SYSC 10A is the part of the FCA Handbook that tells certain firms they need to record phone calls and keep electronic communications relating to client orders and transactions. Say it that plainly and it sounds simple. In practice, most of the difficulty isn't the recording itself — it's the questions firms don't ask until an examiner does: which calls, kept for how long, retrievable how fast, and covering which staff.
The obligation applies to firms carrying out certain regulated activities — broadly, those involved in arranging or executing client orders in financial instruments. If that's you, the rule expects "relevant conversations and electronic communications" to be recorded and retained, generally for a minimum of five years, in a form that can be reproduced and provided to the regulator on request.
Where firms actually get caught out
Rarely on the headline requirement. Most firms know they need to record calls on a trading desk. The gaps tend to sit around the edges:
Scope creep on devices. A mobile used for client business is in scope the same as a desk phone, and "we didn't think WhatsApp counted" is not a defence examiners find persuasive. If a communication channel is used for relevant business, it needs to be captured — or the firm needs a clear, enforced policy that it isn't used for that purpose at all.
Retrieval, not just retention. Keeping the recording is only half the obligation. Being able to find a specific call from fourteen months ago, tied to a specific client and order, inside a reasonable timeframe, is the part that actually gets tested — usually during a live inquiry, which is the worst possible moment to discover the indexing was never built properly.
Staff coverage drifting from the policy. New starters, temporary cover, and anyone moved onto a relevant desk mid-year are the most common gaps — not because anyone decided to exclude them, but because the recording scope was set up once and nobody revisited it as the org chart changed.
What "good" looks like
A recording and retention setup that isn't just compliant on paper, but boringly reliable in practice: capture that doesn't depend on someone remembering to switch it on, retention that matches the rule without anyone having to manually extend it, and retrieval that's fast enough to answer a regulator's request without a week of searching first. None of that is exotic engineering — it's the same discipline behind any of the compliance tooling built under this roof: structure the data at the point it's created, so nobody's reconstructing it under pressure later.