What must an investment firm record of telephone calls and electronic communications?

The duty covers telephone conversations and electronic communications relating to transactions the firm concludes when dealing on its own account and to client-order services, meaning the reception, transmission and execution of orders. It includes conversations and communications intended to result in such transactions, even if no transaction is concluded, and relevant internal conversations. The firm must take every reasonable step to record calls made or received on equipment it provides or whose use it has approved.

Before providing these services, the firm informs both new and existing clients that calls and communications with them are being recorded, and that they can ask for a copy for five years, or up to seven years where CySEC requires. The notice can be given once, before the services start, in the language used for the services. A firm may not offer telephone order services to a client who has not been told in advance.

The firm needs a written recording policy suited to its size, organisation and business. It sets out which conversations are recorded and what happens in exceptional situations where recording is impossible; the firm must keep evidence of those situations for CySEC. The management body oversees the policy, and the arrangements are technology-neutral: whatever channels the firm allows, from phone lines to messaging apps, must be captured. The firm evaluates the effectiveness of these arrangements periodically and, at a minimum, adopts additional measures whenever it accepts or permits a new means of communication. It keeps a list of the people who have firm devices or approved private devices, trains staff, monitors records on a risk basis and must be able to show CySEC its policies.

Records are stored on a durable medium that allows them to be replayed or copied and prevents the original from being altered or deleted, and they must be complete, accurate and easy to find. The retention period starts on the day the record is created: five years, extended to up to seven years at CySEC's request. Clients can get a copy on request.

Orders can also arrive by letter, fax, e-mail or in person. Relevant information from face-to-face conversations with clients must be recorded on a durable medium, for example in written minutes or notes, and orders received in this way are treated as equivalent to orders received by telephone. At a minimum, they show the date and time of the meeting, where it took place, who attended, who initiated it, and the relevant details of the client's order, including the price, volume and type of order and when it should be transmitted or executed.