Description

Recordkeeping Policy Template for South African FSPs

The Recordkeeping Policy Template is an editable downloadable document designed for Financial Services Providers that need a practical policy for creating, storing, protecting, retrieving, retaining and lawfully disposing of business, client and compliance records.

This Recordkeeping Policy Template includes data protection measures and statutory record retention timelines for FAIS, FICA, POPIA, PAIA, Companies Act, tax, payroll, employment, accounting and operational records. It helps an FSP show that records are not treated as informal admin files, but as compliance evidence that must be complete, accurate, secure and retrievable.

For related compliance templates, you may also view our Accounting Policy and Procedures Template, Client Advisory Policy Pack and FICA RMCP Template and Annexure Pack.

For official regulatory context, you can also visit the FSCA FAIS regulated entities page.

What Is Included In This Recordkeeping Policy Template?Recordkeeping Policy Template for South African FSPs

This template is designed to help FSPs manage the full lifecycle of records, from creation or receipt through to classification, storage, use, protection, retrieval, archiving and lawful disposal.

The policy includes sections for:

• Document control and policy ownership
• Policy review and version control sheet
• Change log
• Training and implementation record
• Introduction to recordkeeping obligations
• Purpose and objectives of the policy
• Scope of application
• Legal and regulatory framework
• Core recordkeeping policy statements
• Definitions, including record, personal information, retention period, disposal and approved repository
• Roles and responsibilities
• Records management procedures
• Physical record controls
• Electronic record controls
• Security and access controls
• Record retention principles
• Minimum statutory retention schedule
• Disposal, deletion and de-identification procedure
• Retrieval, backup and assurance testing
• Breach and incident management
• Training and awareness
• Monitoring and review

Recordkeeping Policy Template Annexures Included

The Recordkeeping Policy Template includes practical annexures that help the FSP implement the policy and keep evidence of recordkeeping controls.

The annexures include:

• Annexure A: Recordkeeping Responsibility Matrix
• Annexure B: Detailed Record Retention Schedule
• Annexure C: Electronic Filing Structure Template
• Annexure D: Access Rights Register
• Annexure E: Record Disposal Authorisation and Register
• Annexure F: Record Retrieval and Restoration Test Log
• Annexure G: POPIA / PAIA / Data Subject Request Register
• Annexure H: Recordkeeping Breach / Incident Register
• Annexure I: Annual Recordkeeping Review Checklist
• Annexure J: Staff Acknowledgement and Declaration
• Annexure K: Approval and Adoption

Why FSPs Need a Recordkeeping Policy Template

Recordkeeping is a key part of compliance evidence. If an FSP cannot retrieve client files, advice records, FICA documents, complaints records, training evidence, financial records or regulatory correspondence, it may struggle to prove that it complied with its obligations.

A written Recordkeeping Policy Template helps the FSP document how records must be created, saved, protected, retained and disposed of. It also helps staff understand that records must not be deleted, altered, destroyed or stored in unapproved locations.

This template helps address common weaknesses such as:

• No formal recordkeeping policy
• No statutory record retention schedule
• No clear retention timelines for FAIS, FICA, POPIA, PAIA, tax, payroll and company records
• No approved electronic filing structure
• No access rights register
• No disposal authorisation process
• No record retrieval or backup restoration test log
• No POPIA / PAIA request register
• No recordkeeping breach or incident register
• No annual recordkeeping review checklist

Detailed Record Retention Schedule Included

The template includes a detailed record retention schedule covering FAIS client and advice records, replacement advice records, execution-only sales records, automated advice records, marketing material, complaints records, conflict of interest records, representative and competence records, compliance monitoring records, FICA records, POPIA records, PAIA records, company records, accounting records, tax records, payroll records, HR records, supplier records, insurance records, website records, LMS records, policies, SOPs and legal hold records.

The schedule also reminds the FSP to apply the longest applicable retention period where more than one law applies to the same record.

POPIA, PAIA and Data Protection Controls

This Recordkeeping Policy Template includes practical controls for protecting personal information, managing access rights, handling POPIA or PAIA requests, restricting processing where required and securely deleting or de-identifying records when retention is no longer authorised.

The POPIA / PAIA / Data Subject Request Register helps the FSP record the date received, requester, request type, records affected, decision, response and finalisation date.

Retrieval, Backup and Disposal Controls

The policy includes a record retrieval and restoration test log to help the FSP test whether records can be found and restored when needed. This is useful for client file reviews, FSCA requests, FIC inspections, SARS audits, Ombud matters and internal compliance monitoring.

The record disposal authorisation register helps ensure that records are only destroyed, deleted or de-identified after the retention period has expired and no complaint, audit, investigation, legal hold or regulatory request is pending.

Who Should Use This Recordkeeping Policy Template?

• Authorised Financial Services Providers
• Key Individuals responsible for operational ability
• FSPs with representatives, administrators or outsourced service providers
• FSPs that need FAIS, FICA, POPIA and PAIA recordkeeping controls
• FSPs preparing for compliance monitoring, FSCA queries or FIC inspections
• Compliance officers assisting FSPs with recordkeeping and retention schedules
• Business owners who need a practical filing, retention and disposal framework

Editable and Customisable Recordkeeping Template

This Recordkeeping Policy Template is editable and must be customised before use. The FSP must insert its name, policy owner, Information Officer, Key Individual, approved storage locations, systems, filing structure, access controls, responsible persons, retention rules and review process.

The detailed retention schedule should be reviewed and adjusted to match the FSP’s licence categories, business model, client base, systems, products, communication channels and applicable legal obligations.

Important Compliance Note

This Recordkeeping Policy Template is a compliance support document. It does not replace legal advice, POPIA advice, tax advice, employment law advice, information security advice or a full recordkeeping audit. Each FSP remains responsible for ensuring that the final policy is accurate, implemented, monitored and aligned with its actual business model, systems, outsourced arrangements and current legal obligations.