ExamFinch.com My Study

Study guide

9.1 Record Keeping, Reporting and Notification Requirements

Practice this exam

CeMAP Module 1 Financial Services, Regulation and Ethics

Track your progress as you read

Finished sections get a check mark.

1 Introduction

1.1 About the CeMAP Module 1 (FSRE) Exam 1.2 How to Use This Study Guide

2 UK Financial Services Industry and the Wider Economy

2.1 Purpose and Role of Money and Financial Markets 2.2 Structure of UK and International Financial Markets 2.3 Types of Main Markets and Market Participants 2.4 Asset Classes and Their Characteristics 2.5 The UK Government, EU Influence and International Standards 2.6 Bank of England, Financial Institutions and Financial Crime

3 Serving the Retail Consumer

3.1 Consumer Perceptions and Firm Obligations 3.2 Consumer Financial Needs and How They Are Met 3.3 Product Types and Their Functions

4 Legal Concepts for Financial Advice

4.1 Legal Entities and Powers of Attorney 4.2 Law of Contract and Agency 4.3 Property Ownership, Insolvency and Bankruptcy 4.4 Wills and Intestacy 4.5 Trusts: Structure, Purpose and Types

5 Development of UK Financial Services Regulation

5.1 History of UK Regulation 1986–2021 5.2 The UK Regulatory Framework and Other Regulators 5.3 Additional Oversight: Senior Management, Auditors, Trustees and External Compliance

6 The FCA and PRA and Their Handbook

6.1 FCA and PRA: Statutory and Operational Objectives 6.2 Principles-Based Regulation, Duties and Enforcement Powers 6.3 Purpose and Structure of the FCA Handbook 6.4 High-Level Standards and the Training and Competence (T&C) Regime 6.5 Prudential Standards, CASS and the SMCR 6.6 Conduct of Business (COBS) Rules 6.7 Regulatory Processes, Regulated Activities and Authorisation

7 Advising Clients: Skills and Process

7.1 Communication Skills for Advisers 7.2 Gathering Information and the Fact-Find 7.3 Assessment, Analysis and Identifying Appropriate Solutions 7.4 Recommendations, Conclusions and Insistent Clients

8 Principles for Businesses and Conduct Rules

8.1 Principles for Businesses and Conduct of Business Rules 8.2 Preventing Harm, the Market Conduct Code (MAR) and Conduct Risk 8.3 Corporate Culture, Leadership and Senior Management Responsibilities 8.4 Consumer Rights and Unfair Contract Terms

9 Regulatory Framework Rules and Consumer Protection

9.1 Record Keeping, Reporting and Notification Requirements 9.2 Anti-Money Laundering and Proceeds of Crime 9.3 Data Protection and Data Security 9.4 Complaint Handling and the Financial Ombudsman Service 9.5 FSCS, Treating Customers Fairly and Conduct Risk

10 The Regulatory Advice Framework

10.1 Client Relationships, Adviser Responsibilities and Types of Clients 10.2 Fiduciary Relationships and Types of Service Provision 10.3 Disclosure Requirements and Adviser Charging 10.4 Limitations to Authority, Cancellation Rights and Vulnerable Clients 10.5 Regulated Advice Standards and Due Diligence on Products 10.6 Monitoring and Reviewing Client Circumstances

11 Ethics and Professional Behaviour

11.1 Core Ethical Theories, Principles and Values 11.2 Impact of Ethical Principles and Professional Codes of Conduct 11.3 The Code of Ethics and Resolving Ethical Dilemmas 11.4 Business Ethics, Whistleblowing and Ethical Culture 11.5 Professionalism, CPD and Ethical vs Compliance-Driven Behaviour

9.1 Record Keeping, Reporting and Notification Requirements

Key Takeaways Explain This Topic AI

SYSC 9 requires firms to keep orderly records for at least five years; MLR 2017 transactions need six years; insurance mediation records need seven years

SUP 15 governs immediate notification of material changes including rule breaches, fraud, complaints and operational incidents

SUP 16 returns include MORT 1, CONC 1 and the CMOR (complaints, mortgage and other) data returns filed via GABRIEL

Principal firms remain responsible for appointed representatives and must notify appointments, terminations and material changes to the FCA

Inadequate records are themselves a rule breach; firms cannot destroy files subject to live complaints or litigation holds

Last updated: July 2026

9.1 Record Keeping, Reporting and Notification Requirements

Regulated firms operate in a documentary environment. Every significant decision, transaction and customer interaction must be captured, retained and made available to the FCA on request. The SYSC 9 chapter of the FCA Handbook sets the general record-keeping obligations, while specialist regimes (Money Laundering Regulations 2017, the Data Protection Act 2018, DISP) impose their own retention periods. Failure to keep adequate records is, in itself, a rule breach and can trigger enforcement action even where the underlying conduct was perfectly proper.

SYSC 9 — General Record-Keeping Requirements

SYSC 9.1 requires firms to take reasonable care to maintain orderly and complete records of their business and internal organisation. Records must be sufficient to enable the FCA to verify compliance with rules and to perform its supervisory functions. Records can be kept in paper or electronic form, provided they are durable, accessible and capable of being produced promptly on demand.

Minimum Retention Periods at a Glance

  • Record type Source Minimum period
  • General business and internal organisation records SYSC 9 At least 5 years (longer where other rules require)

Customer due diligence (CDD) records and transaction records Money Laundering Regulations 2017 (MLR 2017), reg. 40 5 years after end of business relationship or occasional transaction

  • Transactions under MLR 2017 JMLSG guidance Often cited as 6 years from end of relationship
  • Insurance mediation records ICOBS / SYSC 9 7 years after the obligation ends
  • Complaints records DISP 1.9 At least 6 months (closed) or longer where linked to redress
  • Personal data of customers UK GDPR / DPA 2018 No longer than necessary for the purpose (storage limitation)

Audio and video recordings of telephone calls and electronic communications COBS 11.8 At least 6 months (often longer under firm policy)

The starting point is therefore the five-year minimum under SYSC, but most advisers should default to six years because client files almost always contain CDD material, transactional records and complaint correspondence. Insurance mediation files should be retained for the seven-year period because the long-tail nature of life and pension contracts makes later disputes likely.

SUP 15 — Notifications to the FCA

The SUP 15 sourcebook governs what a firm must tell the FCA, and when. The principle is that any matter which could have a significant adverse impact on the firm's reputation, financial position or the interests of customers must be notified immediately — interpreted by the FCA as no later than 24 hours after the firm becomes aware of it.

Material Notifications

  • Event Notification deadline SUP 15 reference
  • Significant rule breach or suspected breach Immediately SUP 15.3
  • Material change in ownership or control Immediately SUP 15.3 / SUP 10
  • Fraud, theft or other dishonesty by staff Immediately SUP 15.3
  • Material complaint pattern affecting the firm Immediately SUP 15.3
  • Major operational incident (e.g., systems outage) Immediately SUP 15.3
  • Change of firm's approved person or SMF holder Within 7 business days SUP 10
  • Change in principal or appointed representative As soon as practicable SUP 12
  • Expected breach of capital or liquidity requirements Immediately SUP 15.3
  • SUP 16 — Regular Reporting

The SUP 16 sourcebook mandates periodic returns. Most consumer credit firms and mortgage advisers file returns through GABRIEL (the FCA's online reporting system). Common returns include the MORT 1 for mortgage lending and administration, CONC 1 for consumer credit data, and the CMOR (Complaints, Mortgage and Other Returns) form for volumes and outcomes of complaints.

The CMOR return collects data on complaints opened, closed and upheld, including redress paid. It feeds both FCA supervisory intelligence and the firm's Consumer Duty outcomes monitoring. Late or inaccurate submissions are themselves a rule breach.

Principal and Appointed Representatives

A principal firm that appoints an appointed representative (AR) to carry on regulated activities remains legally responsible for the AR's conduct. The principal must:

Notify the FCA of any appointment, termination or material change in the AR's activities (SUP 12).

Maintain records of the AR's activities, training and oversight for at least five years .

Report the AR's regulated activities and complaints data through the firm's regular returns.

An AR cannot operate independently — they rely on the principal's permissions. If a principal terminates an AR relationship, they must notify the FCA within a reasonable period and ensure records continue to be available.

Practical Compliance Checklist

Maintain a records retention policy mapping each record type to its source rule and retention period.

Diary forward files for review at the retention expiry date; do not destroy files that are subject to a live complaint or litigation hold.

Use secure, access-controlled storage with audit trails of who accessed which file.

Train staff at induction and annually on the consequence of inadequate records: rule breach, FCA enforcement, and civil liability.

Document every SUP 15 notification decision — including the decision not to notify — with a brief rationale.

Audit Trails and Continuity

Good records are not just about retention — they are about audit trails . Firms should be able to reconstruct, months or years later, who did what, when, and on what authority. This applies to client files (suitability reports, fact-finds, signed application forms), to internal decisions (SMF approvals, product governance sign-offs) and to communications (call recordings, meeting notes, email exchanges). Audit trails protect both the firm and the customer if a dispute arises.

Continuity is the other side of the coin. If a firm ceases trading, is taken over, or merges, its records must remain accessible. SYSC 9 expects firms to make arrangements that allow records to be retrieved by a successor, by the FCA, or by the FSCS as part of any failure resolution. Firms using third-party cloud storage should ensure contract terms permit regulator access and that data can be exported in a usable format.

The FCA will not accept a lost file as a defence. Records are the firm's evidence of compliance.