9.1 Record Keeping, Reporting and Notification Requirements

9.1 Record Keeping, Reporting and Notification Requirements

Regulated firms operate in a documentary environment. Every significant decision, transaction and customer interaction must be captured, retained and made available to the FCA on request. The SYSC 9 chapter of the FCA Handbook sets the general record-keeping obligations, while specialist regimes (Money Laundering Regulations 2017, the Data Protection Act 2018, DISP) impose their own retention periods. Failure to keep adequate records is, in itself, a rule breach and can trigger enforcement action even where the underlying conduct was perfectly proper.

SYSC 9 — General Record-Keeping Requirements

SYSC 9.1 requires firms to take reasonable care to maintain orderly and complete records of their business and internal organisation. Records must be sufficient to enable the FCA to verify compliance with rules and to perform its supervisory functions. Records can be kept in paper or electronic form, provided they are durable, accessible and capable of being produced promptly on demand.

Minimum Retention Periods at a Glance

The starting point is therefore the five-year minimum under SYSC, but most advisers should default to six years because client files almost always contain CDD material, transactional records and complaint correspondence. Insurance mediation files should be retained for the seven-year period because the long-tail nature of life and pension contracts makes later disputes likely.

SUP 15 — Notifications to the FCA

The SUP 15 sourcebook governs what a firm must tell the FCA, and when. The principle is that any matter which could have a significant adverse impact on the firm's reputation, financial position or the interests of customers must be notified immediately — interpreted by the FCA as no later than 24 hours after the firm becomes aware of it.

Material Notifications

SUP 16 — Regular Reporting

The SUP 16 sourcebook mandates periodic returns. Most consumer credit firms and mortgage advisers file returns through GABRIEL (the FCA's online reporting system). Common returns include the MORT 1 for mortgage lending and administration, CONC 1 for consumer credit data, and the CMOR (Complaints, Mortgage and Other Returns) form for volumes and outcomes of complaints.

The CMOR return collects data on complaints opened, closed and upheld, including redress paid. It feeds both FCA supervisory intelligence and the firm's Consumer Duty outcomes monitoring. Late or inaccurate submissions are themselves a rule breach.

Principal and Appointed Representatives

A principal firm that appoints an appointed representative (AR) to carry on regulated activities remains legally responsible for the AR's conduct. The principal must:

• Notify the FCA of any appointment, termination or material change in the AR's activities (SUP 12).
• Maintain records of the AR's activities, training and oversight for at least five years.
• Report the AR's regulated activities and complaints data through the firm's regular returns.

An AR cannot operate independently — they rely on the principal's permissions. If a principal terminates an AR relationship, they must notify the FCA within a reasonable period and ensure records continue to be available.

Practical Compliance Checklist

• Maintain a records retention policy mapping each record type to its source rule and retention period.
• Diary forward files for review at the retention expiry date; do not destroy files that are subject to a live complaint or litigation hold.
• Use secure, access-controlled storage with audit trails of who accessed which file.
• Train staff at induction and annually on the consequence of inadequate records: rule breach, FCA enforcement, and civil liability.
• Document every SUP 15 notification decision — including the decision not to notify — with a brief rationale.

Audit Trails and Continuity

Good records are not just about retention — they are about audit trails. Firms should be able to reconstruct, months or years later, who did what, when, and on what authority. This applies to client files (suitability reports, fact-finds, signed application forms), to internal decisions (SMF approvals, product governance sign-offs) and to communications (call recordings, meeting notes, email exchanges). Audit trails protect both the firm and the customer if a dispute arises.

Continuity is the other side of the coin. If a firm ceases trading, is taken over, or merges, its records must remain accessible. SYSC 9 expects firms to make arrangements that allow records to be retrieved by a successor, by the FCA, or by the FSCS as part of any failure resolution. Firms using third-party cloud storage should ensure contract terms permit regulator access and that data can be exported in a usable format.

The FCA will not accept a lost file as a defence. Records are the firm's evidence of compliance.