Recordkeeping and Surveillance Obligations

Recordkeeping failures are the most expensive compliance problem in derivatives right now. Since December 2021, the SEC, CFTC, and FINRA have imposed exceeding $3.5 billion in combined penalties for recordkeeping violations—most involving employees using WhatsApp, Signal, and iMessage for business communications that never reached compliance archives. The practical antidote isn't more policies on paper. It's systematic capture, structured retention, and automated surveillance that removes human discretion from the equation.

TL;DR: Derivatives recordkeeping requires capturing every trade, communication, and margin calculation under strict deadlines (T+1 reporting, 5+ year retention). Off-channel communications have driven billions in fines. Build systems that capture by default—don't rely on employee behavior.

What Counts as a "Regulatory Record" (The Scope Is Wider Than You Think)

Under 17 CFR 1.31, a regulatory record is any book or record required by the Commodity Exchange Act or CFTC regulations—including corrections, amendments, and all metadata necessary to access, search, or display electronically stored records. That definition is deliberately broad.

For swap dealers and major swap participants, 17 CFR 23.202 requires daily trading records that include:

• Initial margin and variation margin calculations for each counterparty
• Collateral valuations (both pre-haircut and post-haircut)
• All collateral transfers executed that business day
• Trade tickets with UTC timestamps to the nearest minute
• Pre-execution oral and written communications related to trades

The point is: recordkeeping isn't just about trade confirmations. It covers the entire lifecycle—from the pre-trade conversation through daily margin calculations to post-termination archival.

Record type → Capture requirement → Retention period → Storage standard

Why this matters: if you cannot produce a complete audit trail—from the first phone call through the final margin payment—you have a recordkeeping deficiency, regardless of whether the underlying trades were properly executed.

Reporting Deadlines and Data Requirements (Where Firms Trip Up)

CFTC Part 45: Swap Data Reporting

Under CFTC Part 45, swap creation data must be submitted to a registered Swap Data Repository (SDR) by T+1—one business day after execution. Each transaction requires a Unique Transaction Identifier (UTI) that enables regulators to track the trade's full lifecycle across counterparties and repositories.

If a firm discovers a late submission, the remediation window is 7 business days from discovery to correct underreporting errors. Miss that window, and the violation compounds.

Real-time public reporting under Part 43 adds another layer: swap transaction and pricing data must be publicly disseminated as soon as technologically practicable after execution (subject to block-trade time delays).

EMIR Reporting: The REFIT Expansion

Under EMIR Article 9, both counterparties must report derivative contract details to a registered trade repository by T+1 (one working day after conclusion, modification, or termination). This dual-sided reporting requirement means two independent submissions for every trade—and reconciliation breaks between them trigger regulatory scrutiny.

EMIR REFIT (effective 29 April 2024 for EU, 30 September 2024 for UK) expanded reportable data fields from 129 to 203—a 57% increase in data complexity. The revised framework introduced:

• XML ISO 20022 format (replacing legacy CSV submissions)
• Unique Product Identifier (UPI) administered by the Derivatives Service Bureau
• Mandatory Legal Entity Identifiers (LEIs) for all counterparties
• Material reporting issue notification—firms must promptly notify their national competent authority of significant issues affecting data accuracy or completeness

The EU remediation deadline for outstanding derivatives supplemental data was 26 October 2024. The UK remediation deadline for re-reporting outstanding derivatives was 31 March 2025. Firms that missed these windows face ongoing compliance gaps in their reported positions.

What this means in practice: reporting isn't a one-time filing. Every modification, novation, transfer, and termination triggers a new reporting obligation with its own T+1 deadline.

Worked Example: A Single Interest Rate Swap Through the Recordkeeping Lifecycle

Consider a plain-vanilla interest rate swap executed on a Monday between your firm (a registered swap dealer) and a corporate counterparty.

Phase 1: Pre-Execution (Monday Morning)

Your trader discusses terms by phone at 14:23 UTC. Under 17 CFR 23.202, that voice communication must be captured and archived with a UTC timestamp to the nearest minute. Under MiFID II Article 16 (if the trade has EU nexus), the recording must be stored in WORM format and retained for 5 years minimum.

Phase 2: Execution and Reporting (Monday–Tuesday)

The swap executes at 15:07 UTC Monday. Your firm must:

1. Assign a Unique Transaction Identifier (UTI)
2. Submit creation data to the SDR by end of business Tuesday (T+1)
3. Under EMIR, your counterparty must independently submit their side to a trade repository by T+1 as well—populating all 203 EMIR REFIT fields if the trade falls under EU/UK scope
4. If the swap qualifies for real-time public reporting under Part 43, disseminate pricing data as soon as technologically practicable

Phase 3: Daily Recordkeeping (Ongoing)

Each business day for the life of the swap, your operations team must calculate and record:

• Initial margin requirement: Assume a notional of $50 million with a 2% initial margin rate = $1,000,000 initial margin
• Variation margin: Mark-to-market movement—if rates shift 15 basis points against you on a $50 million 5-year swap (approximate DV01 of $4,500 per basis point), the daily variation margin call is approximately $67,500
• Collateral valuations both before and after haircuts
• All collateral transfers executed that day

Phase 4: Retention (Post-Termination)

When the swap matures or terminates, all records—trade tickets, margin calculations, voice recordings, electronic communications, and SDR submissions—must be retained for the life of the swap plus 5 years under CFTC Rule 1.31. For a 5-year swap, that means records survive for 10 years total from execution.

The practical point: A single swap generates hundreds of discrete recordkeeping obligations over its lifetime. Multiply that across a derivatives book of thousands of positions, and the operational burden becomes clear. Mechanical alternative: Automate daily margin record generation and SDR submissions through straight-through processing—manual workflows at scale guarantee gaps.

The Off-Channel Communications Problem (Why $3.5 Billion in Fines Happened)

Off-channel communications—business discussions conducted through personal devices or unapproved platforms like WhatsApp, Signal, or iMessage—have become the highest-cost recordkeeping failure in financial services.

The enforcement pattern is stark:

Individual penalties have been severe. Toronto-Dominion Bank paid $75 million to the CFTC in 2024 for recordkeeping and supervision violations. BNP Paribas paid $75 million to the CFTC in 2023 for similar failures.

The point is: these aren't penalties for bad trades or client harm. They're penalties for employees texting about trades on personal phones. The violation is the gap in the archive—the communication that compliance can never review because it was never captured.

Regulatory violation chain: Unapproved device → Unarchived communication → Recordkeeping gap → Surveillance blind spot → Supervision failure → Enforcement action

Why this matters: trade surveillance systems (designed to detect market abuse, spoofing, wash trading, and manipulation under Dodd-Frank Section 747 and EU MAR) can only analyze communications they receive. Every off-channel message is a surveillance gap that regulators now actively investigate.

Surveillance Obligations (Detection, Not Just Storage)

Recordkeeping serves surveillance. Under Dodd-Frank Section 747 (anti-manipulation), EU Market Abuse Regulation, and MiFID II Article 16(6), firms must systematically monitor trading activity for:

• Market manipulation and price distortion
• Spoofing (placing orders with intent to cancel)
• Wash trading (self-dealing to create artificial volume)
• Front-running client orders
• Insider trading patterns

Effective surveillance requires that all relevant data feeds into the monitoring system: trade data, order data, communications (voice and electronic), margin activity, and position changes. A recordkeeping failure is simultaneously a surveillance failure—if the data isn't captured, it can't be monitored.

The test: Can your surveillance system reconstruct the full context of any flagged trade—including every communication between the trader and counterparty—within one business day of a regulatory inquiry? If not, you have a structural gap.

Risks, Limitations, and Common Pitfalls

Pitfall 1: Treating recordkeeping as an IT project, not a controls problem. Technology stores records; controls ensure completeness. The firms paying hundreds of millions in fines had archiving systems—they just couldn't prevent employees from communicating outside them.

Pitfall 2: Underestimating EMIR REFIT field expansion. Going from 129 to 203 reportable fields isn't a 57% increase in data entry—it's a multiplier on reconciliation breaks, validation failures, and data quality exceptions. Firms that didn't rebuild their reporting logic (rather than patching existing systems) are still remediating.

Pitfall 3: Inconsistent retention schedules across jurisdictions. CFTC requires life of swap plus 5 years. MiFID II requires 5 years minimum, extendable to 7. Firms operating across jurisdictions must apply the longest applicable retention period to avoid gaps—typically the CFTC standard for any swap with a US nexus.

Pitfall 4: Manual surveillance review without automation. Surveillance systems generate alerts. Without automated pre-filtering and escalation workflows, compliance teams drown in false positives and miss genuine manipulation signals buried in the noise.

Pitfall 5: No process for material reporting issue notification. Under EMIR REFIT, firms must promptly notify their national competent authority of significant issues affecting data accuracy or completeness. Firms without a defined escalation path—from data quality team to compliance to regulator—risk compounding reporting failures with notification failures.

Recordkeeping and Surveillance Compliance Checklist

Essential (High ROI)—Prevents 80% of Regulatory Exposure

• Block unapproved communication channels at the device level (not just by policy—by technical control)
• Automate T+1 SDR and trade repository submissions with validation checks before transmission
• Apply the longest applicable retention period across all jurisdictions (default: life of swap + 5 years)
• Archive all pre-execution communications (voice and electronic) with UTC timestamps

High-Impact (Workflow and Automation)

• Reconcile dual-sided EMIR reports daily against counterparty submissions to catch breaks early
• Integrate all communication channels (voice, email, chat, electronic trading platforms) into a single surveillance feed
• Automate daily margin record generation (initial margin, variation margin, collateral valuations pre- and post-haircut) per 17 CFR 23.202
• Build an escalation path for material reporting issues with defined SLAs from discovery to regulator notification

Optional (Good for Firms with Large Derivatives Books)

• Implement WORM-compliant storage for all electronic records (required under SEC Rule 17a-4(f) and MiFID II Article 16)
• Run periodic mock regulatory inquiries testing your ability to reconstruct full trade context (communications + trade data + margin records) within one business day
• Maintain a UTI/UPI governance framework ensuring consistent identifier assignment across desks and systems

Your Next Step

This week, run a communication channel inventory. List every platform your derivatives traders and salespeople use to discuss business—approved and unapproved. For each channel, answer three questions: (1) Is it captured by your compliance archive? (2) Does the archived data feed into your surveillance system? (3) Can you produce a complete record within 72 hours of a regulatory request? Any "no" answer is your priority remediation item. Given that off-channel violations alone have driven over $3.5 billion in penalties since 2021, this single exercise has the highest compliance ROI of any action you can take today.

For related operational controls, see Compliance Testing for Position Limits and Disaster Recovery for Trading Desks.