AMF SPOT Checks Find Gaps in Portfolio Management Companies' Telephone Recording Controls

Key Takeaways

• The AMF's SPOT campaign across five French portfolio management companies (SGPs) found weaknesses in telephone recording policies, retention periods, and deletion procedures.
• Voice ordering is declining (only 19% of surveyed SGPs use it), but the AMF says the channel carries heightened operational and compliance risk and still requires robust controls.
• Compliance teams should use the findings to benchmark their own recording frameworks, especially where MiFID II, AIFM, UCITS, and GDPR requirements overlap.

Deep Dive

The AMF's SPOT campaign across five French portfolio management companies (SGPs) found weaknesses in telephone recording policies, retention periods, and deletion procedures. Voice ordering is declining (only 19% of surveyed SGPs use it), but the AMF says the channel carries heightened operational and compliance risk and still requires robust controls. Compliance teams should use the findings to benchmark their own recording frameworks, especially where MiFID II, AIFM, UCITS, and GDPR requirements overlap.

The AMF reviewed five SGPs of varying sizes and activity mix for January 1, 2023 to December 31, 2025. The review covered recording policy, recording scope, access and integrity, staff information and training, and ongoing and periodic controls. Voice orders were small as a share of total orders (for example, 2,691 of 54,226 at SGP No. 5, and 73 of 7,025 at SGP No. 1). The AMF nonetheless stresses that telephone transactions lack the native timestamping, archiving, and audit trail features of electronic channels. Low volume should therefore not translate into reduced control intensity. The report is not a formal position or recommendation, but the "good" and "bad" practices signal supervisory expectations.

The excerpt shows several findings. Policy formalization was inconsistent. SGPs No. 2, 4, and 5 had dedicated policies, while SGP No. 3 consolidated its provisions into a telephone system procedure only on October 1, 2025. SGP No. 1 had no telephone recording provisions until February 10, 2024. SGP No. 1 also had a procedure prohibiting voice orders until June 23, 2023, even though the ban had effectively been lifted at the end of 2022. Retention periods were poorly defined: three SGPs had no defined period for some or all of the review period, and SGP No. 1 relied on brokers' recordings instead of archiving its own. Three SGPs changed their periods mid-review (SGP No. 1 and No. 3 from 5 to 7 years in May and October 2025; SGP No. 4 from 7 to 5 years in June 2025). No SGP had formalized a deletion process.

The retention rules differ by activity: five years for investment services (MiFID II Delegated Regulation Art. 76(8), CMF L. 533-10 III), at least five years for AIFs (AIFM Delegated Regulation Art. 66(1)), and six months to five years for UCITS (AMF General Regulation Art. 321-73). The AMF cites two good practices. The first is a uniform five-year period, the common denominator across activities. The second is a procedure that provides for five years with extension to seven at the request of the competent authority. The AMF also highlights a tension between financial regulation, which favors broad scope and long retention, and GDPR minimization and storage limitation. CNIL guidance suggests systematic recording must rest on a clear legal obligation, while recording for internal control purposes should be sample-based, ad hoc, and random.

Recommended actions: (1) maintain a dedicated, board- or committee-validated recording policy that lists recorded lines, functions, and the rationale for each; (2) set a single documented retention period, include the seven-year extension mechanism, and document the GDPR proportionality analysis; (3) formalize a deletion procedure that prevents premature deletion; (4) confirm fixed and mobile line coverage, including RTO and discretionary and collective management activities; (5) verify access controls, integrity, and business continuity plans for telephone system outages; (6) update staff information and training and run permanent, second-level, and periodic controls on recordings. The excerpt is truncated, so teams should review the full report for the remaining findings on scope, access, training, and controls.

Risk implications: weak recording frameworks can lead to findings on organizational requirements, an inability to evidence order handling, and conflicts with GDPR. Retention changes without clear rationale, and reliance on third-party brokers' recordings, create evidentiary and regulatory exposure. Firms with low voice volumes may under-invest in controls and face supervisory criticism.

Source: Autorité des marchés financiers