Record-Keeping Requirements for FCA Firms: A Practical Guide to SYSC 9

What SYSC 9 actually requires

The core obligation sits in SYSC 9.1.1R. It requires a firm to arrange for orderly records to be kept of its business and internal organisation, including all services and transactions undertaken by it. The word orderly matters. A shoebox of documents that technically exist but cannot be found, indexed or produced on request does not satisfy the rule. The records have to be organised well enough to be useful.

The purpose is set out in the rule itself. The records must be sufficient to enable the FCA to monitor the firm's compliance with the requirements under the regulatory system, and in particular to ascertain that the firm has complied with all its obligations with respect to clients. In other words, record-keeping is not an end in itself. It exists so that the firm can demonstrate compliance and so that the supervisor can verify it. If a record does not help you show that clients were treated properly, ask whether you are keeping the right things.

SYSC 9.1.2-AR adds a quality standard for the medium in which records are held. Records must be retained in a form that allows the FCA to access them readily and to reconstitute each key stage of the processing of a transaction. The firm must be able to identify easily any corrections or other amendments, and the contents of the records before those corrections or amendments were made. That rules out systems where edits silently overwrite history. An audit trail is not optional; it is part of the record itself.

How long you have to keep records

SYSC 9 sets a general expectation but not a single universal period. For non-MiFID business, the guidance in SYSC 9.1.5G is that records should be retained for as long as is relevant for the purposes for which they are made. That is a judgement, not a fixed number, and it puts the onus on the firm to decide what relevant means for each record type.

For MiFID business, SYSC 9.1.2R is firmer. A common platform firm must retain all records kept under the chapter in relation to its MiFID business for a period of at least five years. The words at least are significant: five years is a floor, not a ceiling. Where another rule or another purpose requires longer, the longer period wins.

The retention periods that most firms actually manage against come from the specialist sourcebooks and from legislation, not from SYSC 9 itself. The table below draws those together so you can see the landscape in one place. Treat it as a starting map, and always confirm the period against the specific rule for the record in question, because product variations can extend it.

The five-year AML record rule under MLR 2017

For any firm within scope of the money-laundering regime, the retention rule that draws the most supervisory attention is regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. This is separate legislation, not part of the FCA Handbook, but it sits alongside SYSC 9 and applies to a wide range of regulated firms.

Regulation 40 requires a relevant person to keep two kinds of record. The first is a copy of any documents and information obtained to satisfy the customer due diligence requirements in regulations 28, 29 and 33 to 37. The second is sufficient supporting records, whether original documents or copies, in respect of a transaction that is the subject of customer due diligence or ongoing monitoring, to enable the transaction to be reconstructed.

The period is five years. For an occasional transaction, it begins on the date the relevant person knows, or has reasonable grounds to believe, that the transaction is complete. For records tied to a business relationship, it begins on the date the relationship comes to an end. There is an upper limit: a relevant person is not required to keep the transaction records referred to in the relevant provision for more than 10 years. When the retention period expires, the firm must delete personal data obtained for the purposes of the Regulations, unless a listed exception applies, such as a legal requirement to retain it or the need to keep it for court proceedings.

The practical lesson is that the AML clock is event-driven, not calendar-driven. It does not start when you onboard a client; it starts when the relationship ends or the transaction completes. A long-standing relationship can require you to hold onboarding records for years before the five-year clock even begins to run.

Where the specialist rules set the clock

Two areas of the Handbook set periods that compliance teams manage against day to day: complaints and suitability. Both illustrate how the general SYSC 9 principle is given a specific number elsewhere.

For complaints, DISP 1.9.1R requires a firm to keep a record of each complaint received and the measures taken for its resolution. Most complaint records must be retained for three years from the date the complaint was received. Complaints relating to collective portfolio management services for a UCITS scheme must be kept for five years from that date. The record is expected to cover the complaint lifecycle, so the investigation notes, the final response and any redress calculation all belong in it.

For investment suitability, COBS 9.5.2R sets retention periods that vary sharply by product. A suitability record relating to a pension transfer, pension conversion, pension opt-out or FSAVC must be retained indefinitely. A record relating to a life policy, personal pension scheme, stakeholder pension scheme or benefits in a defined contribution occupational pension scheme must be kept for five years. In any other case the period is three years. The indefinite category exists because the consequences of these decisions can surface decades later, and the firm may still need to justify the advice it gave.

This is why a single firm-wide retention number is dangerous. A wealth manager advising on pension transfers, handling MiFID transactions and running an AML programme is simultaneously subject to indefinite retention, five-year retention and event-driven five-year retention. A framework that keeps everything for three years would breach several rules at once. Building a controlled record estate is exactly the kind of work our control tooling is designed to support.

Conflicts, and the records that prove your controls work

Not every record-keeping obligation is about client transactions. Some are about proving that the firm's own controls operate. SYSC 10.1.6R is a good example. It requires a firm to keep and regularly update a record of the kinds of service or activity carried out by or on behalf of the firm in which a conflict of interest entailing a material risk of damage, or for a common platform firm a risk of damage, to the interests of one or more clients has arisen or, in the case of an ongoing service or activity, may arise.

The phrase regularly update is doing real work. A conflicts record written once at authorisation and never revisited is not compliant, because conflicts change as the business changes. The record is meant to be a living document that reflects the firm as it is now, not as it was on the day the compliance manual was signed off.

The wider point is that supervisors read records as evidence of whether a control framework is real. A policy that says conflicts will be identified and managed carries little weight without a maintained conflicts record behind it. The same logic applies to governance minutes, training logs and monitoring reports. Treat control-evidence records as first-class citizens alongside transaction and client records, because they are often the first thing a supervisor asks to see.

Building a record-keeping framework that survives supervision

A durable framework starts with knowing what you must keep and for how long, then wraps controls around it so the right records exist, stay accessible and are disposed of only when it is safe to do so. The steps below give a practical sequence for a firm building or reviewing its regime.

The single most common failure is not a missing rule but a retention schedule that does not map cleanly onto the way records are actually stored. Emails, call recordings, advice files and AML documents often live in different systems with different default retention settings. If those settings do not reflect the rules above, records are quietly deleted early or kept long past their lawful basis. Bring the schedule and the systems into line before you consider the job done. Firms preparing for authorisation should build this in from the start rather than retrofitting it, and our authorisation support covers exactly that groundwork.

Conclusion

Record-keeping under SYSC 9 is deceptively simple at the level of principle and genuinely complex in the detail. The general rule asks for orderly records that let the firm demonstrate compliance and let the FCA verify it, held in a form that preserves an audit trail. But the retention clocks that determine what you actually keep, and for how long, are set by rules spread across COBS, DISP and the Money Laundering Regulations 2017. A framework that treats all records as one category will breach several of those rules at once.

The firms that handle this well do three things. They map each record type to the specific rule that governs it, they set the retention clock from the correct start date, and they wrap access controls and integrity checks around the whole estate so that records can be produced, trusted and disposed of lawfully. Do that, and record-keeping stops being a compliance chore and becomes what it was always meant to be: the evidence base that lets you show, on demand, that you did the right thing.

Frequently asked questions