurs.
• Defensible policy requirements: A defensible Signal governance policy requires a written policy, device enforcement, message capture, and regular audits.
• Controlled Signal use is achievable: With the right governance layer, regulated industries can let employees and clients continue using Signal, even on personal devices, while still meeting recordkeeping requirements.

Why Signal Is Hard to Govern in a Regulated Environment

Signal has built a reputation as the messaging app of choice for privacy-conscious users in industries where the sensitivity of routine business conversations makes privacy paramount, including financial services, pharmaceutical and life sciences, insurance, and government. Its built-in features prevent conversations from being retained or accessed by anyone outside them, making it a strong choice for executives handling sensitive deal discussions and employees wary of monitored channels.

Though its user base is smaller than WhatsApp’s, employees who already use Signal personally often extend the habit to business conversations, and some use it because a client has expressed a preference for the app’s privacy features.

Two of Signal’s most compelling privacy features are the very ones that make it structurally incapable of supporting the recordkeeping obligations regulated firms must satisfy:

• End-to-end encryption: Signal uses its own open-source Signal Protocol to encrypt messages on the sender’s device and decrypt them only on the recipient’s device. No intermediary, including Signal itself, can access message content in transit. Signal promotes this as a key selling point, emphasizing that the app is built to make it structurally impossible for anyone to read users’ messages. 

• Disappearing messages: Signal lets users define an auto-delete period for any conversation, from 30 seconds to four weeks. Once that interval elapses, the message vanishes from both devices and cannot be recovered. Signal keeps no server-side copy to fall back on.

Regulated industries are required to monitor and retain certain business-related communications under rules such as the following: 

• SEC Rule 17a-4 requires broker-dealers to preserve records in a non-alterable, non-erasable (WORM) format, retrievable on demand.
• FINRA Rule 4511 requires firms to create and preserve accurate records of business communications, including those conducted through consumer messaging apps, for a minimum of three years.
• FINRA Rule 3110 requires firms to maintain a system for supervising associated persons, including review of correspondence and internal communications.
• MiFID II Article 16(7) requires EU investment firms to record telephone conversations and electronic communications related to client orders and transactions, and to retain these records for at least five years.

The problem is that Signal doesn’t have a built-in enterprise archive or any mechanism to capture a message before it is encrypted end-to-end or deleted by the sender. So when employees use the app with clients or for other business purposes, the firm is left with no record of the conversation and no way to retrieve it later. Failure to produce required records can trigger fines and other penalties, a pattern well documented in recent enforcement actions over unretained off-channel messaging.

Signal’s Status as an “Unmanaged Application” in U.S. Government Policy

The U.S. Department of Defense further confirms Signal’s unsuitability for regulated use, classifying it alongside WhatsApp and iMessage as an “unmanaged app”, which is one not authorized to access, transmit, store, or process non-public government information without a formal policy exception. The concern behind that classification applies equally to any industry or setting where an unmanaged app offers no way to capture, retain, or produce a record on request. 

This means that regulated firms can’t safely use Signal as a business communication channel without additional controls that capture and archive Signal communications at the point of sending or receiving, operating reliably despite the app’s built-in encryption or message-lifespan settings, resulting in a durable, reviewable record that is retained in a compliant format.

“Signalgate” Shows What Happens When Messages Disappear

Nothing makes the risks of Signal’s disappear-messages features clearer than “Signalgate.” In March 2025, senior U.S. national security officials used a Signal group chat to discuss sensitive military operations, with the app’s disappearing-messages feature enabled. A journalist was inadvertently added to the chat and later published details of the exchange, which triggered a Federal Records Act lawsuit against the officials involved.

When the lawsuit sought recovery of the Signal messages, the CIA’s chief data officer testified in a court filing that substantive messages from the chat could no longer be found. The app’s disappearing-messages feature irretrievably erased chat records, exposing the officials involved to legal action under the Federal Records Act.

Around the same time, the National Security Agency separately warned its staff that foreign hacking groups were exploiting Signal’s “linked devices” feature through phishing schemes to access accounts and read conversations in real time. Signal disputed that this reflected any flaw in its encryption, characterizing the warning as a phishing risk rather than a vulnerability in its core technology. For regulated firms, this is a reminder that unmanaged use of Signal carries security exposure in addition to recordkeeping exposure. 

What Governing Signal Actually Requires

Understanding why Signal fails at recordkeeping is only half the picture; the more useful question for a compliance function is what to do about it. 

There are two viable paths to Signal governance in regulated industries:

• Block Signal outright: Firms can define a list of approved communication channels that excludes Signal, then use mobile device management (MDM) tools to prevent the app from being installed or used. This is easy to implement on corporate devices, which can be preloaded via MDM, but it offers no protection when an employee disregards policy and uses Signal on a personal device out of habit or convenience. 
• Govern Signal rather than prohibit it: Firms can permit Signal use and still meet their recordkeeping obligations by using a third-party governance tool to capture messages, media, and metadata before encryption or disappearing-messages settings take effect. Some solutions extend this capture layer to both corporate and personal devices via a verified professional identity tied to the employee rather than the device, so employees can use Signal on the device they prefer while every business conversation is still recorded and archived independently of the app’s own settings. 

What does not work is a policy that simply instructs employees not to use Signal without any mechanism to enforce it. In a January 2025 enforcement sweep, the SEC fined a dozen broker-dealers and investment advisers for off-channel communications failures. Investigation found that many of those firms already had policies prohibiting unapproved apps, but these policies were not followed uniformly, largely because they were not properly enforced.

Firms that rely on policy alone, without governance and security controls to back it up, consistently find that off-channel use continues regardless of what the policy says. A far more reliable course of action is to allow preferred apps like Signal while keeping the firm compliant, using the third-party capture approach described above.

Building a Defensible Signal Governance Solution

Closing the gap identified above takes a coordinated policy that defines, enforces, and monitors Signal use as a matter of course and incorporates the following four components:

• A written policy: The policy should distinguish approved communication channels from prohibited ones, specify whether and how Signal use is permitted, and state what happens if an employee is found using an unapproved channel for business. 
• Technical enforcement through mobile device management: MDM tools should be used to help firms control which apps can be installed on corporate-owned devices, remotely restrict or remove Signal if it violates policy, and maintain verifiable records of which devices and accounts are authorized to use it for business. The limitation is that MDM only reaches devices the firm owns and has enrolled, but has no authority over an employee’s personal phone. Any Signal use on personal devices, where most unmanaged use actually happens, sits outside what MDM can see or control. The only way to close that gap is with a capture mechanism that works independently of the device being used for the conversation.
• Capture and archiving for any sanctioned use: An external third-party solution is needed to record and retain messages, media, voice notes, and metadata at the point of sending or receiving. Ideally, the solution will also automatically export that data into the firm’s existing archiving and surveillance systems on a defined schedule, producing a durable record in a compliant format.
• A regular audit cadence: Regular audits should be scheduled to review captured Signal activity against the written policy. Once Signal activity is captured, controls such as role-based access and alerts for flagged or prohibited activity can be implemented by central administration.

Since Signal itself offers no way to record conversations independently of its encryption and disappearing-messages settings, an external capture and archive solution is needed to implement these policies successfully, as they rely on a message archive.

Bringing Signal Under Governance With LeapXpert

The necessary external capture and archiving layer is exactly what The LeapXpert Communications Platform provides, bringing Signal use under the same governance and recordkeeping standards firms already apply to email and other approved channels, without the compliance risks that come with unmanaged apps. Instead of an outright ban that is difficult to enforce and prone to failure, firms can use LeapXpert to support the safe use of Signal for legitimate business needs.

Employees can use Signal on corporate devices in Native Mode, which captures messages, media, and metadata for archiving, despite the app’s encryption and disappearing message settings. On personal devices, Governed Mode, delivered through Microsoft Teams or the dedicated Leap Work application, assigns each employee a Single Professional Identity, ensuring that Signal use for business is fully captured and archived without interfering with personal use of the app on the same device.

Combined with role-based access controls, single sign-on, and centralized administration, this gives compliance teams the audit trail that unmanaged Signal use cannot provide, closing every compliance gap while letting employees keep the interface and privacy protections they value.

Book a demo to learn more.

FAQs

Can financial services employees legally use Signal for business communication?

Financial services employees can use Signal for business communication only if the firm has implemented the controls needed to meet its recordkeeping and supervision obligations, such as third-party capture and archiving. Using Signal as an unmanaged consumer app for business conversations is not permitted under rules such as SEC Rule 17a-4 and FINRA Rule 4511, because neither the firm nor a regulator can retrieve records that the app has not preserved. Firms that allow unmanaged Signal use expose themselves to the same regulatory risk that has resulted in fines against other firms for unretained WhatsApp and iMessage conversations.

Why are Signal’s disappearing messages a compliance risk?

Disappearing messages are a compliance risk because they remove the underlying record before any recordkeeping, supervision, or audit obligation can be met. Once a message expires, it is deleted from both devices with no recovery mechanism, meaning a firm cannot produce it in response to a regulatory exam, an audit, or a litigation hold. This is the same mechanism that exposed federal agencies to records-preservation failures during the 2025 Signalgate incident.

Can Signal messages be archived for regulatory recordkeeping?

Signal messages can be archived for regulatory recordkeeping, but only with a governance layer added on top of the app, since Signal itself offers no administrator console or enterprise archive. Third-party capture solutions record messages, media, and metadata at the point of sending or receiving, operating reliably despite Signal’s encryption and disappearing-messages settings, producing a durable record that the firm controls. Without this layer, any business conversation conducted over Signal leaves no retrievable trace once those features have been triggered.

What is the “Signalgate” incident, and what does it teach regulated firms about messaging compliance?

The “Signalgate” incident refers to the March 2025 case in which senior U.S. national security officials used Signal to discuss sensitive government business, resulting in a Federal Records Act lawsuit after a journalist was inadvertently included in the conversation. Court filings later revealed significant gaps in what the involved agencies had preserved, including confirmation that messages on one official’s device had already been deleted, largely due to Signal’s disappearing-messages feature. For regulated firms, the incident demonstrates that disappearing messages and unmanaged apps can create records-preservation exposure in any industry or sector.