AMF Publishes SPOT Inspection Findings on Telephone Recording at Asset Management Companies

Key Takeaways

• The AMF has released the results of its thematic SPOT inspections of five asset management companies on telephone conversation recording, and identified good and poor practices.
• Telephone ordering is declining, but the AMF warns that its marginal use can increase non-compliance risk because controls are often weaker.
• Compliance teams should benchmark their recording policies, controls, and training against these findings.

Deep Dive

The AMF has released the results of its thematic SPOT inspections of five asset management companies on telephone conversation recording, and identified good and poor practices. Telephone ordering is declining, but the AMF warns that its marginal use can increase non-compliance risk because controls are often weaker. Compliance teams should benchmark their recording policies, controls, and training against these findings.

The review covered five areas: the recording and storage policy; the scope of recording; access conditions, confidentiality, integrity, and storage of recordings; information for recorded persons and employee training; and permanent and periodic controls. The AMF notes that only 19% of respondents to its summer 2025 questionnaire still use the telephone channel. It stresses that this does not reduce risk. Recording, storage, and traceability rely on operational systems that are often more complex than the built-in time stamping and archiving of electronic tools. Recordings also contain personal data and fall under GDPR requirements. The exceptional nature of the channel can weaken operational control.

Good practices include:
- a uniform five-year retention period, extendable to seven years at the request of the competent authority;
- a policy that lists the functions with recorded extensions and the reason for recording each;
- onboarding and annual awareness training reminding staff that calls are recorded;
- quarterly listening to a sample of voice-placed orders.

Poor practices include:
- provisions scattered across documents rather than collated in a single policy;
- no controls over the installation and use of recording applications on employee mobile phones;
- no explicit telephone recording controls in the compliance and internal control plan;
- access to recordings that depends on a technical department.

Compliance teams should:
- Consolidate all recording rules into a single policy.
- Confirm that retention periods align with the five-year baseline and seven-year extension capability.
- Map recorded functions and document the rationale for each.
- Test mobile recording applications and confirm installation and usage controls.
- Add telephone recording checks to the compliance and internal control plan, covering both permanent and periodic controls.
- Give compliance direct access to recordings without reliance on IT.
- Refresh training and sampling programs.
- Involve the data protection officer to confirm GDPR alignment, including recorded-person notices and access security.

No deadlines or penalties are stated. However, gaps could lead to supervisory findings, remediation demands, or sanctions for breaches of record-keeping obligations. Weak access controls or unmonitored mobile channels also create data protection exposure and may impair the firm's ability to reconstruct events during market abuse or client dispute investigations. Firms that have dropped telephone ordering should verify that it is actually unused and that any residual use remains controlled.

Source: Autorité des marchés financiers