Your retention policy has one number in it. MCOB has several.

Ask five brokers how long records have to be kept and you get five numbers. Six years is the most common answer. Six years is not in MCOB.

What MCOB actually does is set a period per rule. MCOB 2.8.52G says it plainly: each rule in MCOB that requires a record also sets out a period that the record must be kept for. Schedule 1 collects them in one table so you can see the spread. The periods in that table range from one year to the term of the contract, and they run from different starting points.

All references below were read from the FCA Handbook on 18 September 2026. Read them again yourself before you change anything — that is the entire point of this piece.

The steps

1. Write down the number your firm currently uses. Then ask two other people in the firm. If you get two different answers, you do not have a retention policy, you have a habit. The check is whether anyone can name the rule their number comes from.

2. Open MCOB Schedule 1 and treat it as an index, not the rule. Every row points at a rule. The operative period lives in the rule, not in the schedule.

3. Sort your files by the rule that generated them, not by client. This is the step people skip, and it is the one that makes the rest work. A single client folder holds an illustration, a suitability record and a set of arrears notes, and those three have different clocks. Decision: if you cannot tell from a file which rule it sits under, that is the file to fix first.

4. Check the short ones. MCOB 5.4.19R requires a record of each illustration issued where the customer applies for that contract, and MCOB 5.4.20R retains it for a year from the date of the application. One year. Not six.

5. Check the advice records. MCOB 4.7A.25R covers the customer information you obtained and your explanation of why the advice met the suitability requirements. It requires a minimum of three years from the date on which the advice or explanation was given. Note the trigger — the date of the advice, not completion, not redemption.

6. Check arrears, including the recordings. MCOB 13.3.9R requires an adequate record of dealings with a customer who has or may have payment difficulties, or whose account has a sale shortfall, and that includes recordings of telephone conversations about arrears or payment shortfall charges. Three years from the date of the dealing. If you are recording calls and have never set a deletion rule on the recordings, this is where the everything-forever problem is usually worst.

7. Work out whether the term-of-contract rows are yours at all. MCOB 11.6.60R is the one that surprises people: the affordability assessment records at (2), the interest-only records at (3) and the bridging extension records at (4) must be kept for the term of the regulated mortgage contract or home purchase plan, and under (7) superseded versions of the responsible lending policy must be kept for so long as any contract to which they applied remains outstanding. But MCOB 11.6 is responsible lending and financing — it binds mortgage lenders and home purchase providers. Decision: check your permissions on the FS Register. If you are intermediary-only, that row is not your obligation and you should not be retaining under it by default.

8. Write the trigger next to every period, not just the length. “Three years” is not a policy. “Three years from the date the advice was given” is. Three of the rules above start their clocks on three different events.

9. Now open the everything-forever folder. Keeping more than required is not the safe option, it is a different exposure. UK GDPR Article 5(1)(e) — storage limitation — says personal data must be kept in a form permitting identification for no longer than is necessary for the purposes it is processed for. The ICO’s guidance is direct about the consequence: the UK GDPR sets no specific time limits, so if you do not have a retention policy covering all the personal data you hold, you must regularly review it and delete or anonymise. There is no neutral position. You either justify the retention or you clear it.

10. For anything you keep past the MCOB period, name the reason and a review date. An open complaint, a live contract, a claim in prospect. The reason goes in the file. Anything with no reason and no review date is the thing to delete. Record that you deleted it and under what rule.

The judgement

The firms that get this wrong in the expensive direction are not the ones binning things early. They are the ones holding a decade of income evidence, bank statements and call recordings on a shared drive because nobody wanted to be the person who deleted something. That folder is a subject access request you cannot answer in a month and a breach notification you cannot scope.

MCOB tells you the floor. It does not tell you to build a warehouse on top of it.