The Paragraph 8.9 Line: What UK Law Firms Can and Cannot Do With WhatsApp

The line that decides everything

A firm's WhatsApp Business number sits on the same handset the senior partner uses to book restaurants. That single fact — one device, two audiences — is where most UK law-firm WhatsApp mistakes start, well before the SRA Code of Conduct opens the question of who the firm can message and how.

The SRA answers that question in one sentence. Paragraph 8.9 of the SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs reads: "You do not make unsolicited approaches to members of the public, with the exception of current or former clients, in order to advertise legal services provided by you, or your business or employer." Everything a firm can and cannot do on WhatsApp sits either side of that one carve-out. Sending a settlement update to a client mid-file is the paragraph's plain intent. Buying a list of accident-report contacts and messaging them a personal-injury pitch is precisely what paragraph 8.9 was written to stop, regardless of channel.

What paragraph 8.9 actually says (and doesn't)

The SRA's own guidance on unsolicited approaches, last updated 16 December 2019, expands the paragraph into practical terms. Prohibited: "direct or specifically targeted approaches to members of the public" made "in person, by phone or via other means which target them individually." Permitted: broadcast advertising — radio, TV, billboards, "online or on a social media platform," and leaflets distributed to all homes across a large area rather than picking targets from a list.

WhatsApp is not named in either the paragraph or the guidance. It cannot be — WhatsApp did not exist in a form the SRA would have contemplated when the language was drafted. But "other means which target them individually" is the operative phrase, and a direct message to a single person on any platform obviously targets them individually. The regulator has never had to write "WhatsApp" into the rule because the wording already covers it.

The consequence, once stated, is unambiguous:

• Messaging a current client, a past client whose file closed a year ago, or a family member of a client (with the client's authority) is expressly allowed.
• Cold outreach to a member of the public via WhatsApp is a breach of paragraph 8.9, whether the number came from a purchased marketing list, a public accident database, or a Facebook group scrape.
• "Warm" outreach based on a referral is a middle case: if the person contacted the firm first — even briefly — they are arguably not being approached unsolicited. If the firm is initiating, the referral does not launder the approach.

This single boundary settles roughly half of what messaging-app vendors tend to sell to law firms. Bulk broadcast to a "prospect list" is not a workflow question in the UK legal market; it is a regulatory line.

Client identification, and why WhatsApp is not a CDD channel

Once a client is engaged, the file has to be opened, and opening the file means Client Due Diligence under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Regulation 28, currently in force as amended on 18 November 2025, sets the minimum: identify the client, verify the client's identity, understand the ownership and control structure for legal persons, and conduct ongoing monitoring of the business relationship. The regulation explicitly accepts electronic identification processes that "meet security standards" as valid verification (Reg 28(18)-(19)).

Nothing in Regulation 28 requires face-to-face verification. That leaves electronic ID checks — provided by specialist electronic identification services — as a legitimate route, provided the process meets Regulation 28's standards and the firm's practice-wide risk assessment supports non-face-to-face onboarding.

But WhatsApp itself is not the verification. A client sending a photograph of their passport into a WhatsApp thread is not identity verification under Regulation 28 in any form; it is an image of an ID on a messaging channel. The verification happens in the electronic-ID system that reads the biometric zone against the source, or in the solicitor's own manual comparison of the passport to a live-linked identity check. WhatsApp can carry the request ("please upload your passport into the ID-check link") and the confirmation ("your ID check completed successfully"), but the compliance artefact sits in the ID-check system, not the WhatsApp thread.

The Legal Sector Affinity Group has published detailed AML guidance for the legal sector — the current 228-page version took effect on 23 April 2025 and is available as a PDF on the SRA's website. Firms doing regular AML-regulated work should read it in full; secondary summaries are not a substitute.

Accurate publicity — rule 8.8 meets the Transparency Rules

Paragraph 8.8 of the Code obliges every firm to ensure "any publicity in relation to your practice is accurate and not misleading, including that relating to your charges and the circumstances in which interest is payable by or to clients." A WhatsApp broadcast to a segment of past clients quoting a fixed fee for remortgage work is publicity, and it has to be accurate on the day it lands in the recipient's phone.

The SRA Transparency Rules, most recently amended and in force from 11 April 2025, add specific price-publication duties for named practice areas including residential conveyancing (Rule 1.3(a) covers freehold and leasehold sales and purchases, and mortgages/re-mortgages). Rule 1.5 requires firms to publish "the total cost of the service or, where not practicable, the average cost or range of costs," "the basis for your charges, including any hourly rates or fixed fees," experience and qualifications of the fee earners and their supervisors, disbursements and VAT treatment, and "details of what services are included in the price displayed, including the key stages of the matter and likely timescales." Rule 1.6 requires the information to be "clear and accessible and in a prominent place on your website."

The WhatsApp adjacency: any fee quoted in a WhatsApp message has to reconcile with the fee published on the firm's transparency page. A quick "£950 fixed for a straightforward remortgage" typed into a client thread creates an implied representation; if the transparency page says the average is £1,150-£1,350, the disparity is a breach exposure both under paragraph 8.8 and under the Transparency Rules themselves.

PECR, UK GDPR, and the "electronic mail" definition WhatsApp meets

Regulation 2 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 defines "electronic mail" as: "any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient and includes messages sent using a short message service."

The definition is broad by design. It was written when SMS was the primary use case, but its wording — "any text, voice, sound or image message… stored… until collected by the recipient" — describes WhatsApp on its face. A WhatsApp message is text or image or voice; it travels over a public electronic communications network (Meta's infrastructure); it is stored on Meta's servers and then in the recipient's device until the recipient opens it.

Regulation 22 then applies: "a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient has previously notified the sender of consent to such communications" (Reg 22(2), current in-force version 5 February 2026). The soft opt-in exception at Reg 22(3) permits marketing without fresh consent only where all three conditions hold: (a) contact details were obtained "in the course of the sale or negotiations for the sale of a product or service," (b) the marketing "concerns only that person's similar products and services," and (c) the recipient was given a simple, free refusal mechanism at collection and at every subsequent communication.

For a law firm, the practical readings:

• A WhatsApp update to a current client about their live file is not direct marketing at all — it's file service.
• A WhatsApp message to a past probate client offering a will-review service satisfies the soft opt-in test only if wills are the "similar service" to the probate they previously bought, and only if the client had a simple opt-out at collection.
• A WhatsApp to a purchased contact list fails the consent test outright and cannot fit the soft opt-in exception.

One more distinction matters for a law firm's mix of clients. PECR regulation 22(1) applies specifically to "individual subscribers" — the opt-in requirement above bites when the recipient is a natural person on a personal number. For direct marketing to a corporate subscriber (a company's business phone), PECR regulation 22's opt-in condition does not apply, though regulation 23 still requires the sender's identity to be disclosed and a working refusal address to be provided. The line between individual and corporate subscriber is not settled for sole traders and unincorporated partnerships — it turns on the specific arrangement and is safest resolved case by case rather than presumed. UK GDPR still governs any personal data of the individual behind the corporate contact. For residential conveyancing the client is almost always an individual and Reg 22 applies fully; for B2B advisory, corporate real estate, or commercial dispute work, the analysis shifts and needs to be run per contact type.

The ICO has not published guidance specifically identifying WhatsApp as an "electronic mail" channel under PECR at the time of writing, so the reading here rests on the primary text of Reg 2 rather than a regulator's specific instruction. A firm choosing a more conservative stance can treat all WhatsApp marketing as consent-only and avoid the interpretive risk entirely.

Client money — the one place WhatsApp cannot touch

The SRA Accounts Rules, effective from 25 November 2019, are payment-method-neutral in one direction and absolute in another. Rule 2.3 requires that "client money is paid promptly into a client account" unless one of three narrow exceptions applies (trustee-obligation conflict, Legal Aid Agency payment, or written alternative arrangement with the client). Rule 3 requires the client account to be at an English or Welsh bank or building society branch, in a name that includes the firm's name and the word "client," and prohibits using client accounts to provide banking facilities. Rule 12 requires an accountant's report within six months of the accounting period, unless the firm's client-money balances averaged under £10,000 and never exceeded £250,000.

Nothing in the Rules blesses a WhatsApp payment link. Client money — a deposit for a house purchase, funds on account for a litigation matter, settlement proceeds — must land in the firm's client account by a route that meets Rule 3's banking requirements. That is a BACS/CHAPS/Faster Payments transfer to the client account's sort code and number, or a cheque paid in to the same account. It is not "click the link" through a payment-service card processor.

A WhatsApp message telling a client "please transfer £X to our client account, sort code YY-YY-YY, account ZZZZZZZZ, reference [matter reference]" is fine — that's a payment instruction on a messaging channel, executed by the client's own bank. A WhatsApp message with an in-thread pay-now button to a merchant account is not fine for client money; the money would land in a card acquirer's holding account and reach the firm through a mechanism that does not meet Rule 3.

Fees for the firm's own account (bill settlement after billing) can, in principle, be collected via card payment; that is not client money. The distinction has to be operationally clear before any payment tool is introduced.

A conveyancing file, stage by stage

The SRA's own guidance on Transparency in Price and Service, last updated 30 September 2024, sets out the example key stages every firm should be publishing for a residential conveyancing matter: take instructions and give initial advice; check finances and contact the lender's solicitors if needed; receive and advise on contract documents; carry out searches; obtain further planning documentation if required; make enquiries of the seller's solicitor; exchange contracts and notify the client; arrange for all monies needed to be received; complete the purchase; deal with the application for registration at Land Registry.

Each stage has a client-facing wait window. The client sends the instruction and hears nothing until the initial-advice call. The firm submits the standard set of property searches and depends on turnaround from the searching bodies. Enquiries of the seller's solicitor create a ping-pong of Q&A that can run for weeks. The mortgage offer, controlled by the lender, sets the earliest possible exchange date. Between exchange and completion, the client is waiting for a specific date that depends on the entire chain moving in step. After completion, the SDLT return has to be filed within 14 days of the effective date (usually completion) per HMRC guidance published 26 June 2026, with penalties for late filing.

The CQS Client Charter, last updated 28 January 2025, is the Law Society's public promise on how a CQS-accredited firm behaves through those wait windows: "keep you informed of progress in your sale or purchase," "respond promptly to your enquiries," "tell you about any problems as soon as we are aware of them." Compliance with the charter is a matter of pace at each wait-point, not tools; the firm can meet it by email, phone or WhatsApp, and can breach it on any of them.

Where WhatsApp legitimately earns its keep on such a file:

• "Local searches submitted today. I'll message you the moment they land."
• "Enquiries have gone across to the seller's solicitor. Waiting on their file review."
• "Mortgage offer received — I've read it in full, no adverse conditions. Let's find a call slot to talk through the completion timeline."
• "Exchange has happened. Completion is set for [date]. I'll send SDLT confirmation on the day of completion."

Each of these is a status update on a live file to an already-engaged client — squarely inside paragraph 8.9's carve-out, and squarely the "keep you informed of progress" commitment the CQS Charter asks for. None of them is a marketing message; consent-under-PECR is not triggered because it is service to an existing matter, not direct marketing.

Costs and vendors — what Meta publishes, what it doesn't

Meta moved the WhatsApp Business Platform to per-message pricing on 1 July 2025 (previously conversation-based). Under the current model, businesses are only charged when a template message is delivered; utility templates sent inside an open customer service window — the 24-hour window that opens each time the client sends the firm an inbound message — are free; marketing and authentication templates are charged whether inside or outside the window. The UK marketing rate was raised effective 1 July 2026 (Meta's pricing update page confirms the change without quoting the new figure on that page).

Meta publishes the actual GBP rates as downloadable rate cards (CSV and PDF, per currency) rather than inline on the pricing page. The most current numbers live at developers.facebook.com/documentation/business-messaging/whatsapp/pricing — the rate-cards section links out to the specific CSV for GBP.

For a firm doing sensible-volume messaging to existing clients (updates, appointment reminders, document-ready notifications), the meaningful architecture question is not the per-message rate. It is: which messages are utility (paragraph-8.9-permitted service to a current client, sent inside a customer service window — the 24-hour window opened by each inbound message from the client → free) versus which are marketing (subject to PECR consent, no soft-opt-in shortcut for law firms in most cases, and charged per delivery). A firm whose WhatsApp usage is dominated by file-service updates in reply to client inbound messages will see very low platform bills. A firm trying to do outreach marketing will run into both a bigger bill and a bigger regulatory question at the same time.

What this rules out

The Code, the Rules, the Regulations and the Charter together rule out four specific patterns any UK firm should refuse before a vendor pitches them:

1. Bulk WhatsApp campaigns to a purchased or scraped list of prospects. Paragraph 8.9. Not fixable by consent forms after the fact.
2. Presenting a passport photograph in a WhatsApp thread as the CDD verification record. Regulation 28. The verification has to happen in an ID system with an auditable output.
3. Client money in via a WhatsApp pay-now link routed through a merchant account. Rule 3. Client money goes to the client account by a route the client account can receive.
4. Personal-phone WhatsApp accounts holding client conversations that cannot be exported into the file. The firm loses visibility of a channel that carries client-file communications, and the record leaves with the fee earner the day they resign.

None of these needs a written policy to notice. They should register as regulatory heat before the first client message is sent.

FAQ

Can we use WhatsApp for first-contact enquiries from prospects?

Yes — if the prospect contacts the firm first (through the website "start a chat" button, a click-to-WhatsApp link on a marketing page, or a direct message initiated by them), it is an inbound approach and paragraph 8.9's ban on unsolicited outreach does not apply. What the firm cannot do is take the phone number a prospect volunteered and later use it for marketing without meeting PECR 22's consent test.

Do we need consent to message current clients on WhatsApp about their file?

File-service messages — status updates, requests for documents, meeting confirmations — are not direct marketing under PECR and do not require PECR consent. Data protection still applies: the client's number is being processed for the purpose of providing the retained service, which is a lawful basis under UK GDPR. A short WhatsApp-usage clause in the engagement letter (channel choice, retention, what won't be sent by WhatsApp) closes the transparency point.

What about SMS reminders instead of WhatsApp?

SMS is explicitly named in PECR Reg 2's electronic-mail definition ("includes messages sent using a short message service"), so PECR 22 applies to SMS marketing in exactly the same shape. For file-service SMS to existing clients, PECR marketing rules are not triggered; UK GDPR still governs how the number is stored and used.

Are staff personal WhatsApp accounts acceptable for firm communications?

Not for client-file communications. Beyond the data-protection issues (the firm loses visibility of a processing channel it is meant to control under UK GDPR), a personal account means client conversations sit on a device the firm cannot recover when the fee earner leaves. The workable pattern is a firm WhatsApp Business account tied to a firm-owned number and integrated with the case management system so the messages are captured in the client file.

Where does SDLT filing fit in the WhatsApp workflow?

SDLT is a hard deadline: HMRC requires the return and any tax within 14 days of the effective date (usually completion). WhatsApp cannot file SDLT — that goes through HMRC's SDLT return process, submitted electronically by the conveyancer. WhatsApp can carry the client-facing confirmation ("SDLT return submitted on your behalf today; receipt attached") on the day of filing, and the reminder that the client will receive HMRC's official acknowledgement separately.