Written by: Luke Sobieraj, Founder & COO, Digital Colliers
The DHS story landed last week and most iGaming operators scrolled past it. They shouldn't have. Federal investigators are now formally requesting neighborhood Signal group chats as evidence in criminal matters. If your VIP hosts, trading desk, or risk team coordinate on Signal or WhatsApp, you're closer to a retention problem than you think. The subpoena doesn't care that the app was your ops team's personal choice. It cares that business decisions happened there.
Why this hits iGaming harder than most verticals
Gambling is a regulated-communications industry whether operators want to admit it or not. In the UK, the Remote Customer Interaction guidance has been in force since August 2022 and got expanded again in 2024. Affordability triggers kick in at £150 net deposits per rolling 30 days, which means your VIP team is making customer-facing judgements on money, harm, and continued play every single day. When a regulator asks how a specific decision got made on a specific player, the answer needs to sit in a system of record, not in someone's phone.
And the enforcement environment is not soft. Roughly 1 in 4 UK-licensed operators fails to achieve a satisfactory AML rating on first assessment. Penalties for the most serious AML breaches run up to 15% of gross gaming yield. If a subpoena or a Commission review pulls a thread and finds VIP decisioning happening in disappearing Signal messages, you have two problems: the underlying decision, and the fact that you cannot produce the reasoning behind it.
Policy without data plumbing is not a defence
Most operators I talk to have a written policy that says employees must use approved channels for work. Very few have the plumbing to enforce it or prove it. That gap is where the cost of inaction lives.
Here is the shape of what actually stands up under scrutiny:
- A single approved channel for VIP, trading, and risk conversations, with retention set to match your longest regulatory obligation, not your shortest.
- Server-side capture, not client-side. If retention depends on an individual's phone or an app setting they can toggle, it isn't retention.
- Every player-linked message tagged with the account ID it concerns, so the audit request "show me all internal comms about player X between these dates" is a query, not a two-week fire drill.
- Immutable storage with hash-chained writes, so you can prove nothing was edited after the fact.
- Access logs on the archive itself. Who read what, when.
None of this is exotic. It's the same pattern you already run for payments and game rounds. The difference is that most operators never extended it to human communications, because for years no one asked.
The shape of an IM retention data model
If you're scoping this internally, the data model is not the hard part. A workable schema has message events, participant events, attachment events, and a linking table to player and case IDs. Each message row carries channel, sender, timestamp, content hash, retention class, and legal-hold flag. Attachments go to object storage with the same hash reference. Legal hold is a boolean that overrides deletion regardless of retention class.
The hard part is the integrations. Slack Enterprise Grid, Teams, and compliant messaging vendors all expose export APIs. WhatsApp Business and Signal do not, by design. That's the actual decision point. Either you migrate the conversations to a channel that can be archived, or you accept that a category of your business communications is unrecoverable.
The operators shipping this well in 2026 are treating internal comms as first-class regulatory data. Same discipline as transaction records. Same query surface. Same retention horizon.
What the cost of inaction actually looks like
Run the numbers on a bad day. A regulator asks for 18 months of VIP team communications about a specific cohort of players. If you can produce them cleanly, you're arguing about the underlying decisions. If you cannot, you're arguing about whether you have a control environment at all. One conversation is expensive. The other is existential.
Kindred publicly reported £14M in compliance-team costs in 2023. That is the price of getting it broadly right. The price of getting it wrong shows up in headline fines, licence conditions, and the diligence questions every future partner and acquirer will ask you for the next five years.
The subpoena in the DHS story was for a neighborhood chat. The next one won't be.