Client data disposal for regulated firms.
FCA-regulated firms, IFAs, mortgage brokers and financial advisers handle client data that carries strict retention and disposal obligations. Under FCA rules, UK GDPR and AML legislation, secure documented destruction is not optional — it is a compliance requirement. We make it straightforward.
Requires secure handling and disposal of client records throughout their lifecycle.
AML CDD and KYC records must be retained 5 years then securely destroyed with documentation.
Senior managers accountable for data security including at the point of physical disposal.
Four regulatory frameworks that require documented disposal.
Financial services businesses operate under some of the most demanding data governance requirements of any sector. The FCA's COBS and SYSC rulebooks, the Money Laundering Regulations, UK GDPR and the Senior Managers and Certification Regime collectively create a compliance environment where secure, documented destruction of client records is an obligation — not a choice.
Physical documents — client suitability assessments, KYC files, mortgage application paperwork, investment instructions and account statements — carry the same compliance obligations as digital records. A client file placed in a general waste bin is a potential FCA breach, an AML compliance failure and a GDPR violation simultaneously.
The solution is straightforward: a regular certified shredding service, with a certificate of destruction issued after every collection. This creates the audit trail that FCA supervisors, compliance consultants and internal risk teams expect to see.
FCA rules require that client records are maintained and disposed of securely. Regulated firms must be able to demonstrate compliant data handling across the full record lifecycle.
CDD documents, KYC files and transaction records must be retained for 5 years after the end of the business relationship, then destroyed securely with documented evidence of destruction.
Under SM&CR, named senior managers are personally accountable for data governance within their firm — including the secure disposal of client personal data at end of retention.
The ICO expects organisations to maintain documented records of data disposal activities. A certificate of destruction from a certified provider satisfies this requirement directly.
From IFAs to mortgage brokers — all regulated firms covered.
Suitability reports, client fact-finds, investment recommendations and correspondence containing sensitive financial personal data.
Application forms, credit reports, income documentation, bank statements and lender correspondence requiring secure disposal at end of retention.
Policy documents, claims files, client correspondence and risk assessments containing personal financial and health data.
Portfolio reports, investment instructions, client meeting notes and financial planning documents at end of prescribed retention periods.
KYC files, CDD documents, beneficial ownership records and transaction monitoring records requiring secure destruction after the 5-year AML retention period.
Loan applications, affordability assessments, credit agreement documentation and customer correspondence for secure compliant disposal.
All financial records and client documents accepted.
Client suitability assessments, fact-finds, risk profile documents and investment recommendations.
Know Your Customer and Customer Due Diligence documents, identity verification records and AML files.
Application forms, income evidence, bank statements, credit reports and lender correspondence.
Client account statements, portfolio valuations, trade confirmations and transaction records.
Letters, emails printed for files, meeting notes and any correspondence containing client personal financial data.
Policy documents, claims correspondence, medical information disclosed for insurance purposes and underwriting files.
Cashflow models, pension transfer analysis, retirement planning documents and tax planning files.
Client agreements, terms of business, powers of attorney and any signed documents no longer required.
Staff records, payroll documents, HR correspondence and internal financial reports.
Digital media destruction
Hard drives, laptops & digital media.
Financial firms hold client data on hard drives, laptops and USB devices as well as in paper files. When devices are decommissioned, physical destruction provides the highest level of security — ensuring data cannot be recovered. Certificate of destruction issued per job.
Request a quoteMinimum quantities apply · Certificate of destruction per job
How long must financial firms keep client records?
FCA rules set minimum retention periods for regulated firms. Once these periods are met, secure destruction with a certificate of destruction is required.
| Record type | Minimum retention | FCA rule / basis |
|---|---|---|
| Investment advice records | 5 years From date of advice | FCA COBS 9.5 |
| Mortgage advice records | 3 years From date of advice | FCA MCOB 4.8A |
| Insurance records | 3 years From date of advice | FCA ICOBS 2.3 |
| AML CDD & KYC records | 5 years After end of business relationship | Money Laundering Regs 2017 |
| AML transaction records | 5 years After transaction date | Money Laundering Regs 2017 |
| Client agreements / ToB | 5 years From end of relationship | FCA SYSC 9.1 |
| Pension transfer records | Indefinitely FCA requires permanent retention | FCA PS18/6 |
This table is for general guidance. Always refer to the specific FCA rules applicable to your firm's permissions and activities.
Fixed prices. Published upfront.
No hidden fees, no variable charges. Certificate of destruction included with every collection as standard.
Serving financial services businesses across three counties.
Trusted by financial businesses across the region.
"Exactly what our compliance team needed. Clear pricing, reliable collections and the certificate of destruction is issued every time without us having to chase anything."
"Switched to Clearcut from a larger provider. Better service, completely transparent pricing and the documentation is exactly what we need for our FCA compliance records."
Financial services shredding FAQs
Get a quote for your financial services business.
We work with FCA-regulated firms, IFAs, mortgage brokers and financial advisers across Dorset, Hampshire and Wiltshire. Tell us your requirements and we'll confirm a price the same day.
89 Commercial Road, Bournemouth, England, BH2 5RR
Office@Clearcutconfidentialwaste.co.uk
01202 022409
© 2026 Clearcut Confidential Waste