What are the client records and retention requirements?
Chapter 4: Client Records & Retention
Record retention requirements are among the most straightforward CIRO obligations, yet misunderstanding persists about what counts, when the clock starts, and what format is acceptable.
4.1 What Counts as "Books and Records"
CIRO's definition is broad. "Records" includes "books, records, client files and information and other documentation, including electronic documents, related to the Investment Dealer Rule Regulated Person's business."
Your client file is a subset of the broader category. Books and records include:
| Category | Examples |
|---|---|
| Client files | KYC forms, account agreements, client correspondence |
| Transaction records | Trade confirmations, order tickets, instructions |
| Communication records | Emails, meeting notes, phone call documentation |
| Compliance records | Suitability assessments, disclosures, conflict documentation |
| Account records | Statements, reports, performance data |
The key principle: if it relates to your business with clients, it is likely a record that must be retained.
4.2 The 7-Year Requirement
The retention period is seven years from the date the record is created. Not from the date of the transaction. Not from account closure. From creation.
7-Year Retention Framework
| Record Type | Retention Start | Duration |
|---|---|---|
| KYC documentation | Date created | 7 years |
| Suitability memos | Date created | 7 years |
| Client correspondence | Date created | 7 years |
| Meeting notes | Date created | 7 years |
| Trade documentation | Date created | 7 years |
| Disclosure records | Date created | 7 years |
This is a prescriptive requirement, not principles-based. Seven years from creation. No flexibility.
Seven years from the date the record is created, not from transaction date, not from account closure.
When CIRO, PIPEDA, or Law 25 changes, the Dispatch explains what it means.
Once a month: what is changing across CIRO, PIPEDA, and Quebec Law 25, and what it means for advisors using AI tools. A five-minute read.
Subscribe, free4.3 Format Requirements
CIRO's approach to format is "technology neutral." Records may be maintained electronically. The requirements for electronic records:
- Secure: Protected from unauthorized access or alteration
- Retrievable: Accessible within a reasonable time
- Legible: Clear and readable regardless of format
- Accessible: Available to clients or CIRO staff upon request
Original documents may need to be retained in some cases (for example, where signature authenticity might be challenged).
4.4 Common Mistakes to Avoid
Frequent retention errors include:
- Starting the clock from transaction date instead of record creation date
- Disposing of records when a client leaves (the seven years still applies)
- Failing to retain copies when transferring with an Approved Person to another dealer
- Inadequate controls for electronic records (no backups, no access controls)
- Mixing personal and business records on shared devices
When an advisor transfers to another dealer, both the old and new dealer must retain applicable records. The client file belongs to the dealer, not the advisor. Records must be retained regardless of who holds the client relationship.
Key Takeaways
- 'Books and records' is broader than your client file
- Seven years from date of creation (prescriptive, not flexible)
- Electronic records must be secure, retrievable, legible, and accessible
- Records must be retained even when clients leave or you transfer
- Original documents needed in some circumstances