# How long must a financial adviser keep client files? The FCA minimum for each type of record, and a retention schedule to copy > COBS 9.5.2R sets the minimum: indefinitely for pension transfers, five years for pensions and life policies, three years otherwise. A schedule to copy. - Page to cite: https://aeolookup.com/financial-advisers/how-long-keep-client-files-financial-adviser-fca-retention-periods/ - Publisher: AEO Lookup (https://aeolookup.com/) - Section: Financial advisers and mortgage brokers, Consumer Duty, the FCA and client data - Published 1 October 2026 - Key fact: COBS 9.5.2R sets the minimum time to keep suitability records: indefinitely for a pension transfer, pension conversion, pension opt-out or FSAVC; five years for a life policy, a personal or stakeholder pension or defined contribution occupational scheme benefits; three years in any other case. Mortgage advice records are three years (MCOB 4.7A.25R). The Financial Ombudsman Service can consider a complaint brought within six years of the event or, if later, three years of the client becoming aware (DISP 2.8.2R), so the minimum can end before the risk does. - Sources: FCA Handbook COBS 9.5.1G, 9.5.2R and 9.5.3R, COBS 9A.4.2AR and 9A.4.3R, SYSC 9.1.2R and 9.1.5G, SYSC 10A.1.14R, MCOB 4.7A.25R, DISP 1.9.1R and DISP 2.8.2R, each read in a browser 2026-10-01; Money Laundering Regulations 2017, regulation 40, and UK GDPR Article 5(1)(e), on legislation.gov.uk, read 2026-10-01; ICO guidance on storage limitation, read 2026-10-01; FCA ongoing financial advice services review, 24 February 2025, read in a browser 2026-10-01. General information, not legal or regulatory advice. The FCA's minimum depends on what the advice was about: indefinitely for a pension transfer, five years for a pension or a life policy, and three years in any other case under COBS 9 and for mortgage advice. Those are floors. A complaint can reach the Financial Ombudsman Service six years after the advice, or later, so most firms need a written schedule that goes past the minimum and says why. ## The minimum for each record | Record | Minimum period | Rule | |---|---|---| | Suitability records for a pension transfer, pension conversion, pension opt-out or FSAVC | Indefinitely | COBS 9.5.2R(1) | | Suitability records for a life policy, personal pension, stakeholder pension or benefits in a defined contribution occupational scheme | Five years | COBS 9.5.2R(2) | | Suitability records in any other case | Three years | COBS 9.5.2R(4) | | Suitability assessment records for insurance-based investment products | At least the duration of the relationship between the firm and the client | COBS 9A.4.3R | | Records of MiFID business kept by a common platform firm | At least five years | SYSC 9.1.2R | | Mortgage advice: the customer information and why the advice was suitable | Three years from the date the advice was given | MCOB 4.7A.25R | | Recorded calls and meeting records that fall under SYSC 10A | Five years, and up to seven where the FCA asks | SYSC 10A.1.14R | | Complaint records | Three years from the date the complaint was received | DISP 1.9.1R | | Identity checks and other customer due diligence documents | Five years from the date the business relationship ends | Money Laundering Regulations 2017, regulation 40 | COBS 9.5.3R says a firm "need not retain its records relating to suitability if the client does not proceed with the recommendation". Whether to keep them anyway is a decision for the schedule. COBS 9.5.2R belongs to COBS 9. Advice on funds and shares may sit under COBS 9A and the MiFID record rules instead, where COBS 9A.4.2AR requires a record of each suitability assessment, the time and date of the advice, the instrument recommended and the suitability report. Ask compliance which chapter each line of your business falls under, and whether the firm is a common platform firm or uses the MiFID optional exemption. For everything outside MiFID business, SYSC 9.1.5G gives the general principle: "records should be retained for as long as is relevant for the purposes for which they are made". ## Why the minimum can be too short DISP 2.8.2R sets the time limits for the ombudsman. It cannot consider a complaint referred more than six months after the firm's final response, or more than six years after the event complained of or, if later, three years from the date the complainant became aware, or ought reasonably to have become aware, of a cause for complaint. The ombudsman can set these limits aside in exceptional circumstances. Take advice given on 1 October 2026. | Advice | Minimum retention ends | Six years after the event | |---|---|---| | A three-year case under COBS 9.5.2R(4) | 1 October 2029 | 1 October 2032 | | A five-year case, such as a personal pension | 1 October 2031 | 1 October 2032 | | A pension transfer | Never | 1 October 2032 | In the three-year case, COBS would let the firm destroy the suitability record three years before the six-year limit runs out, and in the five-year case one year before. The three-year limb has no end date written into the rule, because it runs from when the client became aware. A firm with no file cannot show what it was told, what it recommended or why. The FCA's ongoing advice work shows the gap. On 15 February 2024 it asked 22 of the largest advice firms for data "covering the previous 7 years", and on 24 February 2025 it said firms checking their own delivery "should look back to 2018". A firm that had deleted its 2018 files after five years, in 2023, could not show the reviews it delivered. The [evidence pack guide](https://aeolookup.com/financial-advisers/fca-ongoing-advice-review-evidence-pack-small-firm/) lists what each year needs. ## Why keeping everything for ever fails too Article 5(1)(e) of the UK GDPR says personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". The Information Commissioner's Office puts it as "You must not keep personal data for longer than you need it", and expects a policy with standard retention periods. Regulation 40 of the Money Laundering Regulations 2017 goes further for identity documents. Once the five years are up, the personal data in those records must be deleted unless another law requires the firm to keep it, it is needed for legal proceedings, or the client has agreed. A passport copy has an end date even when the advice file does not. So each line of the schedule needs a period and a reason. ## A retention schedule to copy Fill in the third column with your compliance function. The last column lists the reasons to weigh. | Record | Minimum | Our period | Reason to record | |---|---|---|---| | Pension transfer, conversion, opt-out and FSAVC files | Indefinitely | Indefinitely | COBS 9.5.2R(1) | | Pension and life policy advice files | 5 years | [firm's period] | COBS 9.5.2R(2); DISP 2.8.2R limits; insurer's terms | | Other investment advice files | 3 years under COBS 9.5.2R(4); 5 years where SYSC 9.1.2R applies | [firm's period] | The rule that applies; DISP 2.8.2R limits; insurer's terms | | Mortgage advice files | 3 years | [firm's period] | MCOB 4.7A.25R; DISP 2.8.2R limits | | Ongoing service evidence for each year: invitation, questionnaire, outcome | See advice file | [firm's period] | FCA look-back to 2018 | | Meeting recordings and notes | 5 years, 7 on request | [firm's period] | SYSC 10A.1.14R, if in scope | | Complaint records | 3 years from receipt | [firm's period] | DISP 1.9.1R | | Identity and due diligence documents | 5 years after the relationship ends | 5 years, then delete | Regulation 40 | Add two columns of your own: where each record is held, and who deletes it. ## Three steps this week 1. **List where the records are.** The back office, the shared drive, inboxes, the meeting recorder and paper. Our guide to [recording client meetings](https://aeolookup.com/financial-advisers/recording-client-meetings-ai-note-taker-sysc-10a-script/) deals with the recordings, and the guide to [AI and client data](https://aeolookup.com/financial-advisers/ai-client-data-advice-firm-fca-consumer-duty/) with tools that hold copies. 2. **Ask your professional indemnity insurer in writing** what the policy expects you to keep and for how long. We could not confirm one market-wide figure. 3. **Flag the indefinite files.** Before any clear-out or change of back-office system, mark every pension transfer, conversion, opt-out and FSAVC file so that no deletion rule can touch it. The adviser, and compliance where the firm's procedures require it, reviews and signs anything a tool drafts, and that includes a retention schedule or a list of files to delete. This page is general information, not legal, regulatory or financial advice. ## Short answers from this page **How long does a financial adviser have to keep client files under FCA rules?** COBS 9.5.2R sets the minimum for suitability records: indefinitely for a pension transfer, pension conversion, pension opt-out or FSAVC; five years for a life policy or a personal, stakeholder or defined contribution occupational pension; three years in any other case. Mortgage advice records are three years under MCOB 4.7A.25R. Complaints can reach the ombudsman after six years, so many firms keep files longer. --- ![](https://aeolookup.com/img/d/owner-line.png) General information for UK small firms, not legal, tax or financial advice.