Definition and scope
Records should show what a credit intermediary actually did, which lender received an introduction and what the consumer saw. Maintain dated evidence of the product, parties, application route, fee terms and decisions. A click count or CRM status alone cannot show whether a consumer received the required information. Historical disclosure versions matter when the broker changes a lender panel, commission arrangement or website design. The review should distinguish statutory classification from descriptions in a service agreement. Identify the responsible firm and retain a versioned decision record. If a customer disputes the role or representation, record the evidence rather than relying on assumptions.
Governing obligations
Identify recordkeeping obligations under applicable FCA CONC provisions, and where relevant SYSC, DISP and data protection rules. Different statutory activities and documents may have different retention conditions. An intermediary conducting several regulated activities cannot assume one uniform minimum period. Preserve the legal source and reason for retaining each record. Assess which files a principal or third-party provider holds, who controls them and whether they can be retrieved promptly. Different legal provisions apply to different products and activities. Document the date of the rule and any exemption relied on. Staff should not treat a general regulatory summary as authority to ignore a product-specific condition.
Customer information
Fee and commission evidence should distinguish a customer-paid broker charge from remuneration paid by a lender. Relevant UK CONC 4.4 and 4.5 obligations depend on the transaction and disclosure conditions. Keep the actual notices, agreement confirmations, scripts or webpages and timestamps. A new fee table cannot establish what a customer was told previously. Monitor errors in customer fee deductions and track refunds or corrections against the original consumer case. The consumer-facing explanation must match the exact transaction. Keep the relevant document version and the communication channel in the record. A statement available on today's website cannot prove what an earlier applicant actually saw.
Operational arrangements
Financial promotions and broker introductions should be traceable from the original advert through a referral to the final application stage. Keep material representations, legal names, lender panels, customer data permissions and relevant comparison results. Where affiliates or outsourced brokers participate, require records that show what they actually published and transferred. A supplier's general compliance warranty is insufficient evidence that a specific lead was generated or used appropriately. A risk review should compare the internal commercial arrangement with what consumers were promised. Where the factual record is incomplete, investigate before making a definitive compliance claim. Retain the owner of each correction.
Conflicts and accountability
Complaints may reveal inaccurate fees, misleading claims about lender independence or applications sent to the wrong provider. Link the complaint to the actual advertisement, account and intermediary responsible. Retain decisions, correspondence and corrective actions as required. Staff should be able to retrieve evidence without displaying unrelated consumers' information. Document record ownership when a lender stops trading with a broker or when a servicing arrangement is moved to another organisation. Operational handoffs matter even when legal responsibility stays with another entity. Test the process using real cases, including failed applications and complaints. Make sure staff can find the firm responsible for correcting a specific problem.
EU legal differences
Personal information retention must satisfy applicable UK or EU data protection principles, including storage limitation and security, subject to legal preservation requirements. CCD2 changes intermediary regulation through national measures generally applying from 20 November 2026; it does not establish one universal retention period for every intermediary in Europe. Review the credit product and each country's rules before applying a common cross-border document schedule. Record how new law affects archived and future customer files. Do not conflate requirements currently in force with future national measures. Changes to the product, customer market or business model should trigger a refreshed assessment. Document approvals and effective dates.
Audit and testing
Audit retailer-assisted applications, online referrals, comparison results, declined finance, commission disclosures and consumer complaints. Reconstruct the full journey using materials stored at the relevant date. Test access controls, deletion rules and the ability to retrieve third-party records. Where a file is incomplete, identify the cause and rectify controls rather than inventing missing approvals. Keep a log of findings, owners and subsequent testing. Sampling should include ordinary journeys and edge cases. Preserve source records, decisions, correspondence and corrections so reviewers can reconstruct the transaction. Identify repeated defects and verify remediation.
Frequently asked questions
Do all EU brokers have identical requirements?
No. National law, the credit product and activity determine obligations.
Does authorisation alone guarantee compliance?
No. Firms must also meet applicable conduct and disclosure requirements.
Primary sources
FCA Handbook CONC ↗Regulated Activities Order article 36A ↗Directive (EU) 2023/2225 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.