Your records policy says it. Can you prove it?

Record-keeping rules for UK financial firms are clear about the outcome. The FCA's SYSC 9 requires firms to keep orderly records sufficient for the regulator to monitor compliance. COBS 11.8 requires recorded communications to be kept for at least five years. The Money Laundering Regulations require customer due diligence records to be kept for five years after a relationship ends. UK GDPR then requires personal data to be kept no longer than necessary.

So firms must keep records long enough, find them on request, and not keep them too long. All three, and with evidence.

The cost of getting it wrong is real. An analysis of 22 FCA anti-money-laundering cases over five years found 68% involved data problems such as outdated customer records, with fines totalling over £430m. In the US, regulators fined 11 firms more than $1.8bn in a single round of actions in 2022 for failing to keep business communications, and a further 12 firms $63.1m in January 2025.

In most firms, the records register is a set of spreadsheets, one per business unit or entity. Once a year, someone in the records or compliance team runs the conformance exercise:

• Emailing dozens of record owners to confirm their records are still where the register says.
• Chasing the ones who don't reply, often for weeks.
• Asking for a sample of records to be produced to prove they can be retrieved, and tracking the answers by hand.
• Working out which records have passed retention, checking for legal holds, and recording what was destroyed and on whose authority.
• Assembling all of it into a report for the risk committee or auditors.

The work is repetitive, the evidence is scattered across inboxes, and the picture is out of date as soon as it's finished. Large records management platforms can help, but they usually mean a long integration project with the firm's document systems.

Mooring starts from the register you already have. Import your Excel or CSV inventories; it recognises the usual columns and lets you adjust the mapping. No SharePoint or system integration is needed.

• Location checks. Every night, records with web locations are checked and marked Yes, No, Unverifiable or Not checked, with the reason.
• Steward attestation. Each record owner gets one email listing their records, with a single-use link and no account to create. They confirm or correct each record, and every answer is time-stamped. Mooring sends the reminders.
• Retrieval tests. A risk-weighted sample of records is sent to owners to produce within a deadline, and the results are recorded.
• Certified disposal. Records past retention are queued, legal holds block disposal, and each approved disposal gets a certificate that survives the record's deletion.
• Reporting. A live dashboard by entity and an annual report against four key controls, with an append-only audit trail behind it.

Mooring stores the register, never the documents themselves.