CONTROL CONTEXT / COMPLIANCE

A control is stronger
when its scope is clear.

Start with the rule that applies to your firm. Then define the evidence your recording process needs to produce.

Educational information, not legal advice. Confirm applicability with counsel.

01 / APPLICABILITY

There is no single financial-services recording rule.

Confirm legal entities, registrations, jurisdictions, activities, instruments, approved channels and record categories with counsel. Retention, legal holds, consent, privacy and supervisory procedures cannot be inferred from an audience label.

Research checked 26 September 2026. US rule text reviewed against the 24 September 2026 eCFR issue. Live links below should be rechecked before publication.

CFTC 1.31 / 1.35

Preservation starts with scope.

Section 1.31 governs preservation and production of required regulatory records; it is not a universal call-recording mandate. Unless another provision specifies otherwise, required oral communications have a minimum one-year retention period. Other records have different schedules. Section 1.35 imposes entity- and activity-specific requirements, including particular oral pre-trade communications. Do not assume every commodity firm, CTA or introducing broker has identical duties.

Test evidence: authorized line inventory, recording retrieval, timestamps and exception history. A test-time retention setting is not proof of future preservation.

Read CFTC 1.31 ↗ Read CFTC 1.35 ↗

SEC Rule 17a-4

Preservation is more than a file format.

The broker-dealer rule addresses retention by record category, electronic recordkeeping, access and production. Section (f) permits qualifying audit-trail systems or non-rewriteable, non-erasable preservation. It also addresses automatic verification of storing and retaining processes, download/transfer capabilities and redundancy. It does not impose one blanket telephone-recording duty on every financial firm or RIA.

Test evidence could support a firm’s control record. It does not replace the recordkeeping system’s own verification requirements or establish 17a-4 compliance.

Read SEC 17a-4 ↗

FINRA 3110 / 4511 / 3170

Different rules. Different obligations.

Rule 3110 concerns supervision; 4511 concerns required books and records. Its six-year fallback is not a universal voice-retention period. Rule 3170’s specific taping regime applies to defined taping firms—not all FINRA members. Covered recordings under 3170 have at least three years’ retention, the first two easily accessible.

Documented exceptions and reviewer records could help document a control process. The member retains supervisory responsibility.

Read FINRA 3110 ↗ Read FINRA 4511 ↗Read FINRA 3170 ↗

MiFID II Article 16(7)

Not only conversations that end in a trade.

For EU investment firms in scope, relevant conversations relating to own-account transactions and specified client-order services include communications intended to result in those activities even when none results. Client notification, permitted equipment and access obligations matter. Retention is five years, and up to seven where requested by the competent authority; national implementation and firm scope require review.

Test scope should reflect the firm’s covered channels, not only completed trades. A sample test does not establish completeness of all covered records.

Read MiFID II Article 16 ↗

FCA SYSC 10A

Policy, equipment, monitoring and record quality.

The UK chapter has its own firm and activity scope, exclusions and operational controls. Relevant requirements cover recording policies, equipment, proportionate monitoring, and the quality, accuracy and completeness of records. Retention is five years and up to seven where the FCA requests it. Client notices also need the separate access provisions, including copies available for five years to clients and seven to the FCA, considered. Some qualifying optional-exemption firms may use written notes under specified conditions.

Operational tests could be one input to the firm’s monitoring framework, not a substitute for that framework or counsel’s applicability assessment.

Read FCA SYSC 10A ↗

02 / THE COST OF A GAP

A working phone is not evidence
of a complete recording.

CFTC / NOVEMBER 2019

$1 million

The CFTC ordered Goldman Sachs & Co. LLC to pay a civil monetary penalty over missing required audio recordings. Its release says a hardware failure after a security patch went undetected for approximately three weeks and unavailable recordings impeded an investigation.

Read the official release ↗
CFTC / AUGUST 2023

$5.5 million

The CFTC ordered Goldman Sachs to pay for further audio recordkeeping failures and violation of the earlier order. It described mobile-recording hardware and virtual-turret software issues, each affecting thousands of calls.

Read the official release ↗

These settled cases concern their own facts and swap-dealer obligations. They are not a per-gap price list, an exposure forecast, or evidence that Assure would have prevented the failures.

Keep messaging enforcement separate.

The CFTC’s September 2022 announcement of over $710 million in penalties concerned unapproved written communications, including texts, WhatsApp and Signal—not an established voice-recorder outage. Read the official off-channel release ↗

PUT THE QUESTIONS TO WORK

Take the checklist into your next review.

NEXT / DEFINE THE TEST

Start with the paths
you need to trust.

Bring your recording architecture. Let’s define the right test.

Request a demo