Being SYSC 10A compliant and being ready to be examined against it are treated as the same thing far more often than they should be. A firm can have every relevant call recorded, every retention clock running correctly, and still take a fortnight to produce a straightforward request — because the systems were built to capture, not to be interrogated on demand by someone outside the firm who doesn't know its filing conventions.
A real request rarely comes in shaped like "give us everything." It comes in shaped like: this counterparty, this date range, this desk, possibly this individual, possibly a specific instrument. Answering that well means the underlying records were indexed against those exact dimensions from the start — client, desk, staff member, date, instrument — not just dumped into a store organised by the date the recording happened to land. Firms that only planned for storage discover, at exactly the wrong moment, that storage and searchability were never the same requirement.
The gap between having it and producing it
The rule itself is largely silent on how fast a firm must respond to a specific request — it speaks in terms of records being kept in a way that allows them to be produced to the regulator, without pinning down an exact clock, and firms should check the current Handbook text rather than assume a number. What isn't ambiguous is the expectation of competence: a firm that visibly struggles to locate its own records is telling the examiner something about the rest of its controls, whether or not that was the intent. The retrieval process itself becomes evidence, in a way the recording never does on its own.
That's the part that tends to get underbuilt. Firms invest in the capture layer — the recording, the archive, the retention timer — because that's the part that shows up as a line item and a vendor contract. The query layer, the thing that turns "we have five years of calls" into "here is the specific nineteen-minute call from March, with chain of custody intact," gets far less attention, right up until it's the only thing that matters.
Rehearsal is the actual control
The firms that handle a real request calmly are, almost without exception, the ones that had already run a fake one. A periodic internal exercise — pick a call at random from eighteen months ago, time how long it takes to produce it in a usable format, note where the process stalled — does more for audit-readiness than another round of policy documentation. It converts an assumption ("our retrieval works") into a tested fact, and it surfaces the boring failure modes early: a format nobody can open anymore, an index field that was left blank for a quarter, a leaver whose historic calls nobody remembers how to attribute.
None of that is about the recording technology. It's process discipline applied to something that only gets tested under pressure if a firm doesn't choose to test it on its own terms first. That's the same principle behind the compliance tooling built under this roof — structure and index at the point of capture, so producing a record is a lookup rather than a reconstruction project, and the first time the retrieval path gets exercised isn't the day an examiner is watching.