This is actually a two part question. I've done some research and I don't know if I'm looking in the wrong places but I can't find anything. Our IT department is wanting to implement two new products for our employees. The first is the use of instant messaging throughout the bank. Does anyone know of any compliance issues that might be associated with this, such as, record retention requirements?

Second, they are also discussing the implementation of setting up each employee with their own personal fax number. These faxes will be coming in via email verses through a fax machine. Again, does anyone know of any compliance related issues we may have with this.

Any help or guidance you can give is greatly appreciated

We use instant messaging. Managers like it because it enables them to see who is signed on to their computer, offline, away, etc., it even interfaces with your calendar to show when you are in a meeting. If you aren't saving the messages, it might not be appropriate for employees that work with securities.

If these addressed customer issues such as complaints from a customer, there could be retention requirements.

I would expect that banker to banker communications would not include retainable content. SOX issues may be an exception as I am not that familiar with SOX requirements.

The fax, received in email, would be the same. If you had an employee receive communications that would be retainable as a traditional fax, the same applies.

Your issues then are to print and retain, or retain in e-form. IF you do the latter, a good indexing system should be in place.

The following warning is displayed on every instant message screen to remind our employees to safeguard customer info: "Do not include client or confidential information in your messages. Your session is logged and may be reviewed for compliance with our policies and Code of Conduct."

Without knowing who your regulator is, here is a FDIC FIL on the topic of "instant messaging":

http://www.fdic.gov/news/news/financial/2004/fil8404a.html

Most of the banks for whom we work have elected not to allow the use of instant messaging because of the associated risks.

Also, I failed to mention that employees working in areas with email retention requirements are not permitted access to IMs.

The IM system we use is part of our email and is internal only. It is possible to save instant messages to our email.

We have the system set up so whenever anyone closes an IM it asks if they want to save it. We save very few messages. Most of the usage is within the customer service area. Reps. use it to let there co-workers know when they are going to lunch or will be away from their desk. It has helped with coverage issues.