Governance and Operational Security of Business WhatsApp Group Portfolios: Administrator Lifecycle and Employee Offboarding

Full title: Governance and Operational Security of Business WhatsApp Group Portfolios: Administrator Lifecycle, Employee Offboarding, Brand Impersonation and Recordkeeping

Originally published on OSF: osf.io/g6hf9 · DOI: 10.17605/OSF.IO/G6HF9

Ivan Schroll

Independent Researcher, Brazil · ORCID: 0009-0007-0680-5570

Narrative review / technical report · October 2026 · Language: English · License: CC BY 4.0

Abstract

Organisations that use WhatsApp groups at scale rarely run one group. They run portfolios: dozens or hundreds of groups for customer communities, reseller and distributor networks, sales regions, support queues and internal teams, often created over years by different employees on different phones. This narrative review examines the governance and operational security problems that arise from such portfolios and compares the controls available in ordinary groups, in the WhatsApp Business app and in the Groups API of the WhatsApp Business Platform. It draws on WhatsApp Help Center documentation, WhatsApp business terms and policies, Meta developer documentation, enforcement actions by the United States Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC) on off-channel communications, guidance from the United States Cybersecurity and Infrastructure Security Agency (CISA), Meta's 2025 reporting on scam operations, and peer-reviewed research on workplace messaging and shadow IT. All sources were accessed and verified on 30 October 2026. Five structural risks are identified: groups owned by the personal account of whoever created them, administrator rights that outlive employment, account and device sprawl, brand impersonation aimed at the organisation's customers, and the absence of an organisation-level record of what happened in each group. The paper maps each risk to documented platform controls and to organisational measures, and proposes a portfolio register and an administrator lifecycle procedure. It reports no original data.

Keywords

WhatsApp; WhatsApp Business; group administration; offboarding; access governance; brand impersonation; recordkeeping; off-channel communications; shadow IT; B2B

1. Introduction

A company that starts using WhatsApp groups usually does so informally. A sales manager opens a group for key distributors; a support lead creates one for a large customer; a marketing team builds a customer community; an operations team coordinates shifts. Each decision is reasonable. After a few years the company has a portfolio that nobody can list in full, administered by people who may have changed roles or left, with no single view of who can post in the company's name to its customers.

Earlier reports in this series dealt with moderation governance, the legal position of administrators, account takeover, scams, member exposure and, in Paper 6, the data protection duties of business-run groups. This report focuses on the organisational control of the portfolio as a whole. It asks:

1. Which properties of WhatsApp groups create governance risks when groups are run by organisations rather than individuals?
2. What controls do ordinary groups, the WhatsApp Business app and the Business Platform Groups API document, and where do they stop?
3. What do recordkeeping enforcement actions and public guidance imply for organisations that use groups for regulated or sensitive communications?
4. Which organisational measures can close the gaps?

2. Background

2.1 Three ways to run a business group

Ordinary groups. Any account can create a group with up to 1,024 members (WhatsApp Help Center, n.d.-a). Administrators control who can edit group information, send messages, add members and share invite links, and whether new members require approval (WhatsApp Help Center, n.d.-b).

WhatsApp Business app. The Business app adds business profiles and, through Meta Verified for Business subscriptions, features such as multi-agent support (WhatsApp Help Center, n.d.-c). Groups created from a Business app account are still ordinary groups. Its terms state that the service may be used solely for business purposes and that it is "not intended for intra-company usage" (WhatsApp, n.d.-a).

Business Platform Groups API. Meta's Cloud API now supports groups created and managed by a business through the API. The documentation lists constraints: groups are invite-only through a link, participants cannot be added directly, the maximum is 8 participants per group, a business number can hold up to 10,000 groups, the feature requires an Official Business Account, and it is not available for Business app numbers. Some features such as disappearing messages, view-once messages and message editing are not supported. Supported operations include join request approval, invite link reset, removal of participants and settings changes (Meta for Developers, n.d.-a).

These are different products for different purposes. The API supports small, structured groups between a business and a few people, while large communities still live in ordinary groups and Communities.

One model is outlined in WhatsApp Business community.

2.2 Shadow IT and the origin of portfolios

Research on workplace use explains why portfolios grow without design. Abbas and Alghail (2021) found in interviews that employees used tools such as WhatsApp without approval from IT departments, mainly because the organisation did not provide suitable alternatives, and that this unmonitored sharing harmed knowledge protection. Mols and Pridmore (2020), studying employees from Dutch workplaces, describe WhatsApp as blurring boundaries by default and show employees adjusting features and devices to separate contexts. Both studies are small and qualitative, but they are consistent with a portfolio that begins on personal phones.

3. Method

3.1 Design

Narrative review and documentary analysis. No original data were collected.

3.2 Sources

• Platform documentation: WhatsApp Help Center articles on groups, admins, Communities, linked devices, multi-agent support, impersonation protection, disappearing messages, chat export and account security; WhatsApp Business app terms; the Business Messaging Policy; Meta developer documentation on the Groups API.
• Enforcement and guidance: SEC press release 2022-174, CFTC press release 8599-22, CISA mobile communications guidance (December 2024).
• Industry reporting by the platform operator: Meta's August 2025 announcement on scam centres and anti-scam tools.
• Research: peer-reviewed studies on workplace messaging, shadow IT and group exposure.

Each URL was opened on 30 October 2026. Statements that could not be traced to a source were removed.

3.3 Analysis

Risks were identified from documented platform behaviour, then mapped to platform controls and to organisational measures drawn from general access governance practice. Where no source supports a claim about platform behaviour, the paper says so.

4. Findings

4.1 Risk 1: the group belongs to whoever created it

The most important governance fact about WhatsApp groups is documented in a single sentence: the group creator "can't be removed and will remain an admin unless they exit the group" (WhatsApp Help Center, n.d.-d). The same page states that WhatsApp "can't interfere with group administration functions" (WhatsApp Help Center, n.d.-d). For Communities, admins can remove other admins but not the person who created the community (WhatsApp Help Center, n.d.-e; WhatsApp, n.d.-b).

In an organisation this means that a group created from an employee's personal number is, at platform level, partly controlled by that person for as long as they choose to stay. If the employee leaves on bad terms, the company cannot remove them, and WhatsApp states it will not intervene. The company's only options are to ask the person to leave, or to create a new group from a company-controlled account and migrate members, which in a customer community means asking each customer to join again.

The measure is simple to state: business groups should be created from accounts whose phone numbers belong to the organisation, and personal accounts should be added as admins, never as creators. Existing groups created by personal accounts should be listed and, where the risk justifies it, migrated.

What happens in practice is explained in what happens when a WhatsApp group admin leaves.

4.2 Risk 2: administrator rights that outlive the role

A group can have many admins, and any admin can promote others (WhatsApp Help Center, n.d.-b; WhatsApp Help Center, n.d.-d). Admins can change messaging permissions, edit the group description, approve or remove members and reset invite links (WhatsApp Help Center, n.d.-b). If the only admin leaves, WhatsApp chooses another member at random to become admin (WhatsApp Help Center, n.d.-b), which in a customer group could hand control to a customer.

Admin rights are not linked to any corporate identity system. When an employee changes role or leaves, nothing removes them from the groups they administer unless someone does it by hand, group by group. The result is predictable: former employees, agencies whose contract has ended and partners who changed company can keep the ability to post as an admin to the organisation's customers.

General access governance practice applies directly. Each admin assignment should have an owner, a reason, a start date and a review date; departures should trigger removal from every group in the register; and every group should have at least two company-controlled admin accounts so that no group falls to a random member.

The steps are in how to add, change or remove a WhatsApp group admin.

4.3 Risk 3: device and account sprawl

Admin rights attach to WhatsApp accounts, and each account can be used on several devices. A WhatsApp account can link up to four companion devices, and linked phones are logged out if the primary phone is not used for more than 14 days (WhatsApp Help Center, n.d.-f). On the Business app, the multi-agent feature included in some Meta Verified for Business plans allows up to 10 linked devices, lets the business assign chats to agents and shows which agent or device sent a message; customers cannot see which agent replied. If the subscription ends, only the four most recently active devices stay linked (WhatsApp Help Center, n.d.-c; WhatsApp Help Center, n.d.-g).

From a security standpoint, every linked device is a place from which group admin actions can be taken. WhatsApp's account security guidance lists two-step verification, passkeys, app lock and the option to review and unlink devices (WhatsApp Help Center, n.d.-h). For an organisation these features help only if someone is responsible for using them on every admin account. A device audit (which devices are linked to each company account, by whom they are used) belongs in the same periodic review as admin rights.

The multi-agent attribution feature is relevant to auditability: it allows a business to see which agent sent a message in Business app chats (WhatsApp Help Center, n.d.-c). This review found no documentation stating that this attribution extends to messages sent in ordinary groups from a Business app account, so organisations should not assume it does.

4.4 Risk 4: brand impersonation aimed at customers

A visible customer community tells fraudsters who the company's customers are and how the company talks to them. Meta reported in August 2025 that WhatsApp had banned over 6.8 million accounts linked to scam centres in the first half of that year, that scams often move victims across several apps, and that a request to pay upfront is a warning sign (Meta, 2025). The Business Messaging Policy prohibits businesses from impersonating another business (WhatsApp, n.d.-c), but policy does not prevent a fraudster from creating a lookalike account.

The platform offers some defences. Meta Verified for Business includes impersonation protection, under which WhatsApp monitors for and removes accounts impersonating a protected business; the Help Center lists the plans in which this applies and allows reports of username impersonation (WhatsApp Help Center, n.d.-i). In groups, the measures that reduce exposure are organisational: restricting who may send messages so that announcements can only come from admins (WhatsApp Help Center, n.d.-b), publishing in the group description the official numbers and the payment channels the company uses, telling customers that the company will never ask for payment through a new number, and limiting how widely member lists are exposed (see Paper 6). Paper 4 in this series covers scam mechanics and payment fraud in more detail.

A practical guide is how to prevent scams in WhatsApp groups.

4.5 Risk 5: no organisational record

Ordinary groups are end-to-end encrypted conversations held on members' devices. The organisation has no server-side archive and no log of admin actions. WhatsApp offers chat export, which produces a text file (with or without media) that cannot be imported back into WhatsApp (WhatsApp Help Center, n.d.-j). Disappearing messages can be enabled per group for 24 hours, 7 days or 90 days, admins can restrict who changes the setting, and individual messages can be kept so that they do not disappear (WhatsApp Help Center, n.d.-k; WhatsApp Help Center, n.d.-a). Disappearing messages therefore reduce what accumulates in the group but are not a guaranteed deletion mechanism.

Two objectives pull in opposite directions. Data protection favours keeping less (Paper 6). Recordkeeping obligations, where they exist, require keeping more. The clearest public example of the second is in United States financial regulation. In September 2022 the SEC announced charges against 15 broker-dealers and one affiliated investment adviser, with combined penalties of more than 1.1 billion dollars, for failures to preserve electronic communications. The SEC stated that employees, including supervisors, communicated about business on personal devices using text messaging and apps such as WhatsApp from at least January 2018 through September 2021, that the firms did not maintain or preserve the substantial majority of these communications, and that firms agreed to retain compliance consultants (SEC, 2022). On the same day the CFTC announced orders against 11 financial institutions with more than 710 million dollars in penalties for recordkeeping and supervision failures involving unapproved communication methods, including WhatsApp (CFTC, 2022).

These actions concern regulated financial firms in the United States, not group administration in general. They are relevant because they show the consequence of business communications happening in channels the organisation does not capture. A company subject to sector recordkeeping rules that lets staff discuss business with clients in WhatsApp groups faces the same structural issue.

Security guidance pulls in a third direction. CISA's 2024 guidance for highly targeted individuals recommends end-to-end encrypted messaging (CISA, 2024). Encryption protects content from interception but does not, by itself, give the organisation a record.

4.6 Internal team groups

Internal coordination is the most common use and the one least covered by the terms. The WhatsApp Business app terms state that the service is "not intended for intra-company usage" (WhatsApp, n.d.-a). Ordinary accounts are governed by consumer terms. In either case the organisation has none of the controls normally attached to workplace tools: account provisioning, central removal, retention settings or audit. Mols and Pridmore (2020) also show the cost to employees of always-available messaging. For internal communication, organisations should consider whether a workplace tool under their own administration is more appropriate, and, where WhatsApp groups remain in use, apply the register and lifecycle measures below.

4.7 Comparison of options

Sources: WhatsApp Help Center (n.d.-a, n.d.-b, n.d.-c, n.d.-d, n.d.-f, n.d.-g); Meta for Developers (n.d.-a). The row on organisation-level record for the API reflects the general architecture of API integrations, in which the business's system sends and receives messages; it is the author's inference and should be checked against the business's own integration.

4.8 Where tools fit

Third-party group management tools, including the one founded by the author, typically connect to one or more WhatsApp accounts and apply rules across many groups: entry filters, removal of inactive members, scheduled messages and logs of the actions the tool takes. Such tools can make a portfolio visible and can enforce consistent settings, but they act with the permissions of the connected account and cannot override platform limits. They cannot remove a group creator, see groups in which the connected account is not a member, or recover messages sent before they were connected. They also add a supplier to the processing chain, which needs a contract and a place in the data protection record (Paper 6).

Examples of work that can be handed to a tool are in 9 tasks a WhatsApp group admin should delegate, and the business case is in WhatsApp group automation for business.

5. Discussion: a portfolio register and admin lifecycle

The five risks share a cause: groups are created as personal objects and used as corporate assets. The measures below translate common access governance practice to WhatsApp groups. They are proposals, not tested standards.

Portfolio register. One entry per group or Community, with: name and purpose; business owner; creating account and whether its number is company-controlled; list of admin accounts and the person behind each; membership type (customers, partners, employees); settings (who sends, who adds, approval on or off, disappearing messages); recordkeeping or deletion rule; date of last review.

Creation rule. New business groups are created only from company-controlled numbers and registered at creation.

Minimum admin set. At least two company-controlled admin accounts per group, so the random-admin rule never applies.

Joiner, mover, leaver. Admin rights granted on request with a reason; reviewed when people change role; removed from every group in the register on departure, on the same day as other access is removed. For agencies and partners, admin rights end with the contract.

Device and account hygiene. Two-step verification and app lock on every admin account; periodic review of linked devices; Business app multi-agent features where staff share an account.

Customer-facing safeguards. Messaging restricted to admins in announcement groups; official numbers and payment methods stated in the group description; an internal route for customers to report suspected impersonation; impersonation protection where the organisation subscribes to it.

Records decision. For each class of group, a written decision on whether the group is a channel of record (export on a schedule and store under a retention rule) or an ephemeral channel (disappearing messages on, no business commitments made there). Regulated firms should check that decision against sector rules before allowing client communication in groups.

Annual review. Reconcile the register against the groups the company accounts actually belong to; migrate groups created by personal accounts where the risk justifies the cost.

6. Limitations

• No primary data. The paper does not measure how often the risks occur.
• Documentation, not testing. Platform behaviour is taken from help pages and developer documentation, which can change and may differ by region and app version. The author did not test the features.
• Narrow enforcement base. The SEC and CFTC cases concern United States financial firms and may not transfer to other sectors or countries.
• Inference. Some measures are adapted from general access governance practice and have not been evaluated for WhatsApp specifically.
• Author position. The author founded a group management tool, and the review is not systematic.

7. Conclusion

WhatsApp groups were designed around people, not organisations. A creator cannot be removed, admins are not linked to employment, devices multiply, the brand's customers are visible to whoever joins, and there is no organisational record. The WhatsApp Business app and the Business Platform address some of these points, the Business app through multi-agent support and impersonation protection, and the Groups API through business-owned groups, but the API is limited to small groups, and the largest business communities remain ordinary groups. For those, governance depends on decisions the organisation makes outside the app: which number creates the group, who is admin and for how long, and whether the group is a channel of record. Empirical work measuring how companies actually manage these portfolios would help test the measures proposed here.

Competing interests

The author is the founder of 9bot, a WhatsApp group management tool discussed in this paper. 9bot is independent and is not affiliated with, endorsed by or a partner of WhatsApp or Meta. No funding was received for this work.

Data availability

No new data were generated or analysed. All sources are publicly available at the addresses listed below.

License

This work is distributed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

References

Abbas, J., & Alghail, A. (2021). The impact of mobile shadow IT usage on knowledge protection: An exploratory study. VINE Journal of Information and Knowledge Management Systems, 53(4), 830-848. https://doi.org/10.1108/VJIKMS-08-2020-0155

CFTC. (2022, September 27). CFTC orders 11 financial institutions to pay over $710 million for recordkeeping and supervision failures for widespread use of unapproved communication methods (Release No. 8599-22). Commodity Futures Trading Commission. https://www.cftc.gov/PressRoom/PressReleases/8599-22

CISA. (2024). Mobile communications best practice guidance. Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf

Meta. (2025, August 5). New WhatsApp tools and tips to beat messaging scams. Meta Newsroom. https://about.fb.com/news/2025/08/new-whatsapp-tools-tips-beat-messaging-scams/

Meta for Developers. (n.d.-a). Groups API. WhatsApp Business Platform documentation. https://developers.facebook.com/docs/whatsapp/cloud-api/groups/

Mols, A., & Pridmore, J. (2020). Always available via WhatsApp: Mapping everyday boundary work practices and privacy negotiations. Mobile Media & Communication, 9(3), 422-440. https://doi.org/10.1177/2050157920970582

SEC. (2022, September 27). SEC charges 16 Wall Street firms with widespread recordkeeping failures (Press Release 2022-174). U.S. Securities and Exchange Commission. https://www.sec.gov/newsroom/press-releases/2022-174

WhatsApp. (n.d.-a). WhatsApp Terms for WhatsApp Business App. https://www.whatsapp.com/legal/WhatsApp-Terms-for-WhatsApp-Business-App

WhatsApp. (n.d.-b). Managing roles for multi admin communities. https://www.whatsapp.com/communities/learning/rolesformultiadmincommunities

WhatsApp. (n.d.-c). WhatsApp Business Messaging Policy. https://business.whatsapp.com/policy

WhatsApp Help Center. (n.d.-a). How to create and invite into a group. https://faq.whatsapp.com/3242937609289432

WhatsApp Help Center. (n.d.-b). How to change group admin settings. https://faq.whatsapp.com/526742385997912

WhatsApp Help Center. (n.d.-c). About multi-agent. https://faq.whatsapp.com/395911122612120

WhatsApp Help Center. (n.d.-d). How to manage group admins. https://faq.whatsapp.com/633713745095781/?locale=en_US

WhatsApp Help Center. (n.d.-e). How to manage community admins. https://faq.whatsapp.com/441425088132574/?locale=en_US

WhatsApp Help Center. (n.d.-f). About linking WhatsApp to a second phone. https://faq.whatsapp.com/1046791737425017

WhatsApp Help Center. (n.d.-g). How to link a device with QR code on the WhatsApp Business app. https://faq.whatsapp.com/878854700132604

WhatsApp Help Center. (n.d.-h). Account security tips. https://faq.whatsapp.com/1095301557782068

WhatsApp Help Center. (n.d.-i). About impersonation protection for Meta Verified for Business on WhatsApp. https://faq.whatsapp.com/867277266259595

WhatsApp Help Center. (n.d.-j). How to export your chat history. https://faq.whatsapp.com/1180414079177245

WhatsApp Help Center. (n.d.-k). How to turn disappearing messages on or off in a group. https://faq.whatsapp.com/515705483748188

All URLs were accessed and verified on 30 October 2026.

Learn more about 9bot

9bot is a paid WhatsApp group management tool with a 7-day trial. It is an independent product and is not affiliated with or endorsed by Meta or WhatsApp. Visit 9bot.com.br to see how it supports group administrators.