How long must a financial adviser keep client files? The FCA minimum for each type of record, and a retention schedule to copy

The FCA's minimum depends on what the advice was about: indefinitely for a pension transfer, five years for a pension or a life policy, and three years in any other case under COBS 9 and for mortgage advice. Those are floors. A complaint can reach the Financial Ombudsman Service six years after the advice, or later, so most firms need a written schedule that goes past the minimum and says why.

The minimum for each record

COBS 9.5.3R says a firm "need not retain its records relating to suitability if the client does not proceed with the recommendation". Whether to keep them anyway is a decision for the schedule.

COBS 9.5.2R belongs to COBS 9. Advice on funds and shares may sit under COBS 9A and the MiFID record rules instead, where COBS 9A.4.2AR requires a record of each suitability assessment, the time and date of the advice, the instrument recommended and the suitability report. Ask compliance which chapter each line of your business falls under, and whether the firm is a common platform firm or uses the MiFID optional exemption.

For everything outside MiFID business, SYSC 9.1.5G gives the general principle: "records should be retained for as long as is relevant for the purposes for which they are made".

Why the minimum can be too short

DISP 2.8.2R sets the time limits for the ombudsman. It cannot consider a complaint referred more than six months after the firm's final response, or more than six years after the event complained of or, if later, three years from the date the complainant became aware, or ought reasonably to have become aware, of a cause for complaint. The ombudsman can set these limits aside in exceptional circumstances.

Take advice given on 1 October 2026.

In the three-year case, COBS would let the firm destroy the suitability record three years before the six-year limit runs out, and in the five-year case one year before. The three-year limb has no end date written into the rule, because it runs from when the client became aware. A firm with no file cannot show what it was told, what it recommended or why.

The FCA's ongoing advice work shows the gap. On 15 February 2024 it asked 22 of the largest advice firms for data "covering the previous 7 years", and on 24 February 2025 it said firms checking their own delivery "should look back to 2018". A firm that had deleted its 2018 files after five years, in 2023, could not show the reviews it delivered. The evidence pack guide lists what each year needs.

Why keeping everything for ever fails too

Article 5(1)(e) of the UK GDPR says personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". The Information Commissioner's Office puts it as "You must not keep personal data for longer than you need it", and expects a policy with standard retention periods.

Regulation 40 of the Money Laundering Regulations 2017 goes further for identity documents. Once the five years are up, the personal data in those records must be deleted unless another law requires the firm to keep it, it is needed for legal proceedings, or the client has agreed. A passport copy has an end date even when the advice file does not.

So each line of the schedule needs a period and a reason.

A retention schedule to copy

Fill in the third column with your compliance function. The last column lists the reasons to weigh.

Add two columns of your own: where each record is held, and who deletes it.

Three steps this week

1. List where the records are. The back office, the shared drive, inboxes, the meeting recorder and paper. Our guide to recording client meetings deals with the recordings, and the guide to AI and client data with tools that hold copies.
2. Ask your professional indemnity insurer in writing what the policy expects you to keep and for how long. We could not confirm one market-wide figure.
3. Flag the indefinite files. Before any clear-out or change of back-office system, mark every pension transfer, conversion, opt-out and FSAVC file so that no deletion rule can touch it.

The adviser, and compliance where the firm's procedures require it, reviews and signs anything a tool drafts, and that includes a retention schedule or a list of files to delete. This page is general information, not legal, regulatory or financial advice.