Financial adviser record keeping obligations: how long?

This guide is for owners, compliance leads and operations managers of UK financial advice firms who set retention periods for advice records. The period depends first on which chapter of the FCA’s rules covers the advice, and the FCA says many advisers are “Article 3 firms”, whose optional exemption business falls under COBS 9A rather than COBS 9. Building the retention clock in Filyst, our case management product, taught us that a rule can set a period without a start date. The sections cover which rules apply, the periods, the start date, the discard exception, contents, form and UK GDPR.

What are suitability records?

Suitability records are the records an advice firm keeps of how it assessed whether a recommendation suits the client. The Financial Conduct Authority (FCA), the UK regulator of advice firms, sets their retention in its Handbook.

The Conduct of Business Sourcebook (COBS) holds the suitability rules, and the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) holds the general record-keeping rules.

One record is the suitability report. The FCA Glossary defines it as a report a firm must provide to its client which, among other things, explains why the firm has concluded that a recommended transaction is suitable for the client. Paragraphs marked R in the Handbook are rules; those marked G are guidance.

Which rules apply: COBS 9 or COBS 9A?

COBS 9 applies to a firm that makes a personal recommendation to a retail client on a designated investment (COBS 9.1.1R). COBS 9A applies instead to investment advice in MiFID, equivalent third country or optional exemption business, and to investment advice on insurance-based investment products (COBS 9A.1.1R, COBS 9.1.1AG).

MiFID refers to the Markets in Financial Instruments Directive and the requirements derived from it. The FCA says many financial advisers who do not hold client assets or money and do not do business outside the UK are exempt from it. These are “Article 3 firms”, called “MiFID optional exemption firms” in the FCA’s rules, and they are subject to a number of requirements derived from MiFID II. An insurance-based investment product (IBIP) is a contract of insurance with a maturity or surrender value wholly or partly exposed to market fluctuations. The Glossary excludes, among others, life contracts that pay only on death or incapacity and pension products whose primary purpose is income in retirement.

Two narrower cases sit in COBS 9.1. A personal recommendation to a professional client to take out a life policy that is not an IBIP brings in only the COBS 9 rules that implemented the IDD (COBS 9.1.5R). Which chapter covers a given piece of pension or life advice depends on how the firm’s business is classified; the firm’s compliance person decides that.

How long must records be kept under COBS 9?

COBS 9.5.2Rsays a firm “must retain its records relating to suitability for a minimum of the following periods”. It sets three periods by product; paragraph (3) is deleted.

A pension transferis, in the Glossary, a transaction resulting from a retail client’s decision to require a transfer payment in respect of safeguarded benefits, for example to obtain flexible benefits under another pension scheme. An FSAVC is an arrangement through which a member of an occupational pension scheme makes additional voluntary contributions (AVCs) to a private pension policy or contract that is separate from, but associated with, the scheme. Pension advice that fits neither paragraph (1) nor paragraph (2) falls under “any other case”: three years.

These periods are minimums. For non-MiFID business, SYSC 9.1.5Gadds the general principle that records “should be retained for as long as is relevant for the purposes for which they are made”.

How long must records be kept under COBS 9A?

Records of COBS 9A advice are kept for at least 5 years, under SYSC rather than COBS. COBS 9A.4.2ARrequires the records “in complying with the requirements in SYSC 9”, and COBS 9A.4.2G points to SYSC 9 for firms other than insurers and managing agents.

• MiFID and optional exemption business: SYSC 9.1.2R says a common platform firm must retain records in relation to its MiFID business for at least five years. SYSC 1 Annex 1 3.2CR and Table B apply SYSC 9.1.2R to MiFID optional exemption firms as a rule, applied proportionately.
• Insurance-based investment products: SYSC 9.1.2AR requires suitability records to be kept for at least five years, and COBS 9A.4.3R(3) for at least the duration of the relationship between the firm and the client. SYSC 9.1.2BG(2) tells firms to consider whether the second rule means keeping a record longer than five years.

When does the retention period start?

None of the rules states a start date. COBS 9.5.2R, SYSC 9.1.2R and SYSC 9.1.2AR set periods only, and COBS 9A.4.3R(3) ties IBIP records to the duration of the client relationship.

A firm’s retention policy needs to name the start date it uses for each record type, such as the date of the recommendation or the end of the relationship, and apply it consistently.

Can records be discarded when the client does not proceed?

Under COBS 9, yes: COBS 9.5.3R says a firm “need not retain its records relating to suitability if the client does not proceed with the recommendation”. Neither COBS 9A.4 nor SYSC 9.1 contains an equivalent exception. Record that the client did not proceed, so a later decision to discard can be explained.

What must the records contain?

COBS 9A.4 lists the contents; COBS 9.5 does not. COBS 9.5.1G says only that records may be expected to reflect the different effect of the rules for retail and professional clients, for example the client information the firm must obtain and whether a suitability report is required. For MiFID and optional exemption business, COBS 9A.4.2AR requires a record of:

• compliance with the COBS 9A.2 and 9A.3 rules for each assessment of suitability;
• compliance with COBS 9A.3.6R in telling each client whether it will provide a periodic assessment of suitability;
• for investment advice to a retail client, the time and date of the advice, the financial instrument recommended and the suitability report provided.

For insurance-based investment products, the record must include the information obtained from the client and any documents agreed with the client (COBS 9A.4.3R(2)), and (COBS 9A.4.4R):

• the result of the suitability assessment;
• the recommendation made and the statement provided under COBS 9A.3.3AR;
• any changes to the suitability assessment, in particular to the client’s risk tolerance;
• any changes to the underlying investment assets.

What form must the records take?

SYSC 9.1.4G says records required under the Handbook should be capable of being reproduced in English on paper, subject to any other record-keeping rule. Two rules add conditions for COBS 9A records:

• SYSC 9.1.2-AR, for MiFID business (a rule for optional exemption firms under Table B): the FCA can access the records readily and reconstitute each key stage of each transaction; corrections and the contents before them are easy to see; the records cannot otherwise be manipulated or altered; IT systems can be used where the volume of data requires; and the arrangements comply whatever technology is used.
• SYSC 9.1.2CR, for IBIP records: the FCA can access them readily, reconstitute each element clearly and accurately, and identify easily any changes and the contents before them. Where this rule applies, SYSC 9.1.2-AR does not (SYSC 1 Annex 1 2.8AR(5)).

How does UK GDPR fit with the retention periods?

UK GDPR’s storage limitation principle, Article 5(1)(e), requires personal data to be kept in identifiable form “for no longer than is necessary for the purposes for which the personal data are processed”.

The Information Commission, the UK data protection regulator that took over from the Information Commissioner on 30 September 2026 and still publishes as the ICO, says in its storage limitation guidance that if you keep personal data to comply with a legal requirement, you will not be considered to have kept it for longer than necessary.

That covers the minimum periods, including indefinite retention under COBS 9.5.2R(1). Beyond the minimum, the ICO says you should not keep data indefinitely “just in case”. COBS 9A.4.3R(1) also says the IBIP record duty applies without prejudice to the General Data Protection Regulation. The ICO marks this guidance as under review after the Data (Use and Access) Act.

What should a retention schedule include?

The ICO describes a retention schedule as a list of the types of record you hold, what you use them for and how long you intend to keep them. For suitability records, we suggest these columns:

• Record type, and whether COBS 9 or COBS 9A covers it.
• Product or business it relates to, and the paragraph that sets its period.
• Start date the firm uses, and the review or deletion date that follows.
• Person who approves deletion, and the log of what was deleted and when.
• Storage location, and how a record is found when the FCA asks.

What we learnt building a retention clock

Filyst, our case management product for immigration firms, sets a retention date when a case closes, six years by default for UK firms. It sends a reminder when destruction is due and blocks destruction before that date.

Building it showed that a period with no start date cannot be scheduled: the software needs a fixed event to count from. COBS 9.5.2R has the same gap, so an advice firm’s system needs the start date its policy names on every record, plus the product, to calculate the date.

Retention is one part of the record system an advice firm runs, which the guide to AI software for financial advisers under Consumer Duty covers as a whole. Drafting tools create the suitability reports that these rules govern, as suitability report automation explains. A supplier that stores the records for you is an outsourcing arrangement under the FCA outsourcing rules (SYSC 8). Software for financial advisers describes what we build for advice firms, where AI drafts and nothing is sent until an adviser approves it.

Frequently asked questions

Sources

1. FCA Handbook, COBS 9.5 (records and retention periods, last updated 01/10/2020)
2. FCA Handbook, COBS 9.1 (application)
3. FCA Handbook, COBS 9A.1 (application)
4. FCA Handbook, COBS 9A.4 (records and retention periods, last updated 23/10/2025)
5. FCA Handbook, SYSC 9.1 (general rules on record-keeping)
6. FCA Handbook, SYSC 1 Annex 1 (3.2CR, 2.8AR and Table B)
7. FCA Glossary, pension transfer
8. FCA Glossary, insurance-based investment product
9. FCA, MiFID II: retail investment advice firms (last updated 22/10/2024)
10. UK GDPR Article 5, legislation.gov.uk
11. ICO, Principle (e): storage limitation