FCA Record Retention Requirements: Periods, Formats, and Penalties

FCA record retention requirements set the minimum periods that firms authorised by the Financial Conduct Authority must keep their regulated business records. Most records must be kept for at least five years. Some — notably records tied to pension transfers, pension conversions, pension opt-outs, and free-standing AVCs — must be kept indefinitely. A few sit between those two poles, including Statements of Responsibilities under the Senior Managers and Certification Regime (ten years, or six for large non-directive insurers) and telephone recordings, which run to five years but can be extended to seven at the FCA’s request.

Retention Periods at a Glance

MiFID business records, appropriateness assessments, complaints, and financial promotions: at least five years.¹²
Suitability assessments for insurance-based investment products: at least five years, or the duration of the client relationship, whichever is longer.¹
Telephone and electronic communications relating to client orders: five years, extendable to seven years at the FCA’s request.³
Anti-money laundering customer due diligence records: five years from the end of the business relationship or the completion of an occasional transaction, capped at ten years.⁴
Statements of Responsibilities under SMCR: ten years from the date superseded (six years for large non-directive insurers).⁵
Client agreements for pension transfers, pension conversions, pension opt-outs, and free-standing AVCs: indefinitely.²
Any record connected to an active complaint, investigation, or litigation: until the matter is fully resolved, even if the standard period has expired.

The Five-Year Baseline

Five years is the default across the FCA Handbook. SYSC 9.1.2R requires common platform firms to retain all records kept in relation to MiFID business for at least five years, covering client orders, transactions executed, and services provided.¹

The same five-year period applies to appropriateness assessments and the information gathered to make them,⁶ to friendly society life policy recommendations (running from the date of the recommendation), and to information provided during the term of a life insurance contract (running from the date the information was given).²

Complaint records fall under the same clock. DISP Schedule 1 requires firms to record each complaint received, the investigation conducted, and the measures taken to resolve it, and to retain that record for five years from receipt.⁷

Financial promotions carry the same baseline. COBS Schedule 1 prescribes five years for records relating to non-mass market investment certifications, restricted mass market investment consumer journeys, and risk summaries.² Where a promotion requires approval notification to the FCA — cryptoasset promotions and non-mass market investments in particular — the retained record must include the details in SUP 16.31.6R: the investment name, the kind of investment, the date of approval, the medium of communication, and the identity of any unauthorised person who prepared the content.⁸

The trigger for the five-year clock varies. It is usually the date the record was created, the transaction was completed, or the assessment was made. When you handle multiple sourcebook obligations, check the retention table in COBS Schedule 1 for the exact starting point.

Records That Run Longer Than Five Years

Indefinite Retention for Pension Records

Client agreement records relating to pension transfers, pension conversions, pension opt-outs, and free-standing additional voluntary contributions must be retained indefinitely. Most other client agreements need only be kept for the duration of the relationship, but COBS Schedule 1 carves out these pension categories with no time limit.² Pension mis-selling complaints can surface decades after the original advice, which is why the retention obligation never expires.

Ten Years for SMCR Statements of Responsibilities

Under the Senior Managers and Certification Regime, firms must keep each version of a Statement of Responsibilities for ten years from the date it was superseded. Large non-directive insurers have a shorter obligation of six years. The FCA can ask for any prior version during that window, so overwriting or losing an older version creates a compliance gap of its own.⁵

Records Tied to a Live Dispute

Any record connected to an active complaint, investigation, or litigation must be retained until the matter is fully resolved, whatever the standard period would otherwise say. Destroying records while a dispute is running is one of the fastest ways into regulatory trouble.

Suitability Records for Insurance-Based Investments

For insurance-based investment products, the suitability record must capture the result of the assessment, the recommendation, and any later changes to the client’s risk tolerance or the underlying investment assets. These records must be kept for at least the duration of the client relationship, which in practice runs well beyond five years.⁹

Telephone and Electronic Communications

Firms subject to SYSC 10A must record telephone conversations and electronic communications connected to receiving, transmitting, and executing client orders. The standard retention period is five years, but the FCA can require a firm to hold recordings for up to seven years.³

Clients must be told that recordings will be available to them for five years on request, and to the FCA for up to seven. Coverage is not limited to traditional phone calls: any business-relevant communication on a captured channel falls in scope, and the FCA has confirmed that recordings from video conferencing software can stand in for written minutes in certain contexts, carrying the same retention obligation.¹⁰

Anti-Money Laundering Records

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 sit alongside the FCA’s rules with their own retention regime. Regulation 40 requires firms to keep copies of all customer due diligence documents and supporting records sufficient to reconstruct any transaction.⁴

The period is five years, running from the date the firm knows or has reasonable grounds to believe an occasional transaction is complete, or from the end of the business relationship. There is a hard ceiling of ten years. Once the period expires, the firm must delete any personal data obtained for these purposes unless an exception applies, such as a separate legal requirement to retain the data or active court proceedings.⁴

Format, Access, and Storage

Records must be stored so the FCA can access them for future reference and reconstruct each key stage of a transaction. Physical or electronic storage both work; the format itself is not prescribed.¹

A few format rules apply across the board. Records must be capable of being reproduced in English and on paper if the FCA asks for a hard copy; records kept in another language may stay in that language provided a translation can be produced on request. Storage systems must make it easy to identify corrections or amendments alongside the original content before those changes. And records need protection against damage, unauthorised access, and alteration throughout the retention period.

These duties travel with the data. Using cloud storage, offshore data centres, or third-party providers does not transfer the obligation — the firm remains responsible for ensuring the FCA can access the records without delay.¹

Retention Versus the Right to Erasure

FCA retention duties and UK GDPR erasure rights pull against each other. Article 17(3)(b) of the UK GDPR carves out an exemption where processing is necessary to comply with a legal obligation, and FCA Handbook rules and the Money Laundering Regulations are legal obligations. A firm can therefore refuse an erasure request for data it is required to retain.

The exemption ends when the retention period does. At that point the legal justification falls away, and keeping personal data without another lawful basis becomes a data protection risk in its own right. The Money Laundering Regulations make this explicit by requiring deletion once the five-year period is up. Retention schedules should flag expiry dates and trigger review or deletion; holding data indefinitely on a “just in case” basis is not a defence under either regime.

What Happens If You Get It Wrong

The FCA uses its enforcement tools against record-keeping and reporting failures. In 2025 the regulator fined Sigma Broking Limited over £1 million for transaction reporting failures, and issued a £99,200 penalty against Infinox Capital Limited for similar breaches of MiFIR transaction reporting requirements.¹¹ Both cases turned on inaccurate transaction reporting, a direct product of inadequate record-keeping systems.

Record-keeping failures rarely appear on their own. They surface during broader investigations, at which point the inability to produce records compounds the underlying issue. A firm that cannot reconstruct a transaction or produce a suitability report faces both the original allegation and a separate systems-and-controls charge, and the penalties stack.

1
FCA Handbook. SYSC 9.1 General Rules on Record-Keeping
2
FCA Handbook. COBS Sch 1 Record Keeping Requirements
3
FCA Handbook. SYSC 10A Recording Telephone Conversations and Electronic Communications
4
legislation.gov.uk. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 – Regulation 40
5
FCA Handbook. SUP 10C.11 Statements of Responsibilities
6
FCA Handbook. COBS 10.7 Record Keeping and Retention Periods for Appropriateness Records
7
FCA Handbook. DISP Sch 1 Record Keeping Requirements
8
FCA Handbook. SUP 16.31 Financial Promotion Approval Reporting
9
FCA Handbook. COBS 9A.4 Record Keeping and Retention Periods for Suitability Records
10
Financial Conduct Authority. Sponsors – Record Keeping Requirements
11
Financial Conduct Authority. 2025 Fines