7-Year Document Retention: A Compliance Guide for Financial Services

Why Seven Years?

The seven-year retention period has become the de facto standard for financial services document retention in the UK, though no single regulation mandates exactly seven years for all document types. The figure emerges from the intersection of several overlapping requirements, and firms adopt it as a practical baseline that satisfies most obligations with a reasonable margin.

Understanding where the number comes from is essential for building a compliant retention policy — because in some cases, seven years is not enough, and in others, retaining documents for too long creates its own regulatory exposure under data protection law.

The Regulatory Landscape

FCA Handbook (SYSC 9). The FCA requires firms to keep orderly records of their business sufficient to enable the FCA to monitor compliance. While SYSC does not specify a universal retention period, it requires records to be retained for as long as is relevant for the purposes for which they were made. For many regulated activities, firms interpret this as the duration of the client relationship plus a post-relationship buffer.

MiFID II (Article 16(6)). Investment firms must retain records of all services, activities, and transactions sufficient to enable the FCA to fulfil its supervisory tasks. The minimum retention period is five years, with the possibility of extension to seven years at the FCA's request. Most firms default to seven years to avoid the risk of a shorter retention being challenged.

Solvency II (Article 45). Insurers must maintain adequate records of their risk management system, including all significant decisions and their rationale. While Solvency II does not specify a numeric retention period, the PRA expects records to be available for supervisory review for a period consistent with the nature of the obligations — typically interpreted as the policy duration plus six years.

HMRC requirements. Companies must retain financial records for at least six years from the end of the relevant accounting period. For self-assessment, individuals must retain records for at least five years after the 31 January submission deadline. The six-year HMRC requirement, combined with the potential for retrospective FCA inquiries, contributes to the seven-year convention.

Limitation Act 1980. The standard limitation period for contract and tort claims is six years from the date of the cause of action. For claims involving latent damage, the period can extend. Retaining signed documents for seven years covers the standard limitation period plus a margin for late-filed claims.

Document Types and Retention Requirements

Not all documents carry the same retention obligation. A compliant policy differentiates by document type:

• Client agreements and terms of business — seven years from the end of the client relationship (FCA, MiFID II)
• Transaction records — seven years from the date of the transaction (MiFID II, HMRC)
• KYC and identity verification documents — five years from the end of the business relationship (Money Laundering Regulations 2017)
• Complaints records — five years from the date of receipt (DISP 1.9)
• Board minutes and governance records — indefinite retention is common practice, though not universally mandated
• Marketing approvals (Section 21 sign-offs) — the FCA expects retention for a reasonable period; three to five years is typical

Storage Requirements

Retention is not merely about duration. The manner in which documents are stored must also satisfy regulatory expectations:

Integrity. Stored documents must be demonstrably unaltered from their original state. For electronically signed documents, this means retaining both the signed PDF and the associated audit trail, including the original document hash. If a document is challenged years later, the firm must be able to prove it has not been modified.

Accessibility. Records must be retrievable promptly. The FCA does not define "promptly," but supervisory practice suggests that records should be producible within days, not weeks. Archival storage that requires engineering intervention to retrieve does not meet this standard.

Confidentiality. Access to retained documents must be controlled. Role-based access with audit logging of who accessed what and when provides both security and evidence of access controls.

Durability. Documents must survive hardware failures, software upgrades, and organisational changes. Cloud storage with cross-region replication and versioning provides durability that on-premise storage typically cannot match.

The retention obligation is not satisfied by storing a document. It is satisfied by storing a document in a manner that preserves its evidential value for the entire retention period.

The Data Protection Tension

The UK GDPR's data minimisation principle (Article 5(1)(c)) creates a tension with long-term retention. Firms must not retain personal data for longer than necessary for the purposes for which it was collected. A blanket "retain everything for seven years" policy may not satisfy the ICO if challenged.

The resolution is a documented retention policy that specifies the legal basis for retention by document type. Where a regulatory obligation mandates retention, Article 6(1)(c) (legal obligation) provides the lawful basis. Where retention is for legitimate business interests (such as limitation period defence), Article 6(1)(f) applies, and a balancing test should be documented.

Practically, this means your retention policy should include automated triggers for review or deletion at the end of the retention period, with documented justification for any continued retention beyond the standard period.

Implementation Checklist

For firms building or reviewing their document retention framework, the following checklist provides a practical starting point:

1. Classify document types — identify which regulations apply to each category and set retention periods accordingly
2. Configure immutable storage — use storage that prevents modification or deletion during the retention period
3. Retain complete audit trails — the signed document without its audit trail is incomplete evidence
4. Implement access controls — restrict access to retained documents by role, with audit logging of all access
5. Automate retention management — set automated review triggers at the end of each retention period
6. Document your policy — record the legal basis for each retention period, the storage mechanism, and the disposal process
7. Test retrieval — regularly verify that retained documents and audit trails can be retrieved within an acceptable timeframe

Conclusion

Seven-year retention is a sensible default for most financial services document types, but it is not a universal answer. A compliant retention policy is specific to document type, grounded in identified regulatory obligations, and balanced against data protection requirements. The cost of getting this wrong is not abstract — it is the moment a regulator asks for a document and you cannot produce it, or the moment the ICO asks why you still hold personal data with no legal basis for retention.