MiFID II recording requirements, and what recordings prove

Client health score: four inputs (contact, tone, open issues, portfolio), the four bands, and two synthetic Clients showing why direction matters more than level

Most firms meet the MiFID II recording rule as an archiving duty. The same recordings already hold the path to each recommendation, which is the part supervisors now find missing from suitability files.

What does MiFID II Article 16(7) require?

MiFID II Article 16(7) requires investment firms to record telephone conversations and electronic communications that relate to dealing on own account and to the reception, transmission and execution of Client orders. It covers communications intended to lead to a transaction, even when none follows. Records are kept for five years, or up to seven where the competent authority asks.

The rule sits in Directive 2014/65/EU (MiFID II) and is detailed in Article 76 of Commission Delegated Regulation (EU) 2017/565. In Luxembourg it is supervised by the CSSF, in Germany by BaFin, and in the United Kingdom it lives on in the FCA’s SYSC 10A. Switzerland is outside MiFID II and documents advice under its own Financial Services Act (FinSA).

Which conversations are in scope?

The trigger is the order, not the channel. Article 16(7) covers communications relating to dealing on own account and to the reception, transmission and execution of Client orders. It also covers communications intended to result in those transactions, even when the Client decides not to trade. That second limb is why advice falls in scope: ESMA’s Q&A says that when advice is given with the intention of providing an order service, its content must be recorded (ESMA Q&A 1779). A 2025 answer extends this to conversations that only present investment options, where no trade is possible during the call but one may follow (ESMA Q&A 2416).

Internal communications count too. Article 76(1) of the Delegated Regulation asks the firm’s written recording policy to identify the relevant internal conversations as well as those with Clients.

Which channels?

Article 76(3) requires the arrangements to be technology-neutral. In practice that means:

Fixed and mobile telephony on devices the firm provides, or whose use it has accepted or permitted.
Electronic communications: email, chat, instant messaging and video meetings such as Microsoft Teams.
New media: the firm must re-evaluate its arrangements at least whenever it accepts or permits a new medium of communication (Article 76(3)).

The firm must keep an up-to-date register of the people who hold firm devices or approved private devices (Article 76(4)). It must take all reasonable steps to stop employees using private equipment it cannot record or copy (Article 16(7)).

How long must recordings be kept?

Five years, extended to up to seven where the competent authority requests it (Article 16(7)). The retention period starts on the day the record is created (Article 76(11)). Records must be stored in a durable medium that can be replayed or copied and that does not allow the original to be altered or deleted (Article 76(10)).

What must Clients be told?

Before providing order-related services, the firm tells new and existing Clients that conversations and communications are recorded, and that a copy is available on request for five years, or up to seven (Article 76(8)). The notice is given in the language in which the service is provided. A firm may not take orders by telephone from a Client who has not been notified.

What about face-to-face meetings?

Meetings are not exempt. Orders placed through channels other than the telephone must be documented in a durable medium, and the content of relevant face-to-face conversations may be recorded in written minutes or notes (Article 16(7)). Article 76(9) of the Delegated Regulation sets the minimum content:

Date and time of the meeting.
Location of the meeting.
Identity of the attendees.
Who initiated the meeting.
Relevant information about the Client order: price, volume, type of order, and when it is to be transmitted or executed.

ESMA confirmed in January 2025 that where an order form or contract signed at a meeting lacks any of these fields, the firm must document the missing information in additional records (ESMA Q&A 2415).

Does the firm have to listen to the recordings?

Yes, on a risk basis. Article 76(6) requires firms to periodically monitor the records of transactions and orders subject to the rule, including the relevant conversations, in a way that is risk-based and proportionate. The management body must have effective oversight of the recording policy (Article 76(2)), and the firm must be able to demonstrate its policies, procedures and oversight to the supervisor on request (Article 76(7)).

Is a recording enough? What supervisors found in 2026

A firm can hold every call for seven years and still be unable to show how a recommendation came about. ESMA’s statement of 6 May 2026 on its Common Supervisory Action (CSA) on MiFID II sustainability aspects describes exactly that gap. Twenty-nine national authorities reviewed 245 firms, 153 of them credit institutions and 89 investment firms, during 2024 and 2025.

On record keeping, ESMA found that not all firms keep complete and sufficiently detailed records of Clients’ sustainability preferences, the matching of those preferences to products, and the adaptation process. The gap was clearest for adaptations: in some cases only the final preferences were documented, with nothing on the steps or explanations that led to the change. ESMA asks for documentation that is complete, clear and traceable.

The finding is limited to sustainability preferences, and our guide to the MiFID II suitability test reads it in that scope. The question here is where the missing steps usually are. In most firms they sit in recorded calls, emails and meeting notes kept under Article 16(7), while the suitability file holds only the outcome.

ESMA also reported deficiencies in the neutrality of the Client engagement process, including disclaimers in questionnaires that may influence the Client’s choice. How a preference was collected is visible in the conversation, not in the form. In Luxembourg, the CSSF published the results on 17 June 2026 and said it will continue to supervise these rules with a proportionate approach. ESMA itself invited authorities to favour dialogue over enforcement during the transition, except for clear breaches or mis-selling.

How do recordings relate to the suitability file?

Article 16(7) does not require a firm to use its recordings as suitability evidence. The recording duty and the suitability duty are separate obligations with separate sources. They draw on the same conversations, which is why one archive can serve both.

Obligation	Source	What it requires	What the recorded communication adds
Recording of order-related communications	MiFID II Article 16(7); Delegated Regulation Article 76	Record calls and electronic communications relating to, or intended to lead to, Client orders; minutes for relevant meetings; keep 5 to 7 years	It is the source
Records of services and transactions	MiFID II Article 16(6); Delegated Regulation Article 72(1)(a)	Records that let the authority reconstitute each key stage of each transaction	The conversation where the order started
Suitability assessment	MiFID II Article 25(2); Delegated Regulation Article 54(2)	Information on knowledge and experience, financial situation including ability to bear losses, investment objectives including risk tolerance, and sustainability preferences	Changes the Client mentions between formal reviews
Suitability statement	MiFID II Article 25(6); Delegated Regulation Article 54(12)	A statement to the retail Client, before the transaction, of how the advice meets their preferences, objectives and other characteristics	The reasons the Client actually gave
Suitability records	ESMA Guidelines on suitability (ESMA35-43-3172), Guideline 12	Orderly records of the assessment, the information collected, the advice given, the investments made and the reports provided, including sustainability preferences and their updates	The steps, adaptations and their rationale

The last column is the gap ESMA describes. A Client who says on a call in March that they need liquidity for a property purchase in the autumn has changed their financial situation. If the suitability profile still shows the January answers when an RM recommends a five-year structured product in May, the recording and the file disagree. The firm holds the evidence and the contradiction in the same archive. For what the suitability file itself has to show, see our guide to the MiFID II suitability test.

This is not new. ESMA’s 2020 CSA on suitability also reported weak record keeping, including failures to evidence how the assessment was conducted. National authorities have written to firms about it since (Central Bank of Ireland).

How do you review recorded communications without rating Relationship Managers?

The moment a firm reads its recordings at scale, it can also read its people. Article 76(6) asks firms to monitor the records of orders and transactions. It does not ask them to score the employees who made the calls, and doing so changes the legal picture.

Three rules frame the choice:

EU AI Act, Annex III, point 4(b). AI systems intended to monitor and evaluate the performance and behaviour of people in work relationships, or to inform decisions on promotion, termination or task allocation, are listed as high-risk.
GDPR purpose limitation, Article 5(1)(b) and Article 6(4). Recordings are kept under a legal obligation for an evidential purpose. Using them for a new purpose needs its own documented justification.
Luxembourg Labour Code, Articles L.261-1 and L.414-9. Monitoring employees triggers prior information duties and, for installations that control behaviour or performance, staff-representative involvement.

The practical answer is to make the Client relationship the unit of analysis. A review asks whether the file is complete and whether the advice still fits the Client, not how the RM performed. Findings go first to the RM who owns the relationship, and escalate only when a Client-protection rule requires it, such as a suitability discrepancy under the firm’s procedure. Management sees firm-level aggregates, never a league table.

Our white paper, Recorded, Not Rated, sets out 14 design rules for this, from keying every output to the Client rather than an employee identifier to an annual audit of the rules themselves.

Sampling or full coverage?

Article 76(6) requires monitoring that is risk-based and proportionate, so sampling remains lawful. Sampling satisfies the rule, but a sample tells you how often files are incomplete, and nothing about which ones. Full coverage of the conversation layer finds the specific Client whose stated circumstances no longer match the profile, before the next recommendation rather than after it.

How do the rules differ across Luxembourg, Germany, Switzerland and the UK?

A Luxembourg RM with Clients in Germany and Switzerland works under the rules of the booking entity, plus the marketing and conduct rules of the Client’s country. The recording rule is harmonised across the EU; the documentation habits around it are not.

Jurisdiction	Recording rule	Retention	Suitability documentation	Supervisor
Luxembourg	MiFID II Article 16(7) as transposed into Luxembourg law; Delegated Regulation Article 76 applies directly	5 years, up to 7 on request	ESMA suitability guidelines applied through Circular CSSF 23/835 since 3 October 2023	CSSF
Germany	Section 83(3) of the Securities Trading Act (WpHG)	5 years, up to 7 on request	Suitability statement under Section 64(4) WpHG; ESMA guidelines	BaFin
Switzerland	No general MiFID-style recording duty for advice under FinSA	Per firm policy and sector rules	Documentation under Article 15 FinSA, including, for advice, the Client’s needs and the reasons for each recommendation; FINMA Circular 2025/2 in force since 1 January 2025	FINMA, or a supervisory organisation for portfolio managers
United Kingdom	SYSC 10A of the FCA Handbook, the onshored Article 16(7)	5 years, up to 7 on request	Suitability rules in COBS 9A; Consumer Duty outcomes	FCA

The Swiss row is the one that surprises Luxembourg teams. Where there is no recording duty, the meeting note and the email thread carry the whole evidential load, and the question of how a recommendation came about is answered by FinSA’s documentation duty rather than by a tape.

What changes from 2027?

Neither change removes the recording duty. Both raise the value of being able to show why a recommendation was made.

The Retail Investment Strategy (often called MiFID III)

The package amending MiFID II was politically agreed on 18 December 2025, endorsed by the Council’s permanent representatives on 5 June 2026 and backed by the Parliament’s ECON committee on 23 June 2026. At the time of writing, the plenary vote is indicatively scheduled for 11 November 2026 and the text is not yet adopted. The directive enters into force 20 days after publication. Member States then have 24 months to transpose it, and the main rules apply 30 months after entry into force, which the Commission expects around July 2029. ESMA’s technical advice on the implementing rules, suitability included, is due by 1 October 2027.

Two changes touch the suitability file. Advisers recommending diversified, non-complex and cost-efficient products to retail Clients no longer need to assess knowledge and experience. A new value-for-money test requires costs to be identified, quantified and justified. When fewer questions are asked, the conversation carries more of the evidence.

The EU AI Act

Article 50 transparency duties have applied since 2 August 2026: a person interacting with an AI system must be told so. For machine-readable marking of AI-generated content under Article 50(2), systems already on the market before that date have until 2 December 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the Annex III high-risk obligations, including point 4(b) on employment, to 2 December 2027.

For a firm that uses AI to read recorded communications, the date that matters is December 2027, and the design choice that matters is whether the system evaluates Clients’ files or the firm’s employees.

What should a recorded-communications evidence checklist cover?

The first six points cover the recording obligation. The last six turn the recordings into evidence.

Capture

Channel map. List every channel RMs use with Clients (fixed line, mobile, Teams, email, chat, messaging apps) and check each against the written recording policy (Article 76(1) and 76(3)).
Device register. Keep the register of firm and approved private devices current, and record or block everything else (Article 76(4); Article 16(7)).
Coverage test. Sample calls and meetings each quarter to confirm a complete, retrievable record exists (Article 76(10)).
Client notice. Inform each Client, in the language of the service, before providing order-related services (Article 76(8)).
Meeting minutes. Capture all five Article 76(9) fields, and complete any order form or contract that lacks them in a separate record (ESMA Q&A 2415).
Retention. Store records in a durable form that cannot be altered, available to the Client on request, for five years or up to seven (Article 76(10) and 76(11)).

Evidence

Link the advice to its sources. Every recommendation points to the communications it relied on (ESMA Guideline 12; Article 72(1)(a)).
Date the knowledge. Record when the firm learned of each change in a Client’s circumstances, and check it against the profile used for the next recommendation.
Keep the path, not only the answer. Record each preference adaptation with its reason (ESMA CSA statement of 6 May 2026).
Record the RM’s decision. For each flagged item, record what the RM decided and, when a prompt is set aside, why.
Review the file, not the person. Key findings to the Client file and route them first to the RM who owns the relationship (EU AI Act Annex III, point 4(b)).
Document the new purpose. Record the purpose and legal basis for any new use of recordings, run a DPIA, and complete staff information duties before go-live (GDPR Articles 5(1)(b), 6(4) and 35; Luxembourg Labour Code Article L.261-1).

How Luscent fits this picture

Luscent does not record calls; the firm’s recording and archiving systems keep that duty. Luscent reads the communications the firm already holds and generates suitability evidence as work happens. The RM makes every decision.

Microsoft 365. Email, calendar and Teams meeting transcripts are read through the firm’s own tenant. A message that cannot be tied to one Client is held back, not guessed.
Comms to Compliance. When an email changes what the firm knows about a Client, the advice waits for reassessment.
Suitability Gate. Every proposed trade is checked before the advice leaves, on a deterministic MiFID II rules engine: the same input gives the same result.
Suitability evidence. Each check is recorded at the point of advice, with the verdict, any breaches, the portfolio before the trade and the source messages it rests on.
Health Score. A 0 to 100 score per relationship, with the reasoning behind it. It scores the relationship, never the Relationship Manager.

To go further, read Recorded, Not Rated, or see the same flow on synthetic data in a 90-day pilot.

Frequently asked questions

Does MiFID II require firms to record all Client phone calls? No. Article 16(7) covers calls and electronic communications relating to dealing on own account and to the reception, transmission and execution of Client orders, including those intended to lead to a transaction. Advice given with the intention of leading to an order is in scope. Member States may extend the rule further.

How long must MiFID II recordings be kept? Five years from the date the record is created, and up to seven years where the competent authority asks (Article 16(7); Delegated Regulation Article 76(11)).

Do Microsoft Teams calls and video meetings fall under the recording rule? Yes, when they relate to or are intended to lead to Client orders. The rule is technology-neutral, and the firm must review its arrangements whenever it accepts a new medium of communication (Article 76(3)).

Are WhatsApp and other messaging apps in scope? Yes, if RMs use them for order-related communications. The firm must record them or take all reasonable steps to prevent their use on equipment it cannot record or copy (Article 16(7)).

What must minutes of a face-to-face meeting contain? At least the date and time, location, attendees, who initiated the meeting, and the relevant order details: price, volume, type of order and when it is to be transmitted or executed (Article 76(9)).

Is a recording enough to prove suitability? No. A recording proves what was said. Suitability evidence must show the information collected, the assessment made and why the advice fits the Client (ESMA Guideline 12). Recordings are often the best source for that file, but someone has to connect them to it.

Can AI review recorded communications under MiFID II and the EU AI Act? MiFID II requires risk-based monitoring and does not prescribe the method. Under the EU AI Act, a system that evaluates employees’ performance or behaviour is high-risk under Annex III, point 4(b), from 2 December 2027. Classification turns on the system’s intended purpose, which is why designing the review around Client files matters.

What does the CSSF expect from Luxembourg firms? The CSSF applies the ESMA suitability guidelines through Circular CSSF 23/835, in force since 3 October 2023. In June 2026 it said it will supervise the MiFID II sustainability rules with a proportionate approach, following ESMA’s 2026 findings.

How do Swiss FinSA documentation duties compare with MiFID II? FinSA has no general MiFID-style recording duty for advice. Article 15 FinSA requires firms to document the services agreed, the Client information collected and, for advice, the Client’s needs and the reasons for each recommendation.

Will the Retail Investment Strategy change recording or suitability documentation? It leaves the recording duty in place. It lets advisers skip the knowledge and experience assessment for diversified, non-complex, cost-efficient products, and adds a value-for-money test. At the time of writing it awaits a plenary vote indicatively set for 11 November 2026.