Financial

MiFID II and the archive obligation for investment firms

12 November 2025 · 6 min read · DeSnipperaar

Investment firms, asset managers and investment advisers fall under MiFID II. A core part of that directive is the recording and archiving obligation: every relevant conversation, every instruction and every order confirmation must be reproducibly recorded. This obligation generates a substantial archive, both digital and on paper. This article discusses which periods apply and how a firm tidily destroys the material once they end.

What must be recorded?

MiFID II (art. 16(7) and implementing regulations) prescribes among other things:

• Telephone conversations that could lead to a transaction.
• Electronic communications (email, chat, messaging platforms) around advice and orders.
• Orders received and transmitted (order routing records).
• Client classification and suitability assessments.
• Cost and conflict-of-interest documentation.

Retention period: five years as a basic rule

The standard period under MiFID II is five years. The competent authority (in the Netherlands the AFM) may extend that to seven years, which in practice happens regularly for data that may be relevant for market-abuse investigations. Many firms therefore apply a hard retention period of seven years for MiFID II-relevant communications and orders, in line with the seven-year tax retention period.

After the period ends, further retention becomes a problem: the GDPR storage limitation (art. 5 GDPR) requires that personal data are not kept longer than necessary. As soon as the MiFID II basis lapses, the data must be erased or destroyed, unless another basis exists (for example an ongoing dispute or a tax-relevant document still within the seven-year period).

Paper order documents and back office

Many investment firms still have paper order tickets, printed confirmations, intake documents and compliance forms. These papers contain BSN numbers, account numbers, asset details and copies of identification. A standard office shredder is not enough: the norm for confidential financial data is DIN 66399 P-5.

Digital media

Stored call recordings, back-ups and email archives often sit on SSDs, external hard drives, LTO tapes or NAS systems. At end of life or after the retention period ends, those media must also be destroyed. For tapes and disks containing client communications, DIN 66399 H-4 (paper-magnetic media) or E-4 (electronic media) is the relevant norm. For LTO tapes, see also Backup tapes and LTO tidy-up.

Handing over call recordings to a third party for destruction without a mobile approach means sensitive client communication leaves the premises. That unnecessarily increases chain risk.

The transition moments at which you destroy

There are four typical moments at which an investment firm wants to destroy archive material:

1. End of client relationship plus expired period. The entire file (paper plus digital copies) goes out.
2. Replacement of storage infrastructure. Old servers, SSDs, tapes are disposed of. Destroy before reuse.
3. Office move or merger. Expired archives do not move to the new location.
4. Periodic retention clean-up. Annual or quarterly fixed clean-up round.

Mobile process on site

DeSnipperaar comes with a destruction truck to the investment firm's office. Paper goes straight into the shredder. Data media are shredded on the spot. The compliance officer watches and signs the certificate afterwards. This certificate states volume, standard, date and location, so you have sufficient evidence for the processing register and for AFM questions.

Update the processing register

Include in the GDPR processing register: which categories of MiFID II material, which period (5 or 7 years), which legal basis (statutory obligation art. 6(1)(c) GDPR), which destruction processor and which standard. Link each destruction certificate to the corresponding batch.

Sector page

More on our approach for banks, investment firms and asset managers on Financial advisers & banks.

---

Time for the MiFID II archive that is due for destruction? Call or email for a non-binding quote. We advise plainly, no contract and no minimum order.