Morgan Stanley fined GBP 5.4 million over WhatsApp trading chats
Ofgem found that from 1 January 2018 until 31 March 2020 Morgan Stanley & Co. International plc failed to take reasonable steps to record and retain, or to prevent, WhatsApp messages sent by its EU wholesale energy product traders on privately owned phones about trading. The penalty was GBP 5,411,149 after a 30% settlement discount from GBP 7,730,213.
On this page
The decision
- Authority
- Ofgem (OFGEM), Great Britain
- Published
- 23 August 2023
- Participants
- Morgan Stanley & Co. International plc
- Commodity
- Wholesale energy
- Market
- Wholesale energy product trading communications (MSIP EU wholesale energy product traders)
- Conduct period
- January 2018 to March 2020
- Legal basis
- REMIT Enforcement Regulations 2013, regulation 8 (recording and retaining trading communications)
- Type of conduct
- Record keeping
- Penalty
- GBP 5,411,149, after a 30% settlement discount from GBP 7,730,213
- Status
- Final (settled)
What Ofgem found
The final notice, dated 17 August 2023 and published with Ofgem's press release on 23 August 2023, holds that Morgan Stanley & Co. International plc (MSIP) breached Regulation 8 of the Electricity and Gas (Market Integrity and Transparency) (Enforcement etc.) Regulations 2013 from 1 January 2018 until 31 March 2020. It finds a breach of Regulation 8(3), which requires reasonable steps to ensure relevant communications are recorded and retained, and of Regulation 8(6), which requires reasonable steps to prevent relevant communications, including on privately owned equipment, that the firm cannot ensure are recorded and retained. A relevant communication is any telephone or electronic communication made for the direct or indirect purpose of entering into a transaction in wholesale energy products; retention is for at least six months in a form the Authority can access.
The notice finds that communications carried out by MSIP's EU wholesale energy product traders met that definition: they were instant messages sent via WhatsApp on privately owned mobile phones, made to enter into transactions in wholesale energy products on unrecorded systems, and MSIP could not ensure they were recorded and retained.
How it came to light
The notice says the Authority learned of the WhatsApp use from communications MSIP provided in response to a request for information under the Enforcement Regulations, and opened an investigation in 2021 into whether MSIP had breached Regulation 8.
What the decision turned on
The Authority found that MSIP had policies prohibiting non-approved messaging systems for company business and took some steps to convey them: email reminders, an undertaking from employees not to use unofficial means, and, from 2019, training for its desk focused on misuse of WhatsApp and similar systems. It nonetheless found those measures not sufficient until March 2020. The reason it gives is that MSIP did not take reasonable steps to monitor compliance with the policy or to assess the risks of non-compliance, and acted only after the Authority had identified the WhatsApp use. The Authority acknowledged that MSIP then took the discovery seriously.
The Authority found that by the end of March 2020 MSIP was no longer in breach. The remedial steps it lists are training reinforcing the prohibition on WhatsApp, internal action over employees' use of it, and an internal investigation into WhatsApp and other non-approved messaging systems.
The penalty
The Authority imposed a penalty of GBP 7,730,213, calculated with the six-step process in the 2015 REMIT Penalties Statement, which applies because the breach predates 2022. MSIP admitted the breach and settled within the settlement window, so the penalty was discounted by 30% to GBP 5,411,149, payable within 28 days of service. A warning notice and decision notice came first, and a referral of the decision notice to the Upper Tribunal would end the effect of the final notice. The notice does not itemise the six steps.
For a surveillance function
The notice describes record keeping as what allows the Authority to investigate and enforce REMIT requirements. It finds that a prohibition in policy was not enough without monitoring compliance and assessing the risk of non-compliance, so a firm's controls over trader communications are judged on whether they are monitored and tested.
Sources
- Ofgem, Final notice regarding the imposition of a financial penalty on Morgan Stanley & Co. International plc, 17 August 2023 (Decision)
- Ofgem, Ofgem fines Morgan Stanley & Co. International plc (MSIP) over GBP 5.4m for failure to record and retain electronic trading communications, 23 August 2023 (Press release)
Sources read on 27 October 2026. This page restates what the authority published and adds no finding of its own. A decision under appeal is not final, and its status may have changed since: check the source before relying on it.