MiFID II Art. 16(7) requires you to record and archive conversations and electronic communications relating to orders, even if they are never executed. We work with you to build a taping system that will stand up to an inspection: every channel covered, a retrievable archive and controls with a documentary trail.
Would your recording system hold up to a supervisory request?
Tell us which channels your team uses with clients and we will show you where the gaps are and how to close them.
From the channel inventory to the delivery protocol: six components that turn recording from a risk into your best evidence.
We draft or review your policy on recording and retaining communications: scope by service, authorized and prohibited channels, client notices and fit with the rest of your MiFID II procedures.
When the CNMV asks for recordings, the clock starts ticking from day one. We prepare your extraction and delivery protocol, run mock requests and support you throughout the supervisory process.
We build recording sampling and channel monitoring into your compliance function’s annual plan.
Recordings prove how you received and passed on each order: align them with your execution policy.
Reviewing communications uncovers conflicts and poor sales practices before the supervisor does.
If you do not have an in-house compliance function, we run the taping controls for you and report to the management body.
Four real situations that end up on our desk: different firms, the same underlying problem — communications that exist but cannot be proven.
“We receive orders by landline, mobile and video call. We need to know whether everything is recorded, where it is archived and whether we could hand over a specific call from four years ago.”
“My clients send me messages at all hours. I know relevant conversations are going unarchived there, and I want to sort it out before it becomes a problem.”
“With remote work, half of our conversations go through mobile phones and meeting platforms. We want a clear list of authorized channels and capture that actually works.”
“We have hundreds of relationship managers and we know some of them use their personal phones with clients. Either we ban it with real controls or we give them captured corporate channels.”
Almost no firm breaches the rules by recording nothing: they breach them by recording halfway. These are the most common failures.
Recording only what gets executed: the obligation covers conversations and electronic communications relating to orders even if the transaction is never completed. If you wait until execution to record, you are already in breach.
The ghost channel: personal WhatsApp, SMS or private email with no capture. The conversation exists—and the client keeps it—but your firm cannot archive it, review it or hand it over to the supervisor.
An archive that cannot retrieve: you record, but without indexing by client, date and transaction. When a request comes in, failing to locate a specific communication is, in practice, the same as not having it.
| What is recorded | How long it is kept | Typical mistake |
|---|---|---|
| Telephone conversations and video calls relating to orders (reception, transmission, execution), even if the transaction is not executed | 5 years, extendable to up to 7 at the supervisor’s request | Recording the switchboard while leaving out corporate mobiles and video call platforms |
| Electronic communications with the same purpose: email, chat and instant messaging | Same period: 5 years, extendable to up to 7 if the supervisor requires it | Tolerating WhatsApp or other personal channels with no capture tool or archive |
| Relevant face-to-face conversations with clients | Documented in minutes or notes in a durable medium and kept on the same basis | Key meetings without minutes: the recommendation was given, but there is no record to prove it |
We audit your communication channels, draft the recording policy, help you choose and configure the archive, and set up the sampling and the delivery protocol. All with evidence you can put on the CNMV’s table.
MiFID II Art. 16(7) requires firms to record telephone conversations and electronic communications relating to client orders—their reception, transmission and execution—and to dealing on own account.
The scope includes any communication that may result in transactions, whether or not they are concluded. Relevant face-to-face conversations are not recorded, but they must be documented in minutes or notes. The operational detail is set out in Delegated Regulation (EU) 2017/565.
It makes no difference at all: the duty arises from the intention, not the outcome. A call in which the client asks about a purchase they later drop falls within scope just like an executed order.
This is the costliest misunderstanding in taping: firms that only archive completed transactions leave uncovered precisely the conversations where poor sales practices tend to appear.
5 years as a general rule, extendable to up to 7 when the supervisor requires it. Records must be kept in a durable medium: complete, protected against alteration and retrievable throughout the period.
Watch the practical detail: if your technology provider deletes by default after a few months, or if employee departures take their mailboxes with them, the legal period is breached without anyone consciously deciding it.
Yes. The client must know, before services are provided, that their conversations and communications will be recorded. The notice is documented in the contract, in call scripts and in the signature blocks of written channels.
In addition, the client can request a copy of the recordings of their own conversations, so your archive must allow you to extract them by client. Build this notice into your financial advisory agreement from day one.
Only if it is a corporate channel with capture and archiving. Personal messaging without capture is today the biggest source of taping risk: the conversation exists, the client keeps it, and your firm cannot review it or hand it over.
There are two defensible options: give the team corporate messaging connected to the archive, or ban the channel with real monitoring and consequences. What cannot be defended is a policy that bans it on paper while everyone knows it is used.
The strict Art. 16(7) obligation centers on order-related services, so for a pure EAF the analysis is case by case. That said, its communications may result in transactions, and the general record-keeping rules require it to be able to evidence its advice.
That is why, in practice, we recommend that EAFs keep an equivalent archive of their client channels: it is proof of what was recommended, when and on what information. If you are setting one up, build this in from the design stage, as explained in how to set up an EAF.
The firm remains responsible. The supervisor does not accept “it was their own doing”: it expects you to have provided corporate devices, banned personal channels in writing, monitored compliance and taken action when you detected deviations.
Document every piece: device handover, training, compliance function controls and disciplinary proceedings, if any. That chain of evidence is the difference between an isolated failure and an organizational breach.
It usually checks three levels: the policy (scope, channels, notices), actual coverage (do you really record everything you say you record?) and traceability (can you link each transaction to its communications and deliver them on time?).
Preparing means rehearsing: extract a sample, time the delivery and fix whatever fails. We explain this in CNMV inspections and in control and risk function.
Recording is not about installing a tool: it is a system with policy, technology, controls and evidence. This is the sequence we follow with our clients.
We inventory every means your team uses to talk to clients—landlines, mobiles, softphones, video calls, email, chat, messaging—and cross-check them against who is involved in orders and recommendations. The result is the gap map.
We define authorized and prohibited channels, draft the policy and the client notices, and support the technical rollout of capture and archiving. With proof that it really records, not just on paper.
Periodic sampling by compliance, monitoring of unauthorized channels, retrieval exercises and a delivery protocol for supervisory requests. The goal: every control leaves a documentary trail.
Taping is one piece of your overall compliance framework: see also our MiFID II compliance service and our CNMV inspection preparation.
The 10 conduct controls the CNMV expects to see working at an EAF or investment firm, with the typical evidence for each one. Ideal as a quarterly self-assessment with your team.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These are the terms you will see in the rules, in supervisory requests and in your technology providers’ proposals. It pays to speak the same language as the inspector.
The name the industry uses for the duty to record and retain communications related to client orders.
The article of the MiFID II Directive that requires firms to record telephone conversations and electronic communications relating to orders.
The obligation covers communications that may result in transactions, whether or not they are completed. A lost sale does not erase the duty.
A means of communication approved by the firm and connected to capture and archiving. Everything else must be banned and monitored.
Communication with clients through personal channels (private messaging, SMS, personal email) that the firm does not capture and cannot review.
The client must know, before trading, that their conversations and communications will be recorded. This is documented in contracts and scripts.
Communications are kept complete, protected against tampering and accessible throughout the required period.
Periodic review of a sample of recordings by the compliance function to detect capture failures and poor practices.
The ability to link each transaction to the communications that gave rise to it. It is the first thing an inspector checks.
An approved document that sets out the communications covered, authorized channels, client notices and the responsibilities of each area.
A versioned and approved policy, proof of distribution and staff acknowledgments of receipt.
Every means used with clients is either captured or effectively banned, with no gray areas for mobiles or messaging.
Channel inventory, capture tool configuration and documented recording tests.
A complete archive for 5 years (up to 7 on request), protected against alteration and retrievable by client, date and transaction.
Retention settings, access controls and retrieval exercises with their results.
Periodic review of communications by the second line, with an active search for unauthorized channels.
Annual compliance plan, sampling reports and incidents with the measures taken.
Management body informed, owners appointed and network trained on channels, notices and consequences.
Minutes with compliance reporting, training records and disciplinary proceedings, if any.
If you tick any of these boxes, it is worth auditing the system before the CNMV does.
Recordings are the raw material for other obligations: they prove how you handled orders, what you recommended and how you managed conflicts. These pages help you see the full picture of your firm’s MiFID II evidence.
Which penalty regime applies when mandatory records fail and how infringements are graded.
The recording shows what was said; the test shows why the recommendation was suitable. Together they make the client file watertight.
The natural place for the recording notice and for the communication rules between your firm and its client.
The communications archive runs on ICT providers: since January 2025, DORA has required a register and specific contractual clauses.
If you want a full review, start with your firm’s MiFID II compliance, strengthen the control and risk function and get the system ready for a CNMV inspection.
Tell us how your firm communicates with its clients (phone, email, messaging) and we will review with you what MiFID II Art. 16(7) requires in your specific case.
Article 16(7) of Directive 2014/65/EU (MiFID II) requires firms that provide investment services to record telephone conversations and electronic communications relating to the reception, transmission and execution of orders and to dealing on own account, including those intended to result in transactions that are ultimately not executed. In Spain, this duty is part of the framework of Law 6/2023 and Royal Decree 813/2023, with the operational detail set out in Delegated Regulation (EU) 2017/565 and supervision by the CNMV. It is not a technology obligation: it is an evidence obligation.
The test is not the channel but the content: any telephone conversation or electronic communication—email, chat, messaging, video call—related to client orders is covered, regardless of whether the transaction is completed. Relevant face-to-face meetings are documented in minutes or notes in a durable medium. Before the first conversation, the client must have been told that they will be recorded, and they may request a copy of the recordings of their own communications. All of this sits alongside the other MiFID II records, such as those for best execution or the suitability test.
Recordings and records are kept for 5 years, a period that can be extended to up to 7 when the supervisor requires it. Retention requires integrity (no one can alter the content), availability (the archive survives changes of provider and employee departures) and retrievability (you can locate communications by client, date, employee or transaction). In practice, the most common failure is not a missing archive but the inability to extract in time what the supervisor asks for: that is why we recommend rehearsing delivery just as you would rehearse a business continuity plan.
The biggest current taping risk has a name: personal WhatsApp and other private channels without capture. Supervisors in several jurisdictions have been focusing on these “off-channel” communications for years, and the logic is compelling: if the conversation with the client happens where the firm does not archive, the whole evidence system becomes a dead letter. There are two defensible responses, and neither is free: enable corporate messaging connected to the archive, or ban the channel with effective monitoring, training and documented consequences. A purely formal ban with tolerated use is the worst possible position in a CNMV inspection.
A solid system combines four layers: a policy that defines the communications covered, authorized channels and notices; capture and archiving technology verified with real tests; second-line controls (recording sampling, monitoring of unauthorized channels, retrieval exercises); and governance that reports to the management body and trains the network. We design and implement all four layers as part of our MiFID II compliance service, with support from the control and risk function or an outsourced compliance officer.
Key legislation, linked to the official text:
Legislation and links reviewed in .