IM Gets Regulated

They're ephemeral and fleeting, but new regulations have just made instant messages a lot more permanent: The National Association of Securities Dealers Inc. (NASD) announced yesterday that financial services companies not only have to store emails, but also all IM correspondence for at least three years (see NASD Rules on IM).

The ruling, which follows similar guidelines posted on the New York Stock Exchange Inc. (NYSE) Website in March, represents a new interpretation of the 1997 Securities and Exchange Commission (SEC) Act Rule 17a-4, which requires all financial institutions to archive electronic records as they would paper records.

While the new rules are bound to cause headaches for financial institutions, which have been struggling through the past year of regulatory crackdowns to get their email compliant, analysts say it offers a huge opportunity for data storage and archiving companies.

"Definitely, this will expand their business," says The Radicati Group Inc. analyst Masha Khmargseva. "At this point, there are regulations that say these companies have to archive all electronic communications, but since it doesnt specify IM, a lot of them haven’t done it [for IM]."

According to Merrill Lynch & Co. Inc. analyst John Roy, financial institutions currently represent about 25 percent of all IT spending. "It will have a significant impact," he says. He adds, however, that since IM for the time being mostly consists of plain text, it will create less of a demand for additional storage than rules for archiving email have.Following the $1.4 billion SEC settlement with 10 once highly respected Wall Street firms in April 2003, storage companies have been tripping over each other to get their email archiving products out the door (see SEC, NY Settle With the Banks, Oregon Taps StorageTek for Email, Persist Packs Away Email and HP SAN-Blasts Email). Now, as financial institutions realize that they can get in as much trouble for not supervising and storing IM messages as they have for sloppy email policies, a whole new group of vendors is likely to prosper.

A day after the NASD announcement, IM software vendor IMlogic Inc. announced that its IMlogic IM Manager software for IM record retention and supervision supports the NASD regulations (see IMLogic Offers IM Compliance). "This is good news for us," says Jon Sakoda, the company’s director of products. "Within the financial services industry, there’ll be a rapid adoption of our technology."

IMlogic and competitors like Akonix Systems Inc., Communicator Inc., and FaceTime Communications Inc. offer software that captures the IM stream and archives it as searchable, logical conversations. The software can also block messages containing certain words, or can highlight messages containing the words.

Data storage and archiving vendors, too, have a lot to gain from the new ruling. The IM software vendors are already partnering with companies like KVS Inc., Educom TS Inc., Iron Mountain Inc., and Legato Systems Inc. (Nasdaq: LGTO) for longer-term storage of the IM data (see Legato Mines Iron Mountain and Iron Mountain Touts Compliance Services). The ruling requires companies to keep the data easily accessible for the first two years and archived for at least another year.

"It’s great!" says Margaret Rimmler, Iron Mountain's VP of marketing for enterprise solutions and services group, pointing out that the news was not unexpected. "Everybody’s going to moan that they have one more thing to worry about, but they really knew about already... This is just making it official."Meanwhile, Khmargseva points out that financial institutions are probably just the tip of the iceberg for these vendors. "There have been a lot of regulations around healthcare and government agencies," she says. "This is just beginning, I think."

— Eugénie Larson, Reporter, Byte and Switch