Records retention
Also called record keeping, recordkeeping, books and records
Records retention is the duty on regulated firms to create, keep and be able to retrieve records of their business for set periods. Rules cover customer due diligence files, transactions, recorded calls, electronic messages and orders. Typical periods run from three to seven years, after which data should be deleted.
How it works
A firm keeps a retention schedule listing each record type, the rule behind it, the period and the trigger date, such as the end of a customer relationship. Records sit in systems that prevent alteration and allow quick search. Calls, emails and chat messages on work devices are captured and archived. At the end of the period, records are deleted unless a legal hold applies.
Retention matters because regulators rebuild events from records. Missing files make it impossible to show that checks were done. Off-channel communications on personal messaging apps led US regulators to fine dozens of firms for record-keeping failures. Data protection law pushes the other way, so firms keep records long enough to meet financial rules but no longer.
The rules
Firms must keep customer due diligence records and transaction records for five years after the business relationship ends or the transaction completes.
Banks, payment firms, accountants and other relevant personsFirms must record telephone calls and electronic communications relating to client orders and keep them for five years, or up to seven if requested.
Investment firms and banks providing investment servicesBroker-dealers must preserve required books, records and business communications for three or six years, in a non-rewriteable or audit-trail electronic format.
SEC-registered broker-dealersRecords required under the Bank Secrecy Act must be kept for five years and be accessible within a reasonable time.
Banks and other financial institutions under the BSACommon questions
How long must AML records be kept?
In the UK, the Money Laundering Regulations 2017 require five years from the end of the business relationship or the date of an occasional transaction. US Bank Secrecy Act records are kept for five years. The EU AML Regulation, applying from July 2027, also sets five years.
Do MiFID II recording rules cover mobile chat apps?
Yes, where they are used for communications relating to client orders or transactions. Firms must record and keep these communications, so most ban unrecorded apps for business use. Using personal messaging for work without capture is a record-keeping breach.
What changed in SEC Rule 17a-4 in 2022?
The SEC amended the rule to let broker-dealers keep electronic records either in a non-rewriteable, non-erasable format or in a system with a complete audit trail of changes. Compliance with the amendments was required from 3 May 2023.
Can firms keep records longer than the rules require?
Firms can keep records longer where there is a reason, such as litigation, an investigation or a legal hold. Without a reason, keeping personal data beyond the required period can breach data protection rules on storage limitation.
