Record Retention: What Must Be Kept, and For How Long

A registered firm must keep the records that evidence what it did and why: client agreements, the basis of every recommendation, communications, research and its rationale, complaints, and its own compliance records. The form and the retention period are set in the regulations that apply to the firm's registrations, read at sebi.gov.in or rbi.org.in. The test that actually bites is retrieval, not storage.

Underneath that sits one idea that firms tend to discover late, usually on a day nobody chose. A regulatory recordAnything evidencing what a firm did and why, whatever form it is held in. A message can be a record; a spreadsheet can be a record. is not housekeeping. A record is evidence. Every duty described anywhere else in this subject produces a document, and at an inspection that document is the only version of events that exists in the room. The people have moved on, memories have softened, and the file is what remains.

The household version has the same shape and is a familiar one. Somebody in the Bhoite household paid the electricity bill in cash at the counter, and the receipt went into a shirt pocket and then into a wash. Two months later a notice arrives saying the bill is unpaid. The payment happened. Everyone in the house remembers it happening. None of that is worth anything at the counter, because the counter reads paper rather than memory, and a firm that did the right thing and cannot show it is in practical terms standing where the firm that did nothing is standing.

The argument is complete in one sentence, and everything below is the machinery a firm builds so that it never has to say that it did the thing and simply cannot find it.

What counts as a record, and which ones do firms forget?

The definition is wider than the instinct, so start wide. A record is anything evidencing what the firm did and why. Not just the documents that look like documents. Sarvodaya Capital Advisors Private Limited, the invented nine person advisory and research firm this subject follows, keeps a record inventoryThe list of every category of record a firm actually generates, written down rather than assumed. holding seven categories, and Devaki Suresh, its compliance officer, built that list by walking through the firm's duties rather than by walking through its cupboards.

Walking the duties rather than the cupboards is the trick worth stealing. A record inventory is not built by looking at what happens to have been filed; it is built by listing every duty the firm carries and asking what each duty leaves behind. The two lists are never the same, and the gap between them is exactly where a firm gets caught.

Two of those seven are the ones that go missing, and they are highlighted above for a reason. The first is client communications. A message thread agreeing to move a holding, a call in which a client says they are worried, a reply confirming what was decided: at the time it all feels like conversation rather than filing. The second is the basis of a recommendation. Nirmal Achari, who produces the research at Sarvodaya, knows exactly why he concluded what he concluded, and that knowledge lives in his head, in three browser tabs and in a spreadsheet on his machine. A reason that was never written down is not a weak record, it is not a record at all, and the firm discovers this at the only moment when it cannot be fixed.

Why is a record evidence rather than housekeeping?

Because of what an inspection is. An inspection does not interview the firm's intentions. The inspection reads what the firm produced, in the order it produced it, and forms a view about whether the duty was met. A record, then, is not a description of the work. For regulatory purposes it is the work, in the sense that it is the only part of the work anybody outside the firm can ever see.

Sarvodaya's own application file makes the point neatly. The file ran to 34 documents, of which 22 already existed as ordinary corporate records and 12 were written specially for the application. Notice what the 22 are: they are the firm's ordinary life, kept, and therefore available. The paid up capital of Rs 25,00,000 and the net worth of Rs 62,00,000 on the application date are not numbers that exist because somebody typed them into a form. Both figures exist because a chain of records supports them, and every one of those records is an assertion the firm may later be asked to stand behind.

In what form must records be kept?

The form requirements are set in the regulations that apply to each registration, and they are read there. One thing does not move when a rule moves: what the form requirements are trying to preserve. Almost every form requirement anywhere in the world is an attempt to make an electronic archive behave the way a shelf of paper behaved without anybody arranging it.

A shelf did four things for free. The document on it was the original. Any alteration left a visible mark. The document stayed where somebody put it. And it could be handed to whoever asked. An electronic archive does none of those four things by itself, so every one of them becomes something a firm has to arrange, test and be able to demonstrate. Those four arrangements are the entire content of a form requirement, expressed as a design brief rather than as a rule.

The fourth property fails quietly, so it deserves a sentence of its own. A file that was perfectly readable when it was saved can become unreadable when the software that wrote it is replaced, and nobody notices until somebody asks for it. An unreadable file is not a storage failure; the bytes are all there. The failure is one of readability, and it is invisible right up to the moment it matters. The other three are protected by an audit trailA record showing the sequence of actions taken on something and who took each one, kept so that a change cannot happen silently., the electronic version of the mark a pen leaves on paper.

How long must they be kept?

Every retention periodHow long a record must be kept, set in the regulation that requires the record in the first place. that binds a registered firm is set inside a regulation and is read there. A period holds only as the source currently states it, and the reasoning behind that generalises far past this subject.

Three things are true about these periods at once. The periods differ by record, so the answer for a client agreement is not automatically the answer for a communication. The periods differ by registration, so a firm holding two registrations may be reading two different requirements about the same physical document. And regulations are amended, so the periods move. A summary that printed a period would be right until the morning it was amended and wrong every day afterwards, with nothing on its face to tell the reader which day it is.

There is a second reason, and it is the more practical one. A number that has been handed over is a number that stops being checked. A reader who has been taught where to look opens the source, sees the current text, and also sees the surrounding requirements that no summary would have carried. So the useful thing to take away is not the period. The habit is: name the instrument, name the body that issued it, open it, read the requirement for that specific record, write the period into the schedule, and write beside it the date it was read.

How is a retention schedule actually built?

A retention scheduleThe firm's own table of what is kept, for how long, where it lives, and who may destroy it. Written by the firm, not issued to it. is the artefact that makes all of this operational. The schedule is a table with one row per category of record, and Devaki Suresh built Sarvodaya's with five fields on every row. Four of those fields the firm fills in from its own knowledge of itself. Exactly one comes from the rulebook.

Look again at what field four actually contains. Field four is not a number typed from memory by somebody who is fairly sure. The number is one Devaki Suresh copied out of the regulation for that specific registration at sebi.gov.in, written next to the date she read it, with a review diarised. Writing the date beside the period is what converts a schedule from a claim into a record of a check, and it is the single cheapest discipline described here.

Field three is the one that will save the firm, and almost nobody takes it seriously while writing it. Where it lives means the exact place, and the exact place is not the shared drive. The exact place is which folder, under which naming convention, keyed how. There is a household test for this. Ask somebody where the property papers are. If the answer is in the cupboard, that is field three failing. If the answer is the second drawer, in the brown folder marked house, that is field three passing, and the difference between those two answers is twenty minutes against two days.

What stops the schedule from running on time?

A schedule is a clock, and there is one thing that stops the clock. The stopper is usually called a legal holdAn instruction that suspends normal destruction, because an inspection, a dispute or a request has made the records potentially relevant.: an instruction that suspends normal destruction because an inspection, a dispute, a complaint or a request has made a set of records potentially relevant to somebody outside the firm.

The reason this matters more than it sounds is that destruction on schedule looks completely innocent from inside the firm and completely different from outside it. A routine deletion looks routine right up until the moment somebody asks for the deleted document, and from that moment onwards it never looks routine again. Nothing about the act changed. The change is that the deletion now has to be explained, and the explanation has to survive an audience that was not in the room.

Two practical consequences follow. First, a hold has to be capable of being applied quickly and broadly. The firm therefore has to know which records relate to a given client, a given period or a given decision. Field three is doing that work again. Second, the hold and its release are themselves records. A hold that nobody wrote down cannot be shown to have been applied, and a release that nobody wrote down leaves an unexplained gap between the date the schedule said and the date things actually went.

Why is retrieval a harder test than retention?

Here is the reframe that the rest of this depends on. Retention and retrievalProducing one specific record on request, within a reasonable time. Retention is holding it; retrieval is finding it. are different problems with different solutions, and solving the first does nothing whatsoever for the second.

Retention is solved with money. Buy more space, whether that is a cupboard or a subscription, and the problem goes away. Retrieval is solved with structure, and structure cannot be bought. Every firm that has ever failed a records request had the record somewhere in the building. Volume held is therefore the wrong thing to measure, and time from question to document is the right one.

The arithmetic of volume is easy and worth doing: it shows what the schedule protects the firm from. Sarvodaya files about 1,480 records a year across its seven categories. Held for five years, a length used only to show the shape and required by nothing, that leaves the firm with 7,400 documents standing at any one time. A pile of 7,400 is not a frightening number for a cupboard. On a Tuesday afternoon when somebody wants one particular sheet out of it, the same pile is frightening.

At the five years used for this illustration, Sarvodaya holds 7,400 documents, and one request is a search of 1 column with a schedule and of 5 columns without one. At one year the two states are almost indistinguishable, and that is precisely why small firms conclude they do not need a schedule. At fifteen years the archive holds 22,200 documents, and the same request is a search of 1 column or of 15. Nothing about the firm changed between those two readings except how long it had been operating.

When is a record destroyed, and what is left behind?

DestructionThe deliberate disposal of a record at the end of its retention period, done by a named person on a decided date. is the part everybody skips, and skipping it is what turns a schedule into a wish. A record has six points in its life, and a firm without a schedule only ever performs the first two.

Point six is the one people argue about, and it takes ten seconds to settle. Once a record is gone, a destroyed record and a lost record look exactly the same from outside. The note of what was destroyed, when, under which row of the schedule and by whom is the only thing that distinguishes a firm following its own policy from a firm that has mislaid something. The note is also a line in a register rather than a document, and that makes it the cheapest record to produce of any named above.

What does an inspection actually ask for first?

The order is more predictable than people expect, and a predictable order can be rehearsed. The request starts wide and narrows fast, and the narrow question is the real one.

Questions one and two are answered by the inventory and the schedule, and a firm that has neither is already telling the inspector something before the interesting question arrives. Question three is the interesting one. Question three is not a test of the document. The test is whether the firm knows what it holds and where it put it. A slow answer is read as a firm that does not know what it holds, and that reading invites precisely the kind of attention that costs a small firm months.

Who is answerable, and who outside compliance ever uses any of this?

Inside Sarvodaya the answer to the first half is short. Devaki Suresh writes and maintains the schedule, the record inventory sits alongside her rule change register and her enforcement update log, and the whole thing is reported upward to Harish Vaze, the non executive director on the board. A duty that has no named person attached to it is a duty nobody performs, so Kamala Ravindran, the founder proposed as principal officer, does not get to treat records as an administrative matter that somebody else handles.

The second half of the question is the one that makes this worth learning even for somebody who never works in compliance at all. During the year one of Sarvodaya's clients asked for the basis of a recommendation made fourteen months earlier. Sarvodaya produced it in a day. The record existed in every firm this has ever gone wrong at, so its existence was not the reason. The reason was that the schedule said where it lived.

Seen from where the client stands, the same test runs the other way. The Bhoite household, Sarvodaya's invented advisory client, runs on one salary with two dependants and a home loan. The household will never inspect anybody. They can, however, ask one question of any firm they deal with: what was the basis on which this was recommended, and how long is it kept. The answer that arrives in a day, with a date on it, describes a firm that has built this machinery. The answer that arrives in three weeks, or that arrives as a summary written today about a decision made last year, describes a firm that has not. One question of that kind is the cheapest diligence available to anybody who is not an inspector, and it costs one line in an email.

The same reading is available to a lender looking at a regulated firm as a borrower, to an analyst forming a view about an intermediary's operating quality, and to anybody buying a small advisory business. None of them will audit the archive. All of them can ask for three specific documents and time the response, and that measurement tells them more about the firm than the documents themselves ever will.

Sarvodaya Capital Advisors Private Limited, Kamala Ravindran, Devaki Suresh, Nirmal Achari, Harish Vaze and the Bhoite household are invented.
Educational material. Not advice on any investment, tax, budget or market position.