MiFID 2: Keeping it on record

With implementation of the revised Markets in Financials Instruments Directive (MiFID 2) and Regulation (MiFIR) approaching fast, and the need for EU Member States to have finalised any necessary transposition measures 6 months before then (by 3 July 2017), firms are turning their focus to the key changes the MiFID 2 package will mean for their business. The changes affect every level of business, internal to the firm and client-facing.

In this article, Emma Radmore looks at the changes MiFID 2 makes to a firm's organisational requirements in respect of record keeping and the recording of communications.

Where are the changes?

At a high level, the changes are set out in Article 16 of MiFID 2. These provide that it is a requirement on a firm's home Member State to ensure that investment firms have in place general policies and procedures that will ensure compliance of the firm and its managers, employees and tied agents with a number of high level principles, including conflicts of interest, product manufacture, distribution and governance, outsourcing of key functions, protection of clients' money and assets, and the keeping of records of communications and transactions. For record keeping and recording, the key provisions are in paragraphs 6 and 7 of Article 16:

Record keeping (para 6)

Investment firms must arrange for records to be kept of all services, activities and transactions undertaken which are sufficient to enable the competent authority to fulfil its supervisory tasks and to perform the enforcement actions under the MiFID 2 and Market Abuse Regulation packages, and in particular to ascertain that the investment firm has complied with all obligations including those with respect to clients or potential clients and to the integrity of the market.

Telephone and other recording (para 7)

Records shall include the recording of telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders. The requirement extends to communications that are intended to result in these transactions even if they do not in fact happen.

Investment firms must take all reasonable steps to record relevant telephone conversations and electronic communications that are made with, sent from or received by equipment provided by the investment firm to an employee or contractor or the use of which by an employee or contractor has been accepted or permitted by the investment firm.

An investment firm has to notify new and existing clients that telephone communications or conversations between the investment firm and its clients that result or may result in transactions will be recorded and may make this notification once, before the provision of investment services to new and existing clients, and cannot provide relevant services to clients by phone if they have not been properly notified.

Orders may be placed by clients through other channels, but this must be done in a durable medium such as mails, faxes, emails or documentation of client orders made at meetings. In particular, the content of relevant face-to-face conversations with a client may be recorded by using written minutes or notes. MiFID 2 says these orders shall be considered equivalent to orders received by telephone.

An investment firm shall take all reasonable steps to prevent an employee or contractor from making, sending or receiving relevant telephone conversations and electronic communications on privately-owned equipment which the investment firm is unable to record or copy.

The records kept in accordance with the recording requirements shall be provided to the client involved upon request and shall be kept for a period of five years and, where requested by the competent authority, for a period of up to seven years.

Delegated legislation

These requirements are wide ranging, and the EU has included significant detail on what it expects Member States to require of investment firms in pieces of delegated legislation. Article 16 allowed the Commission to make delegated legislation embellishing on each aspect of it. Relevant to the record keeping and recording requirements is in the Delegated Regulation the European Commission has made under MiFID 2. The choice of instrument is interesting. The Level 1 measure is a Directive, which means its requirements must be transposed into national laws as they do not have the direct applicability that a Regulation has, and are therefore subject at least to a small degree of national interpretation. That said, MiFID 2 is a maximum harmonisation Directive, with little scope for Member State discretion. However, the choice of the Regulation as an implementing measure means the (more detailed) requirements set out in it will apply directly in all Member States without the national legislators having to take measures to implement it. Given the normal delay in some Member States in publishing implementing measures, this could in theory have the interesting effect that secondary measures are in force before primary measures have been finalised.

One of the key aspects of investor protection under MiFID 2 is that acts that are preparatory to an investment service or activity should be considered an integral part of them. This means that even if the activity or service envisaged does not take place, for whatever reason, firms will still have incurred compliance obligations in relation to them, including the obligation to keep records.

Section 8 of the delegated Regulation addresses these issues.

General record keeping requirements

Article 72 provides:

• How to keep records:  Investment firms must keep records in a medium that allows the storage of information in a way accessible for future reference by the competent authority, and in such a form and manner that the following conditions are met:
  • the competent authority is able to access them readily and to reconstitute each key stage of the processing of each transaction
  • it is possible for any corrections or other amendments, and the contents of the records prior to such corrections or amendments, to be easily ascertained
  • it is not possible for the records otherwise to be manipulated or altered
  • it allows IT or any other efficient exploitation when the analysis of the data cannot be easily carried out due to the volume and the nature of the data
  • the firm’s arrangements comply with the record keeping requirements irrespective of the technology used.
• How long to keep records: investment firms shall keep at least the records identified in Annex I to the Regulation depending upon the nature of their activities. The list of records identified in Annex I is without prejudice to any other record-keeping obligations arising from other legislation.
• What the records should include: investment firms shall also keep records of any policies and procedures they are required to maintain pursuant to the MiFID 2 and MAR packages and their respective implementing measures in writing. 

It also provides that competent authorities may require investment firms to keep additional records to the list identified in Annex I to the Regulation.

Record keeping requirements relating to client orders

Article 74 deals with record keeping of client orders and decision to deal.

It states that an investment firm shall, in relation to every initial order received from a client and in relation to every initial decision to deal taken, immediately record and keep at the disposal of the competent authority at least the details set out in Section 1 of Annex IV to the Regulation to the extent they are applicable to the order or decision to deal in question, and consistently with any records that MiFIR requires firms to keep of the relevant transactions.

Article 75 addresses record keeping of transactions and order processing, and requires that investment firms shall, immediately after receiving a client order or making a decision to deal to the extent they are applicable to the order or decision to deal in question, record and keep at the disposal of the competent authority at least the details set out in Section 2 of Annex IV again, consistent with any records it is required to keep under MiFIR.

Recording of communications

Article 76 addresses recording of telephone conversations or electronic communications. It requires investment firms:

• to establish, implement and maintain an effective recording of telephone conversations and electronic communications policy, set out in writing, and appropriate to the size and organisation of the firm, and the nature, scale and complexity of its business. The policy is to include:
  • the identification of the telephone conversations and electronic communications, including relevant internal telephone conversations and electronic communications, that are subject to the recording requirements
  • the specification of the procedures to be followed and measures to be adopted to ensure the firm’s compliance with the third and eighth subparagraphs of MiFID 2 (that is, the requirements on communications made with equipment belonging to, or approved for use by, the firm; and orders places using other mediums including face to face) and where exceptional circumstances arise and the firm is unable to record the conversation/ communication on devices issued, accepted or permitted by the firm. Evidence of such circumstances shall be retained and shall be accessible to competent authorities.
• to ensure that the management body has effective oversight and control over the policies and procedures relating to the firm’s recording of telephone conversations and electronic communications
• to ensure that the arrangements to comply with recording requirements are technology-neutral. Firms shall periodically evaluate the effectiveness of the firm’s policies and procedures and adopt any such alternative or additional measures and procedures as are necessary and appropriate. At a minimum, such adoption of alternative or additional measures shall occur when a new medium of communication is accepted or permitted for use by the firm
• to keep and regularly update a record of those individuals who have firm devices or privately owned devices that have been approved for use by the firm
• to educate and train employees in procedures governing the requirements on recording of communications
• to monitor compliance with the recording and record-keeping requirements by periodically monitoring the records of transactions and orders subject to these requirements, including relevant conversations. Such monitoring shall be risk based and proportionate
• to demonstrate the policies, procedures and management oversight of the recording rules to the relevant competent authorities upon request.

It then requires firms, before providing investment services and activities relating to the reception, transmission and execution of orders to new and existing clients, to inform the client of the following:

• that the conversations and communications are being recorded
• that a copy of the recording of such conversations with the client and communications with the client will be available on request for a period of five years and, where requested by the competent authority, for a period of up to seven years.

Finally, it requires firms to record in a durable medium all relevant information related to relevant face-to-face conversations with clients. The information recorded shall include at least the following:

• date and time of meetings
• location of meetings
• identity of the attendees
• initiator of the meetings
• relevant information about the client order including the price, volume, type of order and when it shall be transmitted or executed.

Firms must store records in a durable medium, which allows them to be replayed or copied and must be retained in a format that does not allow the original record to be altered or deleted; and so that they are readily accessible and available to clients on request.

Firms shall ensure the quality, accuracy and completeness of the records of all telephone recordings and electronic communications.

The period of time for the retention of a record shall begin on the date when the record is created.

What are the records?

The records specified in the annex to the Delegated Regulation span many other requirements of MiFID 2 and MiFIR, and include the requirement to keep records of:

• information to clients
• client agreements
• suitability and appropriateness assessments
• aggregation and allocation of client transactions
• client orders and decisions to deal
• transactions and order processing
• required reports to clients
• client financial instruments held by the firm
• client funds held by the firm
• use of client financial instruments
• information about costs and charges
• information about the firm and its services, financial instruments and safeguarding of client assets
• marketing information (except where marketing is done orally)
• investment advice to retail clients
• investment research
• the firm's business and internal organisation
• compliance reports
• conflict of interest record
• inducements
• risk management reports
• internal audit reports
• complaints handling records
• records of personal transactions
• and, in Annex IV, specific record keeping requirements in relation to client orders and decisions to deal to ensure all relevant details of the transaction and its timing are captured.

What are the UK regulators doing?

As the UK regulators have stressed on many occasions, the intention is to fully implement MiFID 2, notwithstanding Brexit. As a result, between HM Treasury, the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA), there are currently consultations on how almost all of MiFID 2 will be reflected in UK law and regulation. The record keeping and recording requirements will be addressed by FCA requirements (although certain other of the general organisational requirements in Article 16 of MiFID 2 will be addressed in PRA rules for those firms that are MiFID investment firms and are regulated by both PRA and FCA).

Currently, FCA rules include detailed record keeping requirements, in line with the current MiFID requirements and additional requirements stemming from other EU or domestic legislation. The requirements are set out in a schedule to each relevant module of the FCA's Handbook of Rules and guidance. The rules on recording of communications are currently in rule 11.8 of the Conduct of Business Sourcebook (COBS).

Recording of communications

FCA's third consultation paper (CP16/29) addresses the changes FCA proposes to make to its rules in respect of telephone recording. It notes that, although MiFID 2 introduces this requirement for the first time, it has in fact had rules in place since 2009. As a result, UK regulatory requirements will need significantly less change in this area than other Member States that have not introduced their own domestic obligations. FCA rules

FCA notes that this is one of the MiFID 2 provisions that is a "minimum harmonisation" provision and that, therefore, it can if it wishes apply the requirements for recording of communications more widely. As a result, FCA plans to continue to apply the taping regime to discretionary investment managers, and will remove the current exemption for calls that are recorded by their brokers. It will apply a similar approach to firms that are carrying out collective portfolio management activities outside the scope of MiFID, and will also extend its rules to corporate finance business. One tenet of FCA's consultations to date on MiFID 2 implementation is that it will, so long as it is proportionate to do so, apply MiFID rules to activities of non-MiFID firms. It considers that the taping regime is a valuable means of gathering evidence in the context of market abuse and related regulatory breaches and so is just as relevant to non-MiFID firms as to MiFID firms. As a result, it will continue to apply its rules to non-MiFID firms, including those that carry on energy and oil market activity and to the so called "article 3" firms that are exempt from MiFID 2 because of the limited nature of their business. It thinks taping is useful in the context of complaints handling, but has indicated it is open to considering whether there is a more cost-effective method of achieving these protections.

In order to implement the MiFID 2 requirements into its rules, FCA plans to delete the current COBS 11.8 (and relevant rules in COBS 18 for the specialist firms to whom FCA extends these rules) and replace it with similar provisions in its Senior Management Arrangements, Systems and Controls Sourcebook (SYSC). The new SYSC provisions (in SYSC 10A) will contain the current FCA rules as modified by MiFID 2, with the extensions discussed above. FCA will also, as MiFID 2 requires, apply a taping obligation to financial advisers who are investment firms, and seeks views on applying the same rules to those who are article 3 firms.

FCA notes the main areas of change are:

• the retention period under MiFID 2 is five years (with the option to extend to seven), whereas FCA's current requirement is for six months
• MiFID 2 requires recording of conversations and communications with all clients where these relate to/ intend to lead to the conclusion of a transaction, even where the transaction is not concluded. FCA rules currently apply only to communications with professional clients and eligible counterparties and not to all instruments – MiFID 2 provisions apply to all financial instruments
• MiFID 2 set out more prescriptive organisational requirements, and does not include any exemptions or exceptions to the requirement to record.

FCA supports the MiFID 2 standards, commenting they align with its regulatory objectives, for instance in requiring employees to be trained, requiring firms to keep records of employees who use mobile devices and monitoring for compliance with regulatory requirements. It also notes MiFID 2 includes a "reasonableness" standard so firms can adopt measures that suit their business. As a result, it does not think UK firms will need to make as many changes as they may first think. The main costs will be incurred by those who are currently not covered by or are exempt from the recording requirement, who will incur the one-off cost of putting in place compliant procedures. Although FCA acknowledges there will be a cost to this, it also comments the available taping technology is both better and cheaper than it was when FCA first introduced the taping requirement.

Record keeping

FCA also proposes changes to its SYSC requirements in respect of record-keeping requirements. It addressed these initially in its consultation CP16/19, and has now embellished on the proposals as required in its latest consultation. FCA notes the knock-on effect of increased reporting requirements in related areas such as customer complaints – where MiFID 2 now requires further record keeping in relation to complaints from non-retail customers.

In principle, FCA has amended SYSC to reflect its own record-keeping requirements and to refer to those in articles 21 and 72 of the MiFID 2 Delegated Regulation (which it refers to as the MiFID Ord Regulation). Its approach in principle is not to copy out the relevant EU provisions, but to refer to them. Annoyingly for UK firms, technology appears to prevent FCA providing links to the relevant materials in the online version of its rules. It has in this instance provided in a schedule to SYSC what it describes in its consultation as a "quick overall view" of the relevant record keeping requirements, with the caution that it is not a complete statement of the requirements and should not be relied upon as if it were.

The new SYSC rules in principle require records to be kept for five years, although in some cases FCA has reserved the right to require them to be kept for seven.

Has PRA done anything?

PRA has also consulted on MiFID 2 implementation. However, its proposals in these areas are minimal, predominantly consisting of a proposal to amend the Record Keeping part to require compliance with the Delegated Regulation.

What next?

FCA has recently published its fourth consultation paper on MiFID 2 implementation, and plans to provide feedback on all its consultations in the first part of 2017, with a view to publishing the final (or near-final) rules by the July deadline. In the meantime, firms should be preparing their gap analyses and compliance plans based on the current consultations. Firms that are investment firms for the purposes of MiFID 2 can be relatively confident the proposals will not change much. Others, especially article 3 financial advisers, may be more inclined to follow industry discussions closely, to see whether there may be some alternative proposal. However, no-one can afford to wait for the final rules, if they are to have made all necessary changes to their policies and procedures by 3 January 2018.