The SEC and CFTC called it a recordkeeping failure. JPMorgan called it a $200M lesson.

The parallel to AI tools in 2025 is exact — except the data flowing through AI is more sensitive, the usage is more widespread, and the regulatory framework is still catching up.

Same Pattern, Different Channel

The WhatsApp problem wasn't that employees were doing something obviously wrong. It was that they were using a convenient tool to do their jobs faster, and the firm had no technical visibility into what was being discussed on it.

That is precisely what is happening with AI tools today. Engineers are using Cursor to write code faster. Analysts are using ChatGPT to process data faster. Quants are using Claude to debug models faster. None of it feels like a compliance violation. All of it is moving institutional data through a channel with no logging, no monitoring, and no audit trail on the firm's side.

The SEC's recordkeeping rules require firms to capture and preserve business communications. Regulators are already signaling that AI interactions involving client data or business decisions fall into that category. The OCC is asking about AI governance in examinations. The Fed is updating its model risk expectations.

The firms that get caught won't be the ones that banned AI tools. They'll be the ones that allowed broad adoption, wrote a policy, and assumed that was enough.

The Numbers Are Worse Than WhatsApp

The WhatsApp issue was concentrated in one population — bankers communicating with each other and clients.

AI tool exposure is institution-wide. Software engineers, data engineers, analysts, quants, compliance staff, legal — every technical function is using AI tools daily. Industry surveys put the number at 70%+ of developers using AI-assisted coding tools in their regular workflow. In financial services that number is climbing fast despite the regulatory environment, because the productivity gains are too large to ignore.

The volume of sensitive data moving through these tools dwarfs what moved through WhatsApp. Every code completion request from an AI-assisted IDE sends file context to a third-party provider. Every "help me analyze this data" prompt potentially includes production customer records. Every "summarize this document" request potentially includes privileged correspondence.

And unlike WhatsApp messages between two people, AI prompt content is extraordinarily rich — structured data, code with embedded business logic, documents with client names and account details — transmitted in bulk, automatically, on every interaction.

The Fix is the Same Too

JPMorgan's eventual solution to the WhatsApp problem wasn't banning WhatsApp. It was deploying archiving and monitoring infrastructure that captured communications on approved channels and blocked unapproved ones at the network layer.

The solution to AI governance is structurally identical. A governance gateway deployed between engineers and AI providers captures every interaction, detects sensitive content, enforces policy, and produces the audit trail that regulators require. Engineers keep using the tools that make them productive. The institution finally has the visibility it needs.

The firms that move first will do so from a position of strength — demonstrated controls, clean audit evidence, and a governance story they can walk any examiner through.

The firms that wait will have the same conversation JPMorgan had with the SEC. Except the fine for AI recordkeeping failures in 2026 won't be $200M.

BastionGate is an enterprise AI governance gateway for regulated industries. [Get a demo.]