Cast your mind back two, maybe three years, and the prospect of social media as a compliance risk would likely have been scoffed at. How can platforms designed to share holiday photos, relationship updates, invites to simulated farms, and opinions on football stadium ‘scran’ possibly pose economic or compliance risk?
News that the Financial Conduct Authority (FCA) is interviewing 20 finfluencers under caution has made clear, however, that social media risk should be taken very seriously.
FCA takes action against ‘finfluencers’
On October 22, 2024, the FCA announced that it is taking potential criminal action against 20 finfluencers for their alleged involvement in “touting financial services products illegally.” It has also issued 38 alerts to social media accounts operated by finfluencers which may contain “unlawful promotions.”
Commenting on the FCA’s actions, Joint Executive Director of Enforcement and Market Oversight, Steve Smart, said:
“Finfluencers need to check the products they promote to ensure they are not breaking the law and putting their followers’ livelihoods and life savings at risk.”
This isn’t the first time the FCA has taken action against those who could be a bad finfluence. In July 2024, the regulator announced that it had set trial dates for cases against nine social media influencers allegedly involved in promoting an unauthorized trading scheme. Speaking at the time, Lucy Castledine, FCA Director of Consumer investments, said:
“We’ve seen a growing number of ads falling short of the guidance we have in place to stop consumer harm … so we’re updating our guidance to clarify what we expect of firms when marketing financial products online. And for those touting products illegally, we will be taking action against you.”
The FCA looks to be sticking to its word and taking the risks social media can pose to compliance, consumers, and the market seriously. So seriously, in fact, that it is not looking at deterrents, fines, or warnings – but instead opting to take direct, criminal action against these individuals.
Finfluencer fines aren’t just for individuals
To date, the FCA has largely taken enforcement action against finfluencers as individuals. However, there is precedent from U.S. regulators to suggest that financial institutions themselves could find themselves in the finfluencer firing line. This is particularly true as, increasingly, financial institutions look to capitalize on the social media followings of influencers or finfluencers as part of their marketing strategy to promote their products or services.
In March 2024, FINRA fined M1 Finance $850,000 for paying social media influencers to post to social media on the firm’s behalf, finding that these posts “were not fair or balanced, or contained exaggerated, unwarranted, promissory, or misleading claims.” Here, M1 Finance were at fault as they had sought the services of the finfluencers, but had not taken steps to ensure the messaging the finfluencers put out was compliant – or even true.
Among the misleading social media posts, one influencer had stated:
“It is a general principle that anyone who starts a ROTH IRA early on let’s say in their 20s will become a millionaire by the time they’re 60”.
Individuals looking to issue financial advice on social media platforms must be aware of the rules that apply to them, and follow them accordingly. Similarly, firms looking to harness the power of the finfluencer must look at all the rules that apply in this instance too, from recordkeeping expectation to Marketing Rule obligations, and financial promotion rules more generally.
Social media as a growing compliance risk
Of course, finfluencers are not the only – or even the principle – compliance risk posed by social media. Generally speaking, social media risks can be grouped into three key areas:
- Market and economic risk: Including social-media based bank runs, such as the collapse of Silicon Valley Bank back in 2022-
- Marketing risk and consumer risk through misleading promotions and bad advice: This includes social media promotions, finfluencers, and the ability for social media to be used as a platform to market financial instruments, with elements falling under the SEC’s Marketing Rule
- Recordkeeping risks and the potential for off-channel communications: Where social media can be used as a tool for business communication, and must therefore be captured and retained to meet recordkeeping obligations
With a growing regulatory focus on data completeness in light of the $350 million fine against JPMorgan, there is an argument that social media also poses a data governance risk insofar as compliance teams must know the channels through which employees are conducting business, and capture them accordingly.
How to mitigate the compliance risks of social media?
Before taking steps to mitigate the risks that social media poses to your organization, you must first understand whether it does pose a risk and how big that risk is. As an example, compliance teams should know:
- Are employees using social media for business – if so, in what capacity?
- If social media is being used for business purposes, in what context is it being used? Is it a marketing tool, a communication tool, or something different? Different rules will apply depending on each use case.
Once the risk landscape is understood, consider the following these three steps to mitigate risk:
1. Create clear policies and communicate them effectively
Create social media use policies that are free from jargon and clearly set out what is and is not permitted with regard to social media for business communication. Tailor these policies for different roles and responsibilities, e.g. the trading function vs the marketing function. Where possible, break policies down into distinct social media channels so individuals know what is allowed on each platform. Once created, communicate these policies clearly and ensure all employees have engaged with training to understand what is permitted and the consequences of non-compliance.
2. Capture and archive communication from social media platforms
If social media is being used within financial organizations in a business capacity, ensure that all communications are captured and retained to meet recordkeeping requirements.
Global Relay has a suite of data Connectors for social media from LinkedIn to Instagram, and TikTok to X.
3. Review your compliance workflows often, so as not to fall behind innovation
The evolution of business communication channels is happening at pace. In order keep up and stay compliant your policies and solutions must be able to measure up to the emerging risk landscape. In the case of policies, revise often. Horizon scan for regulatory change or innovation and anticipate possible alterations that will be needed. Establish a way to communicate changes with employees so that they are able to stay abreast of changing expectations. Maintain an open, ongoing dialogue with your teams to understand if new social channels, or new use cases for existing channels, are adopted.
For technological compliance solutions, engage with your third-party vendor to understand their ability to be flexible. For instance, if a new communication channel appeared tomorrow, how long would it take them to deliver a compliant solution for it? To ensure compliance with emerging communication channels, firms can’t afford to be on the back foot.
