Most firms don't build their own call recording. A specialist platform holds the archive, runs the retention clock, and surfaces the search tooling when compliance needs to pull something up. That's a sensible division of labour for exactly the reason firms give for it: recording infrastructure is not where a regulated firm's expertise should be concentrated. What it doesn't do is move the SYSC 10A obligation off the firm's books and onto the vendor's. The rule sits with the firm regardless of who is physically holding the audio.
"We use a third-party provider for that" is a true statement about where the infrastructure lives and an irrelevant one when the FCA asks who was responsible for a gap in the archive. The FCA's August 2025 multi-firm review of off-channel communications was based on a survey of eleven wholesale banks. It reported real operational friction with third-party recording platforms: service outages that interrupted recording, reconciliation issues that made it hard to confirm the right communications had been captured, and delayed or missing data from vendors. The vendor issues it describes aren't obviously unique to banks.
Oversight is the part that doesn't outsource
SYSC 10A.1.6R puts the obligation to take all reasonable steps to record directly on the firm, and the FCA's review was explicit that this responsibility can't be transferred to a third party. It's tempting to reach for SYSC 8's outsourcing rules to explain the oversight duty, using its due diligence and ongoing monitoring framework. But SYSC 8.1.5R specifically carves recording and retention under SYSC 10A out of the "critical or important function" category for a common platform firm (the category that includes MiFID investment firms), and the proportionality guidance for non-critical outsourcing (SYSC 8.1.3G) excludes it too. The oversight duty doesn't need SYSC 8's help, because it's already sitting inside SYSC 10A.1.6R itself: a firm can't credibly claim to have taken all reasonable steps to record if it never checks whether its calls are landing in the archive, and the general governance and internal-control requirement in SYSC 4.1.1R points the same way. That's this post's own reading of what the obligation implies, not the FCA stating a specific vendor-oversight rule. The vendor is also processing personal data on the firm's behalf, which brings UK GDPR's Article 28 processor requirements into the contract regardless of how SYSC 8 applies.
The FCA's review put a specific question to firms on this point: does the firm effectively monitor third-party vendors to ensure expected performance and reliability? Read against the outages and reconciliation problems the review reported, that's a question about an ongoing process, something a one-off check at vendor selection can't answer. A firm that can answer it with a reconciliation process, an incident log, and evidence it has used that log when something went wrong is in a different position from one whose answer is "the provider told us it was fine."
What a reconciliation needs to check
In practice this means treating the vendor relationship the same way the record itself should be treated: checked against an independent source, because the absence of a complaint doesn't mean the absence of a problem. Call detail records from the firm's own PBX or telecoms carrier, logged independently of the recording platform, give something to reconcile the vendor's archive against. The gaps worth watching for aren't always missing files: a zero-length recording, one-sided audio, or a file that doesn't match the call it's supposed to be are failure modes that look fine until someone actually listens. Where the reconciliation doesn't match, that's a gap regardless of whether the cause sits with the firm's own equipment or the vendor's pipeline; the obligation doesn't distinguish between them, and neither should the firm's own incident process.
The written agreement is where a lot of this either gets made checkable or doesn't. A contract can't define what "all reasonable steps" means as a regulatory standard. That's for the FCA, and ultimately the Upper Tribunal if a firm refers a decision there. What it can do is set the service levels a firm relies on as evidence of meeting that standard: what gets captured, how fast data can be retrieved, how outages are notified, audit and access rights, and what happens to the archive when the contract ends. SYSC 10A recordings generally need to be kept for five years, extendable to seven at the FCA's request, so if the vendor relationship ends in year three, the firm still owes those records, and the exit clause is what determines whether it gets them. Recording isn't treated as critical or important under SYSC 8, but the conditions that chapter sets for functions that are (performance standards, audit access, continuity on exit) are a reasonable shape for this contract to borrow as good practice, not because the rule requires it here. A contract that's silent on any of this gives the firm nothing concrete to monitor against, and nothing to show the FCA beyond "we trusted them."
None of this is an argument against using a specialist platform: most firms are right to. It's a reminder that the division of labour is technical. The vendor can hold the tapes, run the infrastructure, and do the heavy lifting of capture and storage, but the firm still has to be able to show it was watching. That's the standard Varde is designed around: giving a firm something concrete to show the FCA, rather than something it has to take on faith.
If you're not confident your firm could show the FCA how it monitors its own recording vendor, Varde's free SYSC 10A assessment gives you a RAG-rated view of where you stand in around 10–20 minutes. Try the SYSC 10A assessment →