The FCA regulates off-channel communications through SYSC 10A, the Handbook chapter on recording telephone conversations and electronic communications. It requires a firm to record calls and keep electronic messages that relate to in-scope activity, such as dealing, arranging deals and managing investments, and to "take all reasonable steps to prevent" staff from using privately owned equipment the firm cannot record or copy (FCA Handbook, SYSC 10A.1.7R). Off-channel, in the FCA's words, means communication outside the monitored, recorded channels a firm has permitted (FCA, August 2025). For a UK compliance officer the hard part is the prevention duty: it cannot be met by retention alone. Botminds' Electronic Communications Surveillance reviews what the firm records and checks each move to another channel for a recorded follow-up, which is the evidence a prevention duty needs.
SYSC 10A is the UK form of Article 16(7) of MiFID II. Since 23 October 2025 it has also carried, in the Handbook itself, recording-policy requirements whose wording mirrors Article 76 of the EU's MiFID II delegated regulation. The figure below sets out what it now asks, provision by provision.
SYSC 10A, provision by provision: eight things a UK firm must do
- SYSC 10A.1.6RRecord and keepRecord calls and keep electronic communications about in-scope activity, on equipment the firm provides or permits.
- SYSC 10A.1.7RPreventTake all reasonable steps to stop staff using privately owned equipment the firm cannot record or copy.
- SYSC 10A.1.8RInclude the near-missesConversations intended to lead to a deal are in scope even if no deal follows.
- SYSC 10A.1.11R–12ARTell clientsNotify clients they are recorded, and that copies are available for five years to them and seven to the FCA.
- SYSC 10A.1.14RKeep for five yearsRecords go to the client on request and are kept five years, up to seven where the FCA asks.
- SYSC 10A.1.15RWrite the policyA written recording policy covering scope, exceptional circumstances, a device register, training and monitoring.
- SYSC 10A.1.15R(7)Monitor itPeriodically check records of orders and transactions, including conversations, on a risk basis.
- SYSC 10A.1.16RKeep it wholeDurable, unalterable storage; minutes of face-to-face meetings; quality, accuracy and completeness.
Does the FCA regulate off-channel communications?
Yes, but not under that name. The FCA's rules on recording telephone and electronic communications are in SYSC 10A, "reaffirmed" in Market Watch 66, and they require firms to "record, monitor and ensure communications related to in-scope activities are auditable", including conversations that lead up to them (FCA, multi-firm review, August 2025). An off-channel message about a trade is simply a communication the firm failed to record, or failed to prevent.
The FCA has also said what it will not do. Its regime "does not explicitly address specific encrypted apps or channels", and it does not intend to write new rules for every scenario. That leaves each firm to decide, and to justify, which tools it can capture and which it must forbid.
Who SYSC 10A applies to: asset managers are inside it
SYSC 10A applies to MiFID investment firms, full-scope UK AIFMs, small authorised AIFMs and residual collective investment scheme operators, UCITS management companies and third-country investment firms with UK branches, among others, when they carry on listed activities in financial instruments from a UK establishment (SYSC 10A.1.1R). The listed activities include managing investments, managing a UK UCITS's investment management function and managing an AIF's portfolio, so a London portfolio manager's call to a broker is in scope.
There are carve-outs. The chapter does not reach, for example, a non-MiFID manager's activity in instruments that are not traded on a trading venue (SYSC 10A.1.4R), and a MiFID optional exemption firm serving mainly retail clients may record calls as written minutes instead. A firm should map its own activities to 10A.1.1R before it decides who is recorded.
The prevention duty: why recording is not enough
SYSC 10A has two halves, and firms tend to build only the first. The recording half says what to capture. The prevention half, 10A.1.7R, says the firm must take all reasonable steps to stop relevant calls and messages happening "on privately-owned equipment which the firm is unable to record or copy". A perfect archive of the firm's own systems meets the first half and says nothing about the second.
The FCA spelled out what reasonable steps look like in January 2021. Firms should assess their policies on privately owned devices, which "might include ensuring clear policies banning the use of privately owned devices for in-scope activities where recording cannot be carried out by the firm", and new communication tools "must be approved by the firms before being used by employees to conduct business activities" (FCA, Market Watch 66). It also named WhatsApp as one of the unmonitored, encrypted apps whose use homeworking had made more likely.
Prevention has to be evidenced like anything else. Since October 2025 the written policy must specify what staff do when "exceptional circumstances arise" and a call cannot be recorded on approved equipment, and the firm "must retain the evidence of such circumstances and make it accessible to the FCA" (SYSC 10A.1.15R(1)(b)). Detecting moves to unrecorded channels, and showing what was done about each one, is how a firm shows its steps were reasonable.
What did the FCA's off-channel communications review find?
The FCA's multi-firm review of off-channel communications, published in August 2025, surveyed eleven wholesale banks of different sizes. All had improved their processes over two years, but breaches continued: three firms reported none, and eight reported 178 breaches of their own policies in twelve months, 131 of them at three firms, with 41% involving staff at director grade or above (FCA, August 2025). The FCA cautioned that a breach of internal policy is not necessarily a breach of its rules, and that a high count may mean better detection rather than worse behaviour.
The FCA's off-channel review in four numbers
11
wholesale banks surveyed, large and small
178
internal off-channel breaches reported by eight of them in twelve months
131
of those breaches at just three firms
41%
involved staff at director grade or above
The practices it saw are a useful map of where UK firms are heading. Banks updated lexicons for channel hopping and for emojis, GIFs, voice notes and video; some added natural language processing alongside lexicons and were exploring AI to filter false alerts; two compared each person's use of approved apps with peers to spot unexpectedly low use. Most gave client-facing staff corporate devices, though the rules do not require it.
Two findings deserve a compliance officer's attention. Recording and transcription vendors did not always perform: the review cites service outages, data that could not be reconciled, missing records and one transcription service that was "largely inaccurate". And the FCA reminded firms that "regulatory responsibilities in relation to SYSC 10A cannot be transferred to third parties". On consequences, firms described bonus caps, promotion limits and dismissal for serious breaches, but the FCA found no evidence of the most severe penalties being used.
FCA call recording requirements: which calls and messages must be recorded?
A firm must record calls and keep electronic communications that relate to its in-scope activities in financial instruments, made with, sent from or received on equipment it provides or permits (SYSC 10A.1.6R). The scope reaches conversations "intended to result in" those activities even when no deal follows (10A.1.8R), and the written policy must identify relevant internal calls and messages as well as external ones (10A.1.15R).
Client instructions that do not come by phone must be captured in a durable medium, and relevant face-to-face conversations recorded in minutes or notes (10A.1.13R). Since October 2025 the minimum content of those notes is set out: date and time, location, attendees, who initiated the meeting, and the relevant order details, price, volume, type and timing (10A.1.16R). A breakfast meeting where a client gives an order is in scope; the note is the record.
Clients must be told once, before the firm provides investment services, that their calls are recorded (10A.1.11R), and since October 2025 that a copy will be available on request for five years to them and seven to the FCA (10A.1.12AR). The underlying European text, Article 16(7) of MiFID II, also bars firms from providing order services by phone to clients who have not been told (Directive 2014/65/EU, Article 16(7)). What the MiFID II voice recording requirements mean for a manager whose phones are rarely used has its own guide.
What is the FCA call recording retention period?
Five years, and up to seven where the FCA requests it. SYSC 10A.1.14R sets that period for every record kept under the chapter, and requires the records to be given to the client involved on request (SYSC 10A.1.14R). The period starts when the record is created, and the record must sit in a durable medium that lets it be replayed or copied but not altered or deleted (10A.1.16R).
Five-plus-two is a ceiling to plan for, not a default to apply. A firm must be able to extend a set of recordings to seven years when asked, which means its archive must support holds by person, line or date. Firms with US affiliates meet a different clock: broker-dealers keep business communications for at least three years, the first two easily accessible (17 CFR 240.17a-4(b)), and advisers keep theirs for five years after the fiscal year of the last entry (17 CFR 275.204-2(e)(1)). Retention follows the strictest rule that applies to each record.
Can UK staff use WhatsApp with clients?
Only if the firm records it. The FCA does not restrict which apps a firm may use, but where in-scope business is done on them, on business devices, it expects the conversations to be "recorded and auditable" (FCA, Market Watch 66). A firm that has an approved capture tool for a messaging app on enrolled devices can allow it; a firm that cannot capture it must forbid it for in-scope business and take reasonable steps to make the ban stick.
The FCA has also warned that it has acted "against individuals and firms for misconduct which involved the use of WhatsApp and other social media platforms to arrange deals and provide investment advice", including trading signals sent to clients. The off-channel risk in the UK is less a recordkeeping fine than the loss of the evidence that would show what was arranged.
How the FCA's approach differs from the SEC's
The two regulators start from similar rules and have used them very differently. The SEC brought group settlements with penalties; the FCA has relied on supervision, guidance and reviews. Asked in 2022 which banks it had fined for lack of voice recording compliance, the FCA answered that there "have been no banks who have been fined just for lack of voice recording compliance", pointing to its 2015 LIBOR case against Deutsche Bank, where an inadequate system for recovering traders' call recordings was part of a wider finding (FCA, FOI9047, March 2022).
Off-channel communications under the FCA and the SEC
UK: FCA, SYSC 10A: Record and keep in-scope calls and messages, and take reasonable steps to prevent unrecordable private devices.
US: SEC, Rules 17a-4 and 204-2: Keep business communications (broker-dealers) or communications about advice, orders, funds and performance (advisers), and supervise.
UK: FCA, SYSC 10A: Recorded: phone conversations are expressly in scope.
US: SEC, Rules 17a-4 and 204-2: No general SEC duty for broker-dealers or advisers to record calls; written communications are kept.
UK: FCA, SYSC 10A: Five years, up to seven at the FCA’s request.
US: SEC, Rules 17a-4 and 204-2: Three years for broker-dealer communications; five for advisers’ records.
UK: FCA, SYSC 10A: Content prescribed since October 2025, including exceptional circumstances and a device register.
US: SEC, Rules 17a-4 and 204-2: Policies and procedures reasonably designed to comply, with the content left to the firm.
UK: FCA, SYSC 10A: Supervision, Market Watch and the August 2025 multi-firm review; no bank fined for recording failures alone as of 2022.
US: SEC, Rules 17a-4 and 204-2: Group settlements: 95 actions and $2.3 billion in penalties to early fiscal 2025, a campaign the current Commission has since disowned.
Neither posture makes the duty lighter. The SEC's April 2026 statement criticised the earlier cases but did not amend Rule 17a-4 or Rule 204-2 (SEC 2026-34), and the history is laid out in what the SEC's off-channel sweeps cost firms. In the UK, the FCA has said it will keep discussing breach data with firms "to identify trends and where further action could be required".
The questions the FCA asked firms to put to themselves
The FCA closed its review with eight questions, and they make a fair self-assessment for any firm in scope of SYSC 10A, not only banks. Each can be answered with evidence, which is the point: the policy must be demonstrable to the FCA on request (SYSC 10A.1.15R(8)).
Eight questions from the FCA's off-channel review, as a self-assessment
- Do employees understand their own responsibility to record every relevant communication?
Training records and attestations show it; a self-disclosure route tests it.
- Does leadership set the tone, and is speaking up encouraged?
41% of the reported breaches were at director grade or above.
- Are there barriers that make the approved channels hard to use?
Poor vendor service can push people off channel, the FCA notes.
- Are recording and capture vendors monitored for performance?
Outages, reconciliation gaps and missing data were all reported; the responsibility stays with the firm.
- Does the surveillance model fit the business model?
Lexicons for the languages, slang and channels the desks actually use.
- Do UK senior managers oversee a global framework’s results?
A single global policy must still meet UK standards in practice.
- Do accountable executives receive the right information?
Breaches by grade, channel and severity, alert dispositions, vendor performance and device use, with trends.
- Do accountable managers act promptly on patterns of non-compliance?
Consequences that are applied, and seen to be.
Where Electronic Communications Surveillance fits for a UK firm
Electronic Communications Surveillance works on what the firm already records: the email archive, dealer chat and Teams, turret recordings and their transcripts, and mobile calls and approved apps on enrolled phones. It does three things the FCA's review points at. Its Off-channel agent checks every "call me", "text me" or "move to another app" against the recorded lines and puts each unmatched move in front of a person. Its Language agent puts English beside every message in the twelve languages the sample firm's lexicons cover, keeping the original as the record. And it turns the month's work into the information an accountable executive needs.
Information for the accountable executive, every number tied to its alerts
The solution does not see a personal phone, and no software can. When a move has no record, the review asks the person to preserve and produce the messages, and Legal decides what follows; the solution keeps the request, the answer and the decision with the alert. Every action carries a named person, a reason and a time, and one export gives the FCA the policy's evidence on request. In the UK the London supervisor countersigns EMEA escalations, and records stay in their region.
Demonstrating the recording rules on request: one export, with hashes
Questions people ask
What is SYSC 10A?
SYSC 10A is the chapter of the FCA Handbook that requires in-scope firms to record telephone conversations and keep electronic communications relating to their activities in financial instruments. It implements Article 16(7) of MiFID II in UK rules and, since October 2025, also sets out the content of the firm's written recording policy.
Does SYSC 10A apply to asset managers?
Yes, for UK establishments that manage investments, UCITS or AIFs in financial instruments within its scope: full-scope and small authorised AIFMs and UCITS management companies are named in SYSC 10A.1.1R. Some activity in instruments not traded on a trading venue is carved out by SYSC 10A.1.4R.
How long must FCA call recordings be kept?
Five years from the date the record is created, and up to seven years where the FCA requests it, under SYSC 10A.1.14R. Records must be stored so they can be replayed or copied but not altered or deleted.
Has the FCA fined a firm for off-channel communications?
In March 2022 the FCA told a freedom-of-information requester that no bank had been fined just for lack of voice recording compliance; its 2015 Deutsche Bank LIBOR notice included a recording failure within a wider finding. Its August 2025 review said it would continue to discuss breach data with firms to see where further action could be required.
Do internal Teams chats need to be recorded under FCA rules?
Where they relate to in-scope activity, yes: the written policy must identify relevant internal calls and electronic communications, under SYSC 10A.1.15R. A chat between a portfolio manager and a dealer about an order is in scope; one about lunch is not. The Teams compliance recording guide covers the policy decisions.
Is a corporate phone required under SYSC 10A?
No. The FCA noted in its 2025 review that most banks issue corporate devices to client-facing staff but that this is not required under its rules. What is required is that in-scope calls and messages are recorded and that private equipment the firm cannot record is kept out of in-scope business.