Julian KisselWhat began as a regulatory obligation is now an operational standard: every investment advice call is recorded. But the raw recording rarely suffices. Banks, asset managers and advisers have to make the content searchable, for internal sampling, for evidence in a dispute, and for answering supervisory requests. Transcription is the link between the legal duty and the practical ability to use what was captured.
This article sets out what the recording and retention duties actually require, which data protection obligations run alongside them, and how to satisfy both without friction.
What MiFID II requires
Article 16 (7) MiFID II, together with Article 76 of Delegated Regulation (EU) 2017/565, requires the recording of all telephone conversations and electronic communications that may lead to a securities transaction, even where the conversation does not result in an order. In scope:
- investment advice calls with retail and professional clients
- receipt and transmission of orders
- proprietary trading conversations
- internal discussions where they lead to decisions relevant to proprietary trading or client orders
Recordings must be kept for five years, and up to seven years where the competent authority requires it. They must be reproducible at any time without unreasonable delay and readable for the supervisor.
Why archiving the audio is not enough
A WAV file in a tamper-proof archive formally satisfies the retention duty. It is practically worthless the moment anyone needs content: a compliance sample, evidence for a complaint, an answer to an access request under Article 15. Nobody listens through 5,000 hours of calls to find one statement.
A transcript with word-level timestamps makes the archive searchable. A search for a risk class or the name of a financial instrument finds every mention in seconds, with the timestamp at which the adviser said it. That is what "orderly and directly comprehensible" documentation means in practice.
Two axes at once: supervisory law and the GDPR
Recording sits in a genuine tension. The regulatory duty demands comprehensive storage; the GDPR demands minimisation, purpose limitation and erasure. Both apply simultaneously.
The legal basis. Processing the recordings rests on Article 6 (1)(c) GDPR, compliance with a legal obligation. That basis carries only the purposes that follow directly from MiFID II: recording, retention, provision to the supervisor, internal compliance review. It does not carry marketing, sales coaching, performance analytics or training a speech model. Any use beyond the regulatory purpose needs its own basis, in practice consent, which has to be freely given, informed and revocable.
The notice at the start of the call. The firm must inform the client before the recording starts. In practice that is the familiar announcement. Without it the recording is formally unlawful, even though the duty to record exists.
Deletion after the period ends. Once the five or seven years have run, the recordings must be deleted. The GDPR does not permit keeping data in case it becomes useful: it goes as soon as the purpose is spent. Keeping recordings longer than necessary is itself a fineable breach.
A transcription vendor has to make that deletion technically demonstrable. Audio file, transcript, backups and logs all have to disappear inside the agreed period. A service that advertises long-term storage and model training is unsuitable for this use case by construction.
Why US cloud solutions are difficult here
No provision literally prescribes EU servers. The recommendation follows from three things.
Schrems II (C-311/18). The Court of Justice invalidated the Privacy Shield in 2020. Transfers to the US need standard contractual clauses plus supplementary measures, and remain subject to the CLOUD Act, which permits US authority access regardless of storage location.
Outsourcing guidelines. Credit institutions must register critical outsourcing with their supervisor, and MiFID recording is critical. Non-European cloud providers make it harder to evidence effective control and an exit path.
Banking secrecy. Conversations with investment clients can touch banking secrecy, and in the German context transferring them to a US provider without adequate safeguards can reach into section 203 StGB territory.
The trap is the same one that catches every regulated buyer: a vendor that is formally established in the EU but calls the OpenAI, Google or AWS speech API behind the scenes is transferring MiFID-relevant recordings to a US provider. The contract says EU; the data path says otherwise.
A workflow that holds up
- Call starts. The adviser takes the call; the telephony system plays the recording notice automatically.
- Recording. The conversation lands in a tamper-proof archive, typically WORM storage.
- Transcription. An overnight batch hands the audio to the transcription service. Recognition happens on servers in Germany; the file does not leave EU jurisdiction.
- Indexing. The transcript is stored with its metadata, so calling number, client reference, duration and adviser id, in the compliance system.
- Retention. Audio and transcript stay available for five years. Word-level timestamps allow every statement to be traced back to the exact second of the original recording.
- Search. Compliance can query the archive. A supervisory request about which calls discussed the loss probability of a given product is answered in minutes rather than days.
- Deletion. After the period, audio, transcript and all backups are deleted automatically, and the deletion is recorded in the audit log.
The audit trail is the point
One technical detail decides whether a transcript is regulatorily useful: every statement must be attributable to its position in the original audio. Each word needs a start and end timestamp and a confidence value. In a dispute that lets you show not only what was said but when, and with what recognition certainty the transcript reproduces it.
A plain full-text rendering without timestamps is considerably weaker as evidence, and it is what most general-purpose tools produce.
How DeepScript fits a regulated firm
- Own servers in Germany, at Hetzner, ISO 27001 certified. No US hyperscaler, no CLOUD Act exposure, entirely under German jurisdiction.
- No third-party AI. Our own speech models, no API calls to OpenAI, Google or AWS. Your recordings do not leave our infrastructure.
- An Article 28 processing agreement covering the specific requirements of regulated industries, with the complete sub-processor list, all inside the EU.
- Configurable retention. You set the period, five years, seven years or project-specific. Audio and transcript are deleted automatically afterwards and the deletion is written to the audit log.
- Word-level timestamps with confidence values on every word.
- REST API and MCP access. Integration into an existing compliance platform through the API; if you want an agent to run sampling across the archive, the MCP server exposes it without moving the audio.
- Speaker separation between adviser and client, included in every tier, which is what makes sampling practical at all.
Conclusion
MiFID II is not a paper tiger. Supervisors impose fines for deficient recording practice, and GDPR fines reach 4% of group turnover. Satisfying both is achievable, but only with tools built for regulated environments.
The central question when choosing a transcription partner is not "how accurate is the model?". It is "does our data ever leave the EU?" and "can every processing step be documented end to end?". Answering the first with no and the second with yes is what a defensible compliance stack looks like.
More detail and a workflow example for regulated industries is on the financial services page; the general data protection analysis is in this article.