MiFID II Communications and Recordkeeping

Identify the relevant communication and service

ESMA explains the telephone and electronic communications covered by Article 16(7), including controls on relevant communications through systems that are not recorded. Determine which activities and communications fall within scope before choosing a recording or transfer-control policy.

Sources: [1]

Define approved communication routes

Trace a representative customer instruction through receipt, review, execution support and retention. Identify where a new messaging application, personal device or attachment export could bypass the approved process. Assign an owner to approve channel changes before adoption.

A DLP event and the underlying required communication are different records. Ensure the firm's capture and preservation systems receive what they need even when a handling policy intervenes.

Test retrieval as well as prevention

Use safe examples to test recording, access, review and retrieval. Check the event timeline and the record's association with the relevant customer interaction. Confirm that evidence is available to authorised reviewers without granting broad access to all customer communications.

Keep the change register tied to ESMA sources

ESMA maintains information on the MiFID II/MiFIR review and its implementation work. Record which updates affect the firm's services, who assesses them and when controls need retesting. A general review announcement is not a substitute for checking the adopted measure, applicability date and national implementation where relevant.

Sources: [2]

Applying this with TRIAS

Evaluate TRIAS supported DLP channels for selected unauthorised sharing scenarios and test their interaction with recording systems. Retain evidence of the actual deployment. DLP does not replace MiFID record capture, preservation or the firm's supervisory assessment.

• Financial services →
• File activity visibility →