At first, Lee Blackmore, director of information technology at Stifel Nicolaus, didn't want to see brokers sending instant messages. "When all those new SEC rulings came out last year, we started looking for solutions and our first inclination was not to open it up at all," he said. "Then we found out that a lot of our institutional traders use IM a lot, and they generate a lot of revenue."

He decided to go with a compliance and archive solution from IMLogic.

"IMLogic was probably the easiest fit for us," he said. "It's a SQL back end, we're a SQL shop. It was easy to install. We didn't have to do anything on the end user side of the fence-just find out what their screen name was if they were using Yahoo! or AOL or MSN."

The screen name is linked back to the employee's name and e-mail address, he said, but the company does not dictate the kinds of IM screen names employees can choose. In addition, there's no way to verify the identity of the person on the other end of the IM conversation, though Blackmore said his compliance department isn't worried about this aspect of IM yet.

"I brought up some of these issues myself," he said, adding that he hopes to see a federated identity model develop in which users' IM names are linked to their corporate identities.

He's not the only one.

As the instant messaging offerings of various vendors start to show signs of becoming more interoperable, Wall Street users have an important role to play. They need to ensure that the system that eventually develops allows for identity authentication.

By comparison, consider e-mail: a recent virus infected mailboxes and sent bogus e-mails that purported to come from innocent third parties by faking the "from" section of the message.

Today, users of public instant messaging (IM) networks create their own identities. In IM, a person can become "JSmith@BigCo" simply by signing up for a free AOL IM or MSN IM account. Does that make him the J. Smith that you know at Big Co.? Possibly, but you might still want to double check before entrusting your passwords and bank account numbers to him.

The key to ensuring identities is to link the IM handle that a person uses to a more definite identity, such as a corporate e-mail address, corporate directory listing or some other identifier like a smart card, said Kurt Gilman, principal at PricewaterhouseCoopers. One thing to avoid, he said, is creating an entirely separate system for tracking IM identities. "You don't want to create yet another silo," he said