Well, it's incredibly hard to scale fraud only through person-to-person communications. It's not impossible, but think about the scale that online communication would allow.

This has nothing to do with scaling. How do you picture that, some employee would broadcast sensitive information to a WhatsApp group, in order to reach as many others as possible at once?

The offense here is that no effort was done to keep records of the communication. It would have been ok to use WhatsApp if they somehow would have archived all communications. Records of communications have to be kept so that auditors can verify that no inside trading secrets were communicated to others, for instance.

Now I understand why some of the banks wanted people back in the office as soon as possible. Trying to support their commercial real estate bags is likely another.

The weird step for me is the expansion of regulatory authority from published memos, to all written communication like texts and chats. I get it and don't really object to the end result, but it seems like the law should be updated to match what society desires to be regulated, rather than just relying on a generous interpretation by regulators.

> it seems like the law should be updated to match what society desires to be regulated

This absolutely happens. Usually, however, the regulators are interpreting the law in a way that the legislators agree with. In those cases, there is no need for new legislation.

I wonder if handwritten notes, post-its, or marks on whiteboards are also subject to regulatory authority.

Yes they are, if you haven't taken care of keeping them out of sight of unauthorised other persons.

The law does not need extending. It is that for bank traders ALL communications must be kept.

> for bank traders ALL communications must be kept

One, not every securities professional trades at a bank. Two, this is not true for any of them. Broadly speaking, work-related written communications must be logged. But there is nuance and exception to that.

Not really. How on earth could that ever be implemented?

In person conversations could be required to be recorded with a portable voice recording device (like a tape deck or phone). Same for phone calls. The regulatory authorities exempt those communications for now, but it isn't clear that there is any kind of consistent standard / reasoning.

banks have CCTV cameras in office buildings that record (video) of customer-banker interactions.

any change to any banking system is then done via a banking order (payment order, deposit order, etc) and is documented and signed.

so there is plenty of trail evidence for each transaction with each customer