Market Abuse Regulation (MAR) and MiFIDII RecordKeeping Requirements

1. Why RecordKeeping Matters

Both MAR (Regulation (EU) No 596/2014) and MiFIDII (Directive 2014/65/EU together with Regulation (EU) No 600/2014) impose strict obligations on investment firms to preserve evidence of their business conduct. The main objectives are:

• Detecting and preventing market manipulation, insider dealing and other abusive practices.
• Providing supervisors with reliable data for investigations and audits.
• Ensuring transparency for market participants and safeguarding investor confidence.

2. Scope of MAR RecordKeeping

MAR applies to any person who is a financial market participant (including issuers, brokers, analysts, and undertakings of collective investment). Key records that must be retained include:

• Orders and orderrelated communications (submission, amendment, cancellation).
• Trade confirmations, trade reports and posttrade allocations.
• Inside information handling logs of receipt, dissemination and disposal.
• Any communication that could influence the price of a financial instrument (e.g., research reports, analyst recommendations).

2.1 Retention Period

Under MAR, records must be kept for at least **five years** from the date of the transaction or communication. The competent authority may require a longer period in exceptional cases.

2.2 Format and Accessibility

Records must be stored in a format that enables retrieval in a readable form within a reasonable timeframe. Electronic storage is permitted if it guarantees integrity, confidentiality and auditability. Firms must be able to produce the information to regulators on request, typically within ten working days.

3. MiFIDII RecordKeeping Requirements

MiFIDII extends the obligations set out in MAR and adds specific duties for:

• Best execution and transaction reporting.
• Client order handling and execution venues.
• Algorithmic and highfrequency trading firms.

3.1 Mandatory Records

Firms must retain the following categories (Article25 of MiFIDII):

1. Orders, confirmations and allocations (including timestamps).
2. Details of all outside and inside the firm communications that could affect price formation.
3. Pre and posttrade transparency data (e.g., quote updates, executed price).
4. Transaction reports submitted to the regulator.
5. Algorithmic trading parameters, testing results and monitoring logs.

3.2 Retention Period

MiFIDII requires a minimum **fiveyear** retention, with the possibility of a further five years on request from the competent authority. The period starts from the **day after** the transaction is concluded or the communication is made.

3.3 Technical Requirements

Records must be:

• Stored in a noneditable, timestamped format.
• Securely backed up and protected against unauthorised alteration.
• Easily searchable (e.g., by instrument, client, date, order reference).
• Available in the official language(s) of the jurisdiction where the firm is established.

4. Overlap and Differences Between MAR & MiFIDII

5. Practical Steps for Compliance

1. Map all communication channels. Include email, instant messaging, voice recordings and tradeorder systems.
2. Implement a centralized dataarchiving solution. Use a system that timestamps, encrypts and indexes every record.
3. Define retention policies. Configure automatic deletion only after the mandated period, with audit logs of any early removal.
4. Conduct periodic internal audits. Verify that records are complete, searchable and that backup procedures function correctly.
5. Train staff. Ensure that traders, compliance officers and IT personnel understand their obligations to preserve and forward relevant data.
6. Prepare for supervisory requests. Maintain a readyset procedure to extract requested records within the statutory timeframe.

6. Technology Solutions

Many firms rely on dedicated compliance platforms that integrate with ordermanagement, execution and communication tools. Key features to look for:

• Realtime capture of order flow and communication metadata.
• Immutable storage (e.g., blockchainbased audit trails or WORMtype disks).
• Advanced search capabilities (fulltext, filter by ISIN, client, timestamp).
• Automated retentionpolicy enforcement and export functions for regulatorrequested extracts.

7. Consequences of NonCompliance

Breaches can result in:

• Administrative fines up to 5million or 10% of annual turnover (whichever is higher).
• Criminal sanctions for severe insider dealing or manipulation.
• Reputational damage, loss of client trust and possible restriction of market access.

8. Conclusion

Both MAR and MiFIDII share the goal of a fair, transparent market but address different aspects of market conduct. Effective recordkeeping is the cornerstone of compliance it enables detection of abuse, supports regulatory investigations and demonstrates that a firm meets its fiduciary duties. By adopting robust datacapture technologies, clear policies and a culture of compliance, firms can meet the legal requirements while maintaining operational efficiency.