CRM for market makers and trading firms: a counterparty record the firm actually owns

Ask a desk head where the firm's counterparty list lives and the honest answer is usually a set of Telegram chats on two or three phones. The firm owns the inventory, the capital, the legal entity, and the risk. The record of who it trades with, what was agreed, and who introduced whom sits in a trader's personal account, or in a vendor's cloud under terms the firm never negotiated.

Crypto already has a phrase for this. Not your keys, not your coins: an asset you cannot move, export, or prove without someone else's permission is not fully yours. The record works the same way. If the history of a counterparty relationship exists only inside a messenger account the firm does not control, the firm is borrowing its own memory, and it gets it back on the lender's terms: when the trader stays, when the app keeps running, when the vendor's policy does not change.

This page is about what owning that record takes for a crypto market maker, a prop or quant trading firm, or an OTC desk: why the record is an asset, which deal terms only exist in chat, what changes when those chats become evidence, which retention rules reach you through your counterparties even if you are offshore, why account takeovers make a written history a security control, and who controls the record once it exists. For how BD itself runs across market makers, OTC, funds and allocators, see Telegram CRM for crypto; this page is the ownership question underneath it.

OTC crypto grew up on chat. In 2018 Reuters described desks that negotiated block trades over Skype, some moving more than $100 million a day with minimum tickets of $75,000 to $250,000; Cumberland explained the choice plainly, “We needed a tool that was global and more or less free,” and Genesis said it recorded its trader-client chats (Reuters via Investing.com, 2018). The firms that recorded had a history. The rest had memories.

Execution has since moved onto platforms, but chat never left. Cumberland was trading by voice, chat, its Marea platform, and API, around the clock, by 2019 (The Block, 2019). Wintermute describes its NODE platform as reachable “alongside FIX API or chat,” with weekly OTC volume above $2 billion by late 2023 (Wintermute, 2023 review). The order may arrive by API; the relationship that produced it still runs through messages.

Now look at what happened to the history. Skype shut down on May 5, 2025, and users were told to export their data (Gulf News, 2025). Every desk whose 2018 counterparty conversations lived there kept them only if somebody took the export. At the far end of the spectrum, John J. Ray III's first-day filing in the FTX bankruptcy described staff told to use apps that auto-deleted messages and a near-absence of lasting records of decisions, and Bahamian liquidators warned that some records would expire after 60 days (Decrypt, 2022).

A desk treats its inventory and its keys as assets with custody, controls, and a plan for when a person leaves. The counterparty record deserves the same treatment, because it is the thing a new trader needs on day one and the thing a dispute is decided on.

A common token market-making structure is the loan and call option: the project lends the market maker tokens, typically 1–5% of supply for 12 to 24 months, and the market maker receives call options at tranched strike prices it can exercise instead of returning the tokens (Arrakis; Tokenomist). Around that sit the KPIs: spread, depth on named venues, uptime, reporting. The signed agreement holds the headline numbers. The working terms drift in chat.

Here is the dispute that drift produces. Six months into an engagement, the project's new BD lead writes: the second-tranche strike was never moved, and depth on one venue was never meant to count toward the KPI. Your trader remembers both points differently. The changes were agreed in a Telegram group the project's previous BD lead created, a week after the token generation event slipped, in a run of messages between four people, two of whom have since changed handles. What the desk can produce is whatever is still on one trader's phone, if that trader is still at the desk.

A record that would settle it has three properties: it was captured on the desk's side when the words were written, it attributes each group message to the human who sent it (not to “someone in the group”), and the agreed change sits next to the thread as a note on the deal, where the next person can find it. That is ordinary bookkeeping applied to the place the terms actually moved.

The wider market is not short of disputes about who agreed what. Movement Labs allocated 66 million MOVE, about 5% of supply, to an intermediary, Rentech; wallets linked to Rentech and Web3Port withdrew $38 million the day after the December 9, 2024, listing, Coinbase suspended MOVE on May 1, 2025, and the project suspended a co-founder (Decrypt, 2025). Trust is already thin: a 2025 survey of more than 2,000 respondents, commissioned by a market maker, found 52% did not trust market makers and 67% said more transparency would help (LO:TECH, 2025). In that climate, the desk that can show its own contemporaneous record is the one that gets believed.

In October 2024 federal prosecutors in Massachusetts announced charges against eighteen individuals and entities after an operation in which the FBI created its own token, NexFundAI. Market makers Gotbit, ZM Quant, CLS Global, and MyTrade were among those charged, and more than $25 million in crypto was seized (US Attorney's Office, D. Mass., 2024). According to the charging documents as reported, a ZM Quant executive discussed the arrangement in a Telegram group named “AI Token MM” (Decrypt, 2024). The counterparty on the other side of that group was the FBI. Charges are allegations, and this page takes no view on any case.

The narrower point applies to every honest desk. Every chat has at least two copies, and the other copy belongs to someone whose interests are not yours: a counterparty, that counterparty's compliance archive, an exchange, a litigant, an investigator. When a conversation is later read back in a dispute, an audit, or an inquiry, it will be read from their copy whether or not you kept yours.

Keeping your own record is not about hiding anything; it is the opposite. It means that when a claim is made about what your desk said, you can check it against your own contemporaneous version, with the people correctly identified and the context around the quoted line. A desk that relies on memory and a counterparty's export is answering questions about its own conduct from someone else's file.

Each regime below binds licensed or registered firms. A principal trading firm incorporated offshore and not licensed anywhere may sit outside every one of them. Its counterparties often do not: the exchange it quotes on, the broker it clears through, the lender, the fund, the regulated OTC desk on the other side of a block. Their duty to record and keep business communications covers the chats they have with you, which means a Telegram thread with a regulated counterparty can sit in their archive for five to eight years, and can be produced to their regulator from their side.

The US enforcement record shows how seriously that duty is taken. In September 2022 the SEC brought actions totaling more than $1.1 billion against 16 firms and the CFTC more than $710 million against 11 of them, for business conducted over WhatsApp and text that was not preserved (CFTC, 2022). In August 2024 the SEC added $392.75 million against 26 firms (ThinkAdvisor, 2024), and in January 2025 $63.1 million against 12 more, including $12 million from Blackstone and $11 million from KKR, bringing the total since December 2021 to more than 100 firms and more than $2 billion (SEC, 2025). Enforcement has slowed since, but the SEC declined in April and June 2025 to soften the earlier settlements (Simpson Thacher, 2025). In the UK the duty reaches individuals too: the FCA fined Jefferies banker Christopher Niehaus £37,198 in 2017 for sharing client-confidential deal information over WhatsApp (FCA final notice).

Two practical consequences. First, when a regulated counterparty's compliance team asks for the chat trail behind a trade, they already hold their half; the useful thing you bring is yours. Second, if your firm is itself licensed in any of these places, these rules need a compliance archive with retention policies, legal hold, and an audit trail. Pantheon is a relationship record, not a regulatory archive, and it does not claim to meet any of the obligations in this table. The table is here so you know who is keeping your conversations, and for how long.

The most expensive message a trading firm receives this year will probably come from someone it already knows. The pattern is consistent across incidents. On September 11, 2024, someone at Radiant Capital received a Telegram message from what appeared to be a former contractor, with a zipped PDF that carried malware; about $50 million was taken on October 16, in an attack attributed to North Korea, tracked by Mandiant as UNC4736 (The Defiant). In June 2025 Hypersphere partner Mehdi Farooq described a contact's hacked Telegram booking a Calendly call that led to a fake “Zoom update” and six emptied wallets (ForkLog, 2025). A security researcher's alert put losses from the hijacked-Telegram, fake-Zoom pattern above $300 million, with Emblem Vault losing $100,000 on April 14, 2025 (crypto.news). In February 2026 Google's Mandiant described UNC1069 combining hijacked Telegram accounts, spoofed Zoom meetings, AI-generated video, and “ClickFix” prompts across seven new malware families (Decrypt, 2026).

The scale case is Bybit: about $1.5 billion on February 21, 2025, attributed by the FBI to North Korea's TraderTraitor, after a Safe developer's Mac was infected on February 4 (SecurityWeek, 2025). Impersonation of trading firms runs the other way too: a Zoom deepfake of Binance's communications chief was used to sell listings (Gizmodo), and California's regulator recorded a victim who sent more than $167,000 to a fake Wintermute site (California DFPI).

A relationship system does not stop malware, and Pantheon does not detect takeovers for you. What a complete history does is put the right questions in front of the person about to click. A practice worth writing into the desk's playbook:

• When did we last actually speak? A contact dormant for fourteen months whose first message is a meeting link is a different risk from a counterparty you spoke to yesterday.
• Has this person ever sent a link like this? If three years of history contain no Calendly links, the first one deserves a second look.
• Is it the same account? Check the handle and number against the ones already on the counterparty's record, not the display name.
• Confirm on a second channel you already hold. If the record shows their WhatsApp number from last year's settlement thread, ask there before joining.
• Never install anything mid-call. No legitimate counterparty needs you to update a meeting client to keep talking.

Every item on that list depends on one thing: a history of the relationship that lives somewhere other than the account that may have just been taken over.

Firms often ask where their data is stored. The more useful question is who controls it. Under the US CLOUD Act, US authorities can require a provider subject to US jurisdiction to produce data in its possession, custody, or control “regardless of whether” it is stored inside or outside the United States (18 U.S.C. § 2713). Law follows the controller, not only the server. Under oath before a French Senate inquiry on June 10, 2025, Microsoft France's legal director said he “cannot guarantee” French public-sector data would be protected from a US request, while adding that none had been made (heise, 2025).

This is not an argument for being out of reach of courts. A trading firm should expect lawful process wherever it operates, and should want to answer it properly. It is an argument for knowing, in writing, which entity controls your counterparty record, under which law, and who must respond to an order, so that the party answering is the firm and not an employee's personal messenger account or a vendor nobody vetted.

Jurisdiction also moves. Proton, long associated with Switzerland, has begun moving infrastructure out of the country (its Lumo assistant to Germany, with Norway planned) over a proposed revision of the Swiss surveillance ordinance, VÜPF, that would add six-month metadata retention and user identification for services above 5,000 users (heise; CyberInsider). The lesson is not which country is safe. It is that the choice is ongoing: pick a controlling entity and a location deliberately, write the decision down, and re-check it when the law changes.

Ownership also means the terms that govern the record cannot be rewritten under you. Three recent examples. In May 2024 Slack's privacy principles allowed customer data to be used for its machine-learning models, and opting out required a workspace admin to send an email (The Register, 2024). In August 2023 Zoom rewrote section 10.4 of its terms after a backlash over language read as permitting AI training on user content (UC Today, 2023). On September 23, 2024 Telegram changed its privacy policy to allow disclosing users' IP addresses and phone numbers in response to valid court orders (Security Affairs, 2024).

None of these is scandalous on its own. Each is a reminder that a desk's counterparty notes, sitting inside someone else's product, are governed by a document the desk did not write and will not be asked about when it changes. Tools also end: Skype did, and the export window was the only exit.

The practical defenses are dull and effective. Know which vendor policies touch counterparty data and who in the firm reads the change notices. Have an exit plan before you need it: what you would export, in what format, and where it would go. In the EU, the Data Act's cloud-switching provisions, which apply from September 12, 2025, give customers rights to switch providers and take their data with them (European Commission); everywhere else, the right is whatever your contract says, so read it.

Telegram is where much of this business happens, and it is not going anywhere. It passed a billion monthly users in March 2025 (TechCrunch, 2025), and a 2024 CoinGecko community survey ranked it the second crypto social platform at 21.5%, behind X at 41.7% (CoinGecko, 2024). Nobody on a desk should be asked to stop using it.

But a messenger is a channel, not a record. Telegram's cloud chats and all group chats use client-server encryption; only one-to-one Secret Chats are end-to-end encrypted (Telegram FAQ). So the history of almost every counterparty group a desk is in is held by Telegram, under Telegram's policies, reachable through whichever personal account happens to be in the group. Lose the phone, the account, or the employee, and the firm's access to that history goes with them.

The channel also does not know that the person in the Telegram group, the WhatsApp number on the settlement thread, the iMessage from the conference, and the X/Twitter DM are the same counterparty. It cannot hold the agreed strike change as a note on a deal. It cannot tell a new trader who introduced this fund, or which of four people in the group actually agreed the KPI. Those are jobs for a record that sits beside the channels, owned by the firm, which is the gap a CRM for trading firms has to fill without asking anyone to change where they talk.

Once the record exists, a desk will want to ask it questions: what did we agree with this project about tranche two, which counterparties have gone quiet since the listing, what did this fund say the last time it asked for a quote on size. That means an AI model reads counterparty conversations. Which model, under whose terms, is a decision the firm should make, not one a vendor makes for it.

Pantheon lets you bring your own AI: choose ChatGPT, Claude, Grok, or a model from Hugging Face, and Milo, Pantheon's assistant, answers over your own chats with the model you picked. Milo recalls what a counterparty said, summarizes a long group thread, and reminds you who you owe a reply. Your data is never sold, and it is not used to train third-party models.

The reason this matters for a trading firm is the same reason the Slack and Zoom examples matter: the terms that govern a model's access to your data belong to whoever chose the model. A desk that already has an approved AI provider, or a policy about which providers may see client information, can keep that policy instead of inheriting a vendor's.

Pantheon builds the counterparty record from the conversations your firm is already having. You connect your own Telegram, WhatsApp, iMessage, and X/Twitter accounts: no bot added to counterparty groups, no browser extension. History backfills from the conversations already on the account, so the record starts populated rather than blank, and Pantheon runs on the web platform and desktop, with mobile on iOS and Android through private access.

What you get today:

• One record per counterparty across Telegram, WhatsApp, iMessage, and X/Twitter, with handles and numbers resolved to the same person when they move channels or change usernames.
• Group chats attributed message by message to the person who sent them, so “who agreed the strike change” has an answer.
• Contacts, companies, deals, and notes beside the conversations, and search across the full history.
• Bring-your-own AI with Milo for recall, summaries, and follow-up reminders over your own chats.
• No keys, no wallets. Pantheon touches neither; it is the record, not a trading tool.

Where it runs: data is hosted outside the United States today. Teams with specific residency requirements, including US-based teams that need their data held in the US, can reach out to us to discuss it. For larger firms, deployment is custom and by arrangement: fully managed, partially managed, or fully yours on your own dedicated bare-metal servers. Write to enterprise@pantheon.run.

What is next: shared team workspaces, with SSO and isolated-tenant deployments, provisioned through guided onboarding. SOC 2 and ISO certification are on our roadmap; Pantheon is not certified today and does not say otherwise. Today a workspace connects one Telegram account, so a desk running several Telegram accounts runs several workspaces. Pantheon is in alpha. Our current posture is on the security page.

An illustration most desk heads will recognize. A senior OTC trader gives notice on a Friday. Over three years they have built the desk's relationships with a dozen funds and two exchanges, almost entirely in Telegram, from their personal account. On Monday the account leaves with them, and with it every thread, every group where they were the desk's only member, and the context nobody wrote down: which fund wants a call before anything large, which exchange contact actually decides, what was promised on fees in March. The counterparties now hear from a stranger, and some of them start hearing from the departed trader at a new firm.

The fix is mostly policy, and it starts before anyone resigns:

• Firm-owned accounts for firm business. The desk's Telegram and WhatsApp numbers belong to the firm, so the account and its history stay when the person goes.
• A record organized by counterparty, not by trader. The handover question is “what is the state of each relationship,” not “what is on this phone.”
• Terms written next to the thread. A note on the deal survives a resignation; a memory does not.
• A handover read. Before the last day, walk the recent history of each counterparty with the successor.
• Tell counterparties on a channel they already trust. Announce the new contact from a known account; it also makes later impersonation of the departed trader harder to pull off.

Pantheon supports the record-side half of this today: a firm that connects firm-owned accounts to a workspace it holds keeps that history when people move. Shared team workspaces, where several traders work one firm record with SSO, are next. If you are planning an offboarding policy around that, talk to us about timing.

Questions to put to any vendor, including us. The right-hand column is Pantheon's honest answer today; where the answer belongs to your compliance stack instead, it says so.