In short
FCA email retention rules sit mainly in SYSC 10A of the FCA Handbook. In-scope firms must keep a copy of relevant electronic communications (SYSC 10A.1.6R) for five years, and up to seven where the FCA requests (SYSC 10A.1.14R), in a durable medium that does not allow the original to be altered or deleted (SYSC 10A.1.16R). Scope depends on the firm.
Get a quote for email archiving for FCA-regulated firms
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Which firms the rules apply to
SYSC 10A is the FCA Handbook chapter on recording telephone conversations and electronic communications. SYSC 10A.1.1R applies it to a list of firm types, including MiFID investment firms, UK AIFMs, UCITS management companies, MiFID optional exemption firms (for the activities covered by the exemption) and third country investment firms, among others. It covers communications about activities in financial instruments such as arranging and dealing in investments, managing investments and some fund management activities, carried on from an establishment in the UK.
SYSC 10A.1.4R then excludes some activities, and the detail of who is in scope is genuinely complicated. Before you design an archive around SYSC 10A, confirm with your compliance adviser which of your activities and people are in scope.
The old home of these rules, COBS 11.8, is shown in the FCA Handbook as deleted; the requirements have sat in SYSC 10A since 3 January 2018. Guidance that still cites COBS 11.8 is out of date.
What SYSC 10A requires for electronic communications
The key rules, as they read in the FCA Handbook in November 2026:
| Rule | What it says, in summary |
|---|---|
| SYSC 10A.1.6R | Take all reasonable steps to record telephone conversations, and keep a copy of electronic communications, relating to in-scope activities, made with, sent from or received on equipment the firm provides or permits |
| SYSC 10A.1.7R | Take all reasonable steps to stop staff using privately owned equipment for relevant communications the firm cannot record or copy |
| SYSC 10A.1.8R | This includes communications intended to result in a transaction, even if no transaction follows |
| SYSC 10A.1.12AR | Tell clients that communications are recorded and that copies are available on request for 5 years to the client and 7 years to the FCA |
| SYSC 10A.1.13R | Client instructions given otherwise than by telephone must be made in a durable medium, such as mail, faxes, emails or notes of meetings |
| SYSC 10A.1.14R | Provide records to the client on request, and keep them for five years and, where requested by the FCA, for up to seven years |
| SYSC 10A.1.15R | Keep a written, technology-neutral recording policy, evaluate it periodically, train staff and monitor compliance |
| SYSC 10A.1.16R | Store records in a durable medium that can be replayed or copied, in a format that does not allow the original to be altered or deleted, with retention running from the date the record is created, and readily accessible to clients on request |
For email, the practical effect is that relevant messages must be captured whatever the user does with their own copy, kept unaltered, and retrievable for the client or the FCA for the full period.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
SYSC 9: general record-keeping
SYSC 10A is not the only rule. SYSC 9.1 covers record-keeping more generally:
- SYSC 9.1.2R: a common platform firm must keep records under that chapter relating to its MiFID business for at least five years.
- SYSC 9.1.2-AR: for MiFID business, records must be kept in a medium that allows ready access, makes corrections and the original content easy to see, and does not allow records otherwise to be manipulated or altered.
- SYSC 9.1.5G: for non-MiFID business, the general principle is that records should be kept for as long as is relevant for the purposes for which they are made.
Other parts of the Handbook, and other law such as the Money Laundering Regulations 2017, set their own periods. Our page on how long a company should keep emails lists the main UK reference points.
How an immutable journaling archive maps to the rules
An email archive is one part of meeting these rules, for email. Here is how the requirements line up with what NinjaOne Archiver does, according to NinjaOne's own material:
| Requirement | What the archive provides |
|---|---|
| Keep a copy of relevant electronic communications | Real-time journaling captures inbound and outbound mail, with attachments and metadata, at server level, including messages a user later deletes |
| Five years, up to seven on request | Retention policies from 30 days to over a decade or unlimited, set as a standard policy or by department or email account |
| Durable medium; original cannot be altered or deleted | Immutable WORM storage with full audit trails |
| Readily accessible to clients and the FCA | eDiscovery by account, date, sender, recipients and keywords, with saved searches, tagging and export |
| Keep records during an investigation | Legal hold freezes retention for held data until the hold is removed |
| Control who can see records | Compliance and Review Officer, Data Protection Officer, Reviewer and Limited Reviewer roles; the IT Admin role cannot open compliance features |
| Show what has been done | Audit log of activity in the archive |
Three points to check when you configure it. First, SYSC 10A.1.16R says retention runs from the date the record is created, so set periods with that start point in mind and confirm how the archive counts them before you rely on a minimum. Second, set the in-scope period as a floor and consider whether the FCA's seven-year request power means you should keep relevant mail longer by default. Third, journaling depends on a working connection to your tenant: NinjaOne's own FAQ says it cannot guarantee a 100% journaling success rate, explains that a journal setup error (often expired credentials) leaves email relying on periodic backups, and says partners are emailed when a tenant needs reauthenticating. SYSC 10A.1.15R expects you to monitor compliance with recording requirements, so include journaling status in that monitoring.
Is email archiving for FCA-regulated firms the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What an email archive does not cover
Being clear about the limits is part of a sound recording policy, which SYSC 10A.1.15R expects to be technology-neutral.
- Telephone recording. SYSC 10A covers phone conversations as well as electronic communications. An email archive does not record calls.
- Other messaging channels. Text messages, WhatsApp and other chat apps on firm or permitted devices are electronic communications too. A Microsoft 365 or Google Workspace email archive does not capture them.
- Teams chats. Private Teams chat backup is available with the NinjaOne Archiver plan, but it is a different mechanism from email journaling: it needs its own credential set-up and activation, and NinjaOne's documentation also refers to an additional charge, which we confirm when we quote. See Teams chat archiving for how it works and what to check.
- Mail sent outside your systems. Journaling captures mail that flows through your Microsoft 365 or Google Workspace tenant. SYSC 10A.1.7R is the rule that deals with private equipment.
Your recording policy should list each channel and how it is captured. The email archive covers the email line of that list well; it is not the whole list.
Setting up an archive for an FCA-regulated firm
We help regulated firms set up NinjaOne Archiver around their recording policy. A typical approach:
- Agree scope with your compliance adviser: which people, mailboxes and activities fall within SYSC 10A, and the periods you will apply.
- Connect the tenant and confirm journaling: for Microsoft 365, NinjaOne creates the journal rule and distribution group after authentication; for Google Workspace, a Gmail routing rule is added in the Google Admin console, for everyone or for a Google group of selected users. See how NinjaOne Archiver is set up and Gmail journaling.
- Create retention policies: a policy for in-scope staff that meets your SYSC 10A period, and a standard policy for everyone else.
- Assign compliance roles: give your compliance team the Compliance and Review Officer, Data Protection Officer or Reviewer roles they need, separate from IT.
- Bring in legacy mail: plan NinjaOne's ingestion of older PST or EML archives so earlier records are held in the same place. See migrating a legacy email archive.
- Show reviewers how to search, hold and export: so requests from clients or the FCA can be answered from the archive.
We confirm the bundle, seat count, storage allowance and where your archive will be held when we quote.
A note on compliance claims
No email archive, ours included, makes a firm compliant with FCA rules. Compliance depends on your scope, policy, people and controls. What an immutable journaling archive does is give you a searchable, unaltered record of email that your compliance team can control, which covers a large part of what SYSC 10A asks of email.
If you are reviewing your recording arrangements, contact us and we can show you how NinjaOne Archiver would sit within your policy.
*This page summarises the FCA Handbook as viewed on 1 November 2026 and is not legal or regulatory advice. Confirm your obligations with your compliance adviser.*
How Forever Systems helps with email archiving
We are an independent UK IT and cyber security provider. We supply NinjaOne SaaS Backup with Archiver for organisations on Microsoft 365 or Google Workspace, and help you get the archive set up, the policies right and the people who need it confident using it.
- Scoping: we look at your mailboxes, leavers, legacy archives and record-keeping obligations, and what your Microsoft 365 or Google Workspace plan already includes, before suggesting anything new
- Set-up: we can configure journaling for Exchange Online or Google Workspace, connect the archive and check that mail is arriving
- Retention and legal hold: we help you turn your email retention policy into archive rules, and show your compliance or HR lead how to search, hold and export
- Leavers and legacy archives: we can help you plan how former employees' mail and older archives are brought across, with the approach confirmed at quote
- Backup alongside the archive: the same NinjaOne per-user licence also covers backup of your Microsoft 365 or Google Workspace data, so recovery and record-keeping are planned together
We work with businesses, schools, charities and public sector organisations. If you also need wider protection, see our independent cloud security guides.
Frequently asked questions
How long does the FCA require emails to be kept?
For firms in scope of SYSC 10A, relevant electronic communications must be kept for five years and, where the FCA requests, for up to seven years (SYSC 10A.1.14R). Other records have their own periods, such as at least five years for MiFID business records under SYSC 9.1.2R.
Is the FCA record-keeping requirement 7 years?
Seven years applies where the FCA requests it. The base period in SYSC 10A.1.14R is five years, extendable to up to seven at the FCA's request, and firms must tell clients copies are available for five years to the client and seven to the FCA.
Does SYSC 10A apply to all FCA-regulated firms?
No. SYSC 10A.1.1R applies it to listed firm types, such as MiFID investment firms, for communications about specified activities in financial instruments, with exclusions in SYSC 10A.1.4R. Confirm your scope with your compliance adviser.
What happened to COBS 11.8?
COBS 11.8 is shown as deleted in the FCA Handbook. The rules on recording telephone conversations and electronic communications have been in SYSC 10A since 3 January 2018.
What does 'durable medium' mean for email records?
SYSC 10A.1.16R requires records to be stored in a durable medium that allows them to be replayed or copied and does not allow the original to be altered or deleted. An immutable WORM archive is designed to meet that kind of requirement for email.
Do financial advisers need email archiving?
Advisers in scope of SYSC 10A must keep relevant electronic communications unaltered for the required period, and a journaling archive is a practical way to do that for email, whether it runs on Microsoft 365 or Google Workspace. Whether you are in scope depends on your permissions and activities, so confirm it with your compliance adviser.
Still have a question about email archiving for FCA-regulated firms?
Ask us and a member of our team will reply by email.