How UK compliance teams can manage email to meet FCA, MiFID II, SRA and GDPR retention rules

Email management for compliance teams means automatically filing, classifying and retaining email against the rules a regulator sets, not a generic IT policy.

In UK financial and professional services, that means FCA SYSC 9 and SYSC 10A, MiFID II, SRA rules and UK GDPR's storage limitation principle, each with a different retention window and a different penalty for getting it wrong.

Doing this well depends on four things: knowing which rule applies to which record, automating the filing so it does not rely on individual habit, being able to search on demand, and producing an audit trail a regulator will actually accept.

What is electronic communications compliance? Recording, keeping and supervising firm messages under UK rules

Electronic communications compliance is the practice of capturing, keeping and supervising a firm's email, chat and other digital messages so the firm can produce them for a regulator on request.

The FCA does not define the term itself. Its rule in SYSC 10A.1.6R sets the duty instead (FCA Handbook, last updated 23 October 2025): "A firm must take all reasonable steps to record telephone conversations, and keep a copy of electronic communications, that relate to the activities in financial instruments referred to in SYSC 10A.1.1R(2) (and that are not excluded by SYSC 10A.1.4R)."

In plain English, a firm in scope has to keep a copy of the digital messages that relate to dealing in financial instruments. An email confirming a client order is one example. A chat message agreeing a price is another. A message meant to lead to a trade counts even if no trade follows, because the rule covers communications intended to result in those activities.

Electronic communications compliance is a duty owned by the firm, and the FCA supervises it. It applies to communications on firm-provided equipment and on equipment the firm has permitted staff to use. It does not on its own set retention periods for other regimes, such as UK GDPR, which apply separately.

What the FCA rule requires: seven elements with examples

Element	What SYSC 10A requires	Example
Copy of messages	Take all reasonable steps to keep a copy of relevant electronic communications	A broker's email confirming a client order
Retention period	Five years, and up to seven years where the FCA requests it	A 2026 order email kept until at least 2031
Written policy	An effective recording policy set out in writing and suited to the firm's size and business	A policy listing which channels are in scope
Management oversight	The management body keeps effective oversight and control of the policy	Board or senior manager review of recording gaps
Technology neutral	Arrangements must be technology-neutral	The same duty applies to email and to a newly approved chat tool
Private devices	Take all reasonable steps to stop relevant messages on privately owned equipment the firm cannot record or copy	Blocking trade discussions on an unapproved personal messaging app
Tamper-resistant storage	Records held in a durable medium in a format that does not allow the original to be altered or deleted	An archive where filed emails cannot be edited

Why standard email tools fail UK compliance requirements

Most UK firms already run Outlook. The problem compliance teams face is not sending email: it is proving what was said, when, and by whom, within the retention window their regulator sets.

Rising email volume outpaces manual filing

Knowledge workers spend close to 28% of the working week on email and close to 19% of it searching for internal information, according to McKinsey Global Institute research. Manual filing habits do not scale against that volume.

Retention rules differ by regulation and record type

FCA, MiFID II, SRA and GDPR rules each set different windows for different record types. A single blanket retention policy rarely satisfies all of them, which is why classification at the point of filing matters more than storage capacity.

Departures and disputes expose filing gaps

The moment a client relationship sours or an employee leaves is precisely when a firm most needs a complete record, and precisely when informal filing habits fail. The wider email governance gap inside most Microsoft 365 deployments often surfaces first at this point, once it is too late to fix retroactively.

What is email archiving? How it works, what it keeps and how it supports UK retention rules

Email archiving is the automatic capture of email and its attachments into a central, searchable store outside the live mailbox.

The US National Archives and Records Administration (NARA Bulletin 2011-03, a US federal source) defines it this way: "E-mail archiving generally refers to applications that remove e-mail from the mail server and manage it in a central location also known as an archive." NARA adds that these applications typically need little or no action from the user and that authorized users can then search the repository.

In plain English, an archive is where finished email lives so the inbox does not have to hold it. A law firm might keep every client email against its matter. A bank might hold order confirmations for the full retention period. An HR team might pull a former employee's emails during a dispute without asking IT to restore a mailbox.

Email archiving is owned and run by the organization, not by a regulator. Regulators set what must be kept and for how long. An archive on its own does not decide those periods, and under the UK GDPR storage limitation principle it should not keep personal data longer than the firm can justify.

What an archive needs to hold to be useful as evidence

Item to keep	Why it matters	Source
Message body and attachments	The full content is what a regulator or court asks to see	NARA Bulletin 2011-03 (US federal)
Sender, recipients and date	Identifies who said what, to whom and when	NARA Bulletin 2013-02 and 36 CFR 1236.22 (US federal)
Unalterable stored record	A record that can be edited cannot prove what was sent	FCA SYSC 10A (UK)
Search across the archive	Records must be retrievable, not only stored	NARA Bulletin 2011-03 (US federal)

UK email retention rules: FCA, MiFID II, SRA and GDPR requirements

Compliance teams are not choosing retention periods in a vacuum. UK and EU-derived rules set specific floors, and the practical implications differ enough to warrant separating them out.

Regulation or body	Retention requirement	Practical implication for email
FCA (SYSC 9 and SYSC 10A)	Generally 5 years; up to 7 years for MiFID business if the FCA requests it	Client communications and order-related correspondence must stay retrievable years later, not just archived
MiFID II	5-7 years for records of client-order-related communications	Firms conducting investment business must reconstruct the full communication trail around a transaction
SRA (law firms)	At least 6 years post-matter; Law Society recommends 15 years for property, 21 years for matters involving minors, indefinitely for wills and trusts	Retention varies by matter type, so a single firm-wide email retention policy is rarely sufficient
UK GDPR	No fixed period; the storage limitation principle requires data to be kept only as long as justified	Firms must be able to explain and evidence why each category of email is retained for as long as it is

Getting this wrong is not theoretical: incomplete archives and communications happening on unarchived channels outside official systems are exactly the kind of gap the rules above are designed to catch.

UK GDPR's storage limitation principle cuts the other way too: keeping personal data in email for longer than is justified is itself a compliance risk, independent of the retention minimums set elsewhere in this table.

Key features of a compliant email management platform: filing, metadata, search and audit trail

Stripped of vendor language, an email management platform for compliance needs to do four things well.

Automatic filing at the point of send or receipt

Filing should not rely on individual employees remembering to do it. Filing emails to SharePoint directly from Outlook in one click, via an add-in, removes that dependency and applies metadata as it goes.

Metadata capture for enforceable retention

Each email needs to be classified against the matter, client or project it belongs to at the point of filing. That is what makes a retention rule enforceable rather than aspirational.

Contextual search across subject, body and attachments

A compliance team should be able to reconstruct a full communication trail in minutes, searching by subject line, body text, attachment name or meeting location, not just sender and date.

A defensible, audit-ready trail

The evidence a regulator or auditor actually asks for is not just what was sent. It is where each email was filed, when, and under what classification, which is why a defensible, searchable record needs to already exist rather than being reconstructed under pressure once a regulator asks for it.

Ideagen's email management platform for Outlook-based compliance teams is built around Ideagen Mail Manager, the Outlook-native tool behind these capabilities. Ideagen's own published figures show the effect on search time: from up to a week down to around five minutes, saving an average of three hours per person per week.

Email management checklist for UK compliance teams: five questions to test your setup

Test the current setup against these questions:

• Can any team member retrieve a client email from three years ago in under ten minutes, without asking IT?
• Is the retention period applied consistent with the regulation governing that specific matter type?
• Is there a metadata record showing when and how each email was classified?
• Would the current setup satisfy a regulator's request for a full communication trail?
• Are communications happening on any unarchived channel outside the firm's searchable system, including messaging apps?

For firms managing this within Microsoft 365 specifically, a breakdown of what M365 email governance readiness actually requires is worth working through before evaluating any solution.

A no, or an uncertain answer, to any of the checklist points above points to a structural gap rather than a training one: a filing system that depends on individual discipline instead of automatic classification at the point of sending or receipt.

UK compliance teams that close it do four things: name the exact regulation, automate the filing, prove the trail, and treat email archiving with the same discipline as any other financial record.

Ideagen's own published figures, search time cut from up to a week to around five minutes with three hours saved per person per week, show what is achievable once an email management platform for compliance teams, such as Ideagen Mail Manager or Enterprise Solutions, replaces scattered inboxes with a system built for FCA, MiFID II, SRA and GDPR requirements from the outset.

To see how automatic filing, contextual search and an audit-ready trail work inside Outlook, explore Ideagen Mail Manager.