Is call recording mandatory for financial advisers in the UK?

Only for some calls. SYSC 10A requires firms in its scope to record calls relating to investment activities such as arranging, dealing in or managing investments, including calls intended to lead to a transaction. Retail investment advisers using the MiFID optional exemption may keep a written note instead. We found no rule in MCOB that requires mortgage or equity release advisers to record calls.

How long do you have to keep call recordings under FCA rules?

Under SYSC 10A, five years from the date of the conversation, or up to seven years if the FCA requests it. Claims management firms must keep recordings for at least 12 months from the latest trigger event under CMCOB 2.3. Where recording is voluntary there is no FCA minimum, and UK GDPR expects a retention period you can justify.

Do mortgage and equity release advisers have to record calls?

We found no rule in MCOB that requires it. MCOB instead requires suitability records, kept for at least three years. The FCA's 2020 review of equity release advice found most customer interactions were not recorded, which made good written records of discussions important. Firms with investment permissions should check whether some calls fall under SYSC 10A.

Do I need consent to record business calls under UK GDPR?

Not necessarily. You need a lawful basis, decided and documented before you start, and consent is only one option. The ICO has said consent may not be the most appropriate basis for creating call transcripts, and legal obligation fits only where a rule actually requires the recording. Whatever basis you choose, tell callers the call is recorded.

Do you have to tell someone a call is being recorded?

In practice, yes. The interception rules authorise business recording only where all reasonable efforts have been made to inform people who may use the system, UK GDPR requires privacy information when you collect personal data, and SYSC 10A and CMCOB 2.3 require firms in scope to tell clients. Staff should be told too, in privacy information and documents such as the staff handbook.

FCA call recording requirements for advice firms

No FCA rule makes every firm record calls. SYSC 10A requires firms in scope to record calls about investment activities such as arranging, dealing in or managing investments, and keep them for five years. Claims management firms must record under CMCOB 2.3. Retail investment advisers using the MiFID optional exemption may keep a note instead, and we found no MCOB rule requiring mortgage or equity release advisers to record.

Key takeaways

SYSC 10A, which replaced the old COBS 11.8 taping rules, covers calls about in-scope investment activities, even those that don't end in a transaction. Recordings are kept for five years, or up to seven if the FCA asks.
Retail investment advisers using the MiFID optional exemption can keep a written note instead, subject to conditions.
We found no rule in MCOB that requires mortgage or equity release advisers to record calls. They must keep suitability records for at least three years instead.
Where recording is voluntary there is no FCA minimum retention period. UK GDPR expects a period you can justify, written into a retention policy.
Whatever the regime, tell people the call is recorded. Telling is not the same as asking for consent, and consent is not the only lawful basis.

Do FCA-regulated firms have to record calls?

Some do, for some calls: it depends on what the call is about and which rules apply to your firm. Three parts of the FCA Handbook cover most advice and sales firms:

Rules	Who they cover	Recording or note?	Minimum retention
SYSC 10A	MiFID investment firms, fund managers and Article 3 firms, for calls about arranging, dealing in or managing investments	Record relevant calls; Article 3 firms serving solely or mainly retail clients may keep a written note instead	Five years from the call; up to seven if the FCA requests it
CMCOB 2.3	Claims management firms	Record all telephone calls	At least 12 months from the latest trigger event, such as settlement, withdrawal or the close of a complaint
MCOB 4 and 8	Mortgage and equity release advice	No recording rule found; suitability records required	At least three years (for records, not recordings)

COBS 11.8 is still cited online as the taping rule, but it belongs to the regime that applied before MiFID II. The rules now sit in SYSC 10A, Recording telephone conversations and electronic communications, which the Handbook shows as last updated on 23 October 2025, so read the current text rather than older summaries.

Who must record calls under SYSC 10A?

SYSC 10A applies to MiFID investment firms, UK AIFMs (full-scope and small authorised), residual CIS operators, UCITS management companies and third country investment firms. It also applies to MiFID optional exemption firms, often called Article 3 firms, for the activities their exemption covers.

The recording duty is triggered by activities in financial instruments: arranging deals in investments, dealing as agent or principal, managing investments, and managing a UCITS, an AIF or a collective investment scheme.

What has to be recorded

A firm must take all reasonable steps to record relevant telephone conversations, and keep copies of relevant electronic communications, made with equipment it provides or permits staff to use.
That includes conversations intended to result in an in-scope activity, even if they do not.
It must also take reasonable steps to stop staff making relevant calls or sending relevant messages on privately owned equipment the firm cannot record or copy. The FCA examined this risk at wholesale banks in its multi-firm review of off-channel communications, published on 7 August 2025.

How recordings must be kept

In a durable medium that allows them to be replayed or copied, in a format that does not allow the original record to be altered or deleted.
Available to the client on request.
For five years from the date of the conversation or communication, or up to seven years where the FCA requests it.

Telling clients

Before providing services, the firm must tell new and existing clients that relevant telephone conversations and communications will be recorded, and that a copy will be available on request for five years, or up to seven where the FCA requests it.

Outsourcing the recording doesn't outsource the duty

SYSC 8 treats the recording and retention of communications subject to SYSC 10A as a critical or important function for outsourcing purposes, and the FCA's off-channel communications review said regulatory responsibilities under SYSC 10A cannot be transferred to third parties. Check what your telephony provider records and how quickly you can retrieve a call.

Retail investment advisers: record the call or keep a note

In CP16/29, in 2016, the FCA proposed full taping for Article 3 retail financial advisers. In 2017 it changed course: those firms could either record relevant conversations or keep a contemporaneous note of them. In PS17/14 it said a note should capture the key details of any orders taken and the key substance of the main points of the conversation.

Today, SYSC 10A.1 allows a MiFID optional exemption firm that serves solely or mainly retail clients to keep a written minute or note of telephone conversations instead of recording them, provided it meets conditions. The rule sets minimum contents for the note, including:

the date and time of the conversation;
the identity of the participants;
who initiated the conversation.

FCA guidance adds that the note should contain all relevant substantive details of the conversation, and that a firm using this option should set out that decision in its recording policy. Separately, face-to-face conversations with clients can be recorded in written minutes or notes.

Older FCA guidance for the COBS 11.8 regime said it did not expect retail financial advisers to be recorded, because they would not normally have relevant conversations in that role. For Article 3 firms the current position is record or note.

Do mortgage, equity release and protection advisers have to record calls?

We found no rule in MCOB that requires mortgage or equity release advisers to record calls, and mortgage and equity release advice are not among the investment activities that trigger SYSC 10A. But if your firm also holds investment permissions, calls about those activities may be in scope, so check your permissions with your compliance team.

What MCOB does require is a suitability record. For equity release advice under MCOB 8, the firm must record the customer information it obtained, including about the customer's needs and circumstances, and why it concluded the advice is suitable, and keep those records for at least three years from the date the advice was given. Records of mortgage advice under MCOB 4 also have a three-year minimum. MCOB notes that firms may keep records for longer, for example where a complaint or legal action is possible.

The FCA's June 2020 review of equity release sales and advice found that most customer interactions were not recorded, by tape or digitally. That made good written records of discussions important, both to evidence suitability and to give firms assurance over their advisers. The FCA wanted the customer's voice to be clearly "heard" in the file, and said firms should collect and retain the evidence that supports the suitability assessment.

In a 2019 speech on improving the suitability of financial advice, the FCA put it more directly: "Consider recording client interactions. This isn't a requirement, but we have come across many firms who have invested in this." It also pointed to recordings as strong evidence if a complaint arises.

Protection and general insurance. Insurance distribution does not appear in SYSC 10A's list of firms and activities. We have not reviewed ICOBS or the rules for insurance-based investment products here, so if you advise on protection or insurance, confirm the position with your compliance team.

Where a firm does record, the recording is the fullest account of a long fact find. Our equity release fact find checklist sets out what to listen for, and evidencing good outcomes in equity release covers the Consumer Duty side.

How long do you have to keep call recordings?

It depends on which rule, if any, applies.

Situation	Minimum period	Where it comes from
Calls in scope of SYSC 10A	Five years from the date of the conversation or communication; up to seven years if the FCA requests it	SYSC 10A; SYSC Schedule 1
Claims management calls	At least 12 months from the latest of several trigger events, such as settlement, withdrawal or the close of a complaint	CMCOB 2.3
Mortgage and equity release advice	No recording period found; suitability records for at least three years	MCOB 4 and 8; MCOB Schedule 1
Voluntary recordings	No FCA minimum; no longer than needed, for a period you can justify	UK GDPR storage limitation principle

Three figures that circulate online are worth correcting:

Six months comes from the old COBS 11.8 regime and the FCA's legacy guidance written for it. It does not apply to SYSC 10A recordings.
Twelve months is the claims management minimum under CMCOB 2.3, not a general rule.
Six years is sometimes presented as an FCA rule for every firm. None of the rules in the table sets it.

Voluntary recordings: a period you can justify

Where no FCA rule requires the recording, UK GDPR's storage limitation principle applies: personal data must not be kept for longer than it is needed. The ICO expects retention periods to be justified, ideally in a retention policy that is reviewed periodically, with data erased once the period ends. For mortgage and equity release recordings, MCOB's record-keeping periods are useful context. Write down the period and the reasoning, and agree it with your data protection officer.

Not necessarily. Neither the interception rules nor UK GDPR makes consent a requirement in itself, but you do need to tell people, and you need a lawful basis.

The interception rules: make all reasonable efforts to inform

The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, made under the Investigatory Powers Act 2016, authorise interception by businesses for monitoring and record-keeping only if conditions are met. One is that the system controller has made all reasonable efforts to inform every person who may use the system that their communications may be intercepted. That is a duty to inform, not to obtain consent. The Regulations replaced the Telecommunications (Lawful Business Practice) Regulations 2000.

Choose and document a lawful basis

The ICO says you must decide your lawful basis before you start processing, document it with a justification for each purpose, and include the lawful basis and purposes in your privacy information. Three points matter for call recording:

Legal obligation needs an obligation with a sufficiently clear basis in common law or statute, and the ICO says it cannot be used where you have discretion over whether to process. So it does not fit voluntary recording.
Consent is not the only option. On using a third-party AI supplier to transcribe calls, the ICO said consent "may not be the most appropriate basis" for creating call transcripts, that all lawful bases (and Article 9 conditions where needed) must be considered, and that consent cannot be obtained through agreement to a privacy policy.
Legitimate interests is another basis to consider for voluntary recording. Whether it fits is a judgement to make, and document, with your DPO.

Tell callers when you collect their data

UK GDPR Article 13 requires privacy information at the point you collect personal data directly from someone, which is what a recorded call does. A short recording notice at the start of the call, pointing to your privacy notice, is the practical way to do it. SYSC 10A firms must also tell clients before providing services, and claims management firms must tell the customer at the start of each call, including internet voice calls.

Health information and DPIAs

In later-life lending, health and lifestyle questions are often asked on the fact find, for example to qualify for enhanced terms. Health information is special category data, so processing it needs an Article 9 condition as well as an Article 6 lawful basis. Recording and analysing calls at scale, particularly with AI, often needs a data protection impact assessment: see rolling out AI call monitoring and identifying vulnerable customers on calls.

Staff are data subjects too

The ICO's guidance on monitoring workers says employers should tell workers about call monitoring in their privacy information and in documents such as the staff handbook, and recommends a DPIA even where one is not mandatory. The ICO notes that this guidance is under review following the Data (Use and Access) Act.

How to evidence recording compliance on every call

Whether or not recording is mandatory for you, a few habits help:

Script the recording notice and check it. Fixed wording makes it a natural verbatim rule (see writing compliance rules an AI can check); add it to your call QA scorecard.
Keep the evidence with the result. A pass or fail is more useful with the quoted words behind it.
State your coverage. A written call-selection policy, with excluded calls logged and reasons given, stops coverage being overstated.
Make recordings findable. When a client asks for a copy, or a complaint needs investigating, you need the moment in the call, not just the file. Cited AI answers are one way to get there.
Ask suppliers in writing about access controls, data isolation, audit logging, retention and support for your DPIA; the buyer's guide lists the questions.

COSA Compliance does not record your advisers' calls. It works on recordings your firm already makes, arriving from your dialler or uploaded, and never joins a live call. (The AI Dialler, COSA's sales side, records its own AI calls once a person answers, with a recording notice in its opening. The consent rules for AI calls are covered in is AI calling legal in the UK?) A firm can set its recording notice up as a verbatim rule, so every in-scope call shows whether it was given, with an explanation, the quoted words and a confidence level. The COSA Assistant answers questions about a client's calls with cited passages and plays the recording from the cited moment. Retention and lawful basis remain the firm's decisions, and COSA supports, and does not replace, professional compliance review. See how rules work or read about security.

This article is general information, not legal or regulatory advice. Which rules apply depends on your firm's permissions and activities. Check the current Handbook text of SYSC 10A, CMCOB 2.3 and MCOB, and take advice from your compliance team and data protection officer.

FCA call recording requirements: who must record, and how long to keep recordings

Do FCA-regulated firms have to record calls?