Email Archiving for Financial Services: DORA, MiFID II, and Beyond

Financial services organisations operate under the most demanding email retention regime in the European Union. Unlike the general commercial correspondence rules that apply to all businesses, financial entities must satisfy overlapping obligations drawn from market conduct regulation, prudential supervision, cybersecurity law, and national regulator guidance - each with its own retention period, integrity requirement, and supervisory sanction.

Email is not a peripheral concern in this framework. It is the primary medium through which investment advice is given, orders are placed and confirmed, client complaints are received, and regulatory correspondence is conducted. A failure to archive it correctly is simultaneously a market conduct violation, an ICT risk management deficiency, and in some jurisdictions a criminal record-keeping offence.

This article sets out the core obligations - MiFID II, DORA, NIS2, and the requirements of BaFin, the FCA, AMF, and CONSOB - and explains what a compliant email archiving programme must deliver to satisfy each of them.

MiFID II Article 16(7): The Foundation of Financial Email Retention

The Markets in Financial Instruments Directive II (Directive 2014/65/EU), and its implementing regulation MiFID II Delegated Regulation (EU) 2017/565, establish the bedrock record-keeping obligation for investment firms operating in the EU and EEA.

Article 16(7) of MiFID II requires investment firms to retain records of all services, activities, and transactions they undertake, in a form and manner that enables competent authorities to monitor compliance. Article 16(7) is not limited to formal contract documents. It captures the full communication chain surrounding any service or transaction, which in practice means all email correspondence with clients, between staff involved in client-facing activity, and between the firm and execution venues or counterparties.

MiFID II Delegated Regulation Article 76 operationalises this obligation:

• Records must be retained for a minimum of five years from the date of creation. Competent authorities may extend this to seven years where the retention is justified by market monitoring requirements.
• Records must be stored on a durable medium that ensures they cannot be altered or deleted during the retention period.
• Records must be reproducible in their original form: the archived version must be a faithful copy of the communication as sent or received, not a reformatted or summarised version.
• Firms must have adequate systems to allow competent authorities to access records promptly and to reconstruct any service or transaction.

Article 76(9) explicitly addresses electronic communications: telephone recordings and electronic communications relating to transactions concluded by phone or electronically are specifically in scope. For email, this means all messages that constitute, initiate, record, or relate to an investment transaction or client order - which in a modern investment firm encompasses virtually the entire outbound and inbound email flow.

ESMA's Technical Standards on MiFID II record-keeping (Commission Delegated Regulation (EU) 2017/589 and related RTS) reinforce the integrity requirement. Records must be stored in a format that prevents retrospective amendment, and the firm must be able to demonstrate on audit that no record has been altered since capture.

The practical consequence is that a MiFID II-compliant email archive must be:

• Immutable from the moment of capture (no post-storage modification)
• Retained for at least five years (seven years if the competent authority requires it)
• Fully searchable and reproducible on demand
• Accessible to the competent authority without undue delay

DORA: ICT Risk Management and Third-Party Oversight

The Digital Operational Resilience Act, Regulation (EU) 2022/2554 (DORA), has applied across all EU Member States since 17 January 2025. It imposes a comprehensive ICT risk management framework on financial entities and introduces specific obligations for third-party service providers delivering ICT services to those entities.

Email as a Critical Information Asset Under Articles 6-16

DORA's Chapter II requires financial entities to maintain a documented, board-approved ICT risk management framework. Article 8 requires complete identification and classification of all ICT assets, including data and third-party services. Business email - whether self-hosted or delivered via a cloud provider - must be catalogued as a critical information asset. The unavailability or compromise of email directly affects the firm's ability to communicate with clients, counterparties, and regulators, which DORA treats as a critical business function.

Article 9 requires integrity, availability, and confidentiality controls for all critical information assets. For email, this means encryption, access controls, and tamper-proof archiving. An archive that uses write-once storage or cryptographic hashing to prevent post-capture modification satisfies Article 9's integrity requirement.

Article 12 mandates backup policies for critical systems, with recovery tested against defined recovery time and recovery point objectives. Email archives that are operationally independent of the primary mail server satisfy Article 12's separation requirement and provide a verified recovery path. DORA explicitly requires that backup copies are stored in a location physically and logically separate from primary systems.

Article 9(4)(h) requires mechanisms to generate logs and enable reconstruction of ICT events. An immutable, indexed email archive is the most complete log of a financial entity's communication activity and provides the forensic foundation for post-incident reconstruction.

Third-Party Provisions Under Articles 28-30

Most financial entities deliver email via third-party SaaS providers, and many use cloud-based email archiving services. DORA Articles 28-30 impose specific obligations on the financial entity as the contracting party.

Article 28 requires a complete register of ICT third-party providers and documentation of whether each arrangement supports a critical or important function. Email archiving that supports MiFID II retention obligations qualifies as critical: its failure would directly impair the firm's ability to satisfy regulatory record-keeping requirements.

Article 30 sets out the mandatory minimum content of contracts with ICT third-party providers. For email archiving agreements, the following provisions are now legally required:

• Identification of the specific jurisdictions where data is processed and stored
• Documented availability, integrity, and confidentiality commitments
• Audit rights for the financial entity, its competent authority, and the European Supervisory Authorities
• Service levels for incident response and resolution
• Exit provisions including data portability with defined timelines and formats

Financial entities should review existing archiving contracts against this list. Agreements predating DORA that lack these provisions require renegotiation or replacement.

Incident Reporting for Email-Related Incidents

DORA Chapter III (Articles 17-23) establishes mandatory incident classification and reporting. Email incidents fall within scope:

• Extended unavailability of email affecting client communication or order flow
• Unauthorised access to email accounts or the archive
• Ransomware affecting email infrastructure or destroying archived records
• Accidental or deliberate deletion of records required for MiFID II compliance
• Data exfiltration from the email archive

Article 19 requires a three-stage reporting timeline: initial notification within four hours of classifying an incident as major (or 24 hours from awareness at the latest), an intermediate report within 72 hours, and a final report within one month. An email archive accelerates the forensic investigation needed to meet these deadlines and provides the evidence base for the reports themselves.

NIS2: Financial Sector as Essential Entities

Directive (EU) 2022/2555 (NIS2) applies to financial entities as essential entities under Annex I - specifically the banking sector and financial market infrastructures. NIS2 entered into force on 18 October 2024, with member state transposition required by the same date.

As noted in Article 4 of DORA, financial entities subject to DORA are considered to satisfy the equivalent NIS2 requirements for ICT risk management and incident reporting. In practice, DORA functions as a lex specialis to NIS2 for financial entities: DORA's more detailed requirements take precedence, but NIS2 fills any gaps for activities or entities not fully covered by DORA.

NIS2 Article 21(2) requires essential entities to address ten minimum categories of risk management measures. Those most directly relevant to email in financial services are:

• Article 21(2)(b): incident handling procedures, including detection, containment, and investigation
• Article 21(2)(c): business continuity and backup management, including independent access to historical email during primary system outages
• Article 21(2)(i): cryptographic controls for data at rest and in transit

NIS2 Article 23 imposes a parallel incident reporting regime to DORA's, with a 24-hour early warning and 72-hour detailed notification. For financial entities, DORA's reporting obligations take precedence, but entities with activities outside DORA's scope - for example, payment institutions conducting non-investment activities - should assess whether NIS2 reporting obligations apply independently.

The management liability provisions of NIS2 Article 20 are directly relevant. Management bodies of essential entities must approve and oversee cybersecurity risk management measures, and can be held personally accountable for infringements. For CIOs and compliance officers in financial services, this means that board-level sign-off on email security and archiving policies is not optional - it is a legal requirement.

National Regulator Requirements

Beyond the EU-level framework, national regulators impose additional expectations that vary by jurisdiction. The following overview covers the four largest EU financial markets and the UK.

BaFin (Germany) - MaRisk and BAIT

The Bundesanstalt fur Finanzdienstleistungsaufsicht (BaFin) supervises German credit institutions, investment firms, and insurance undertakings. BaFin's Minimum Requirements for Risk Management (MaRisk) and the Banking Supervisory Requirements for IT (BAIT) provide the operational framework for ICT risk management in German financial entities.

MaRisk AT 7.2 requires institutions to have in place procedures and systems to ensure the completeness, correctness, and availability of data. For email, this translates to comprehensive capture of all business-relevant communications, tamper-proof storage, and guaranteed availability for the full retention period.

BAIT Section 5 (Operational information security) and Section 7 (IT operations) require financial institutions to implement controls that ensure the integrity and availability of data across all critical systems, including communication infrastructure. BaFin examiners treat email archiving deficiencies as evidence of inadequate IT governance.

Retention under HGB section 257 requires commercial correspondence to be retained for six years, and accounting vouchers for eight years and books for ten years under AO section 147. For banks, insurers and investment firms the shortening from ten to eight years applies one year later. For investment firms under MiFID II, the five-year minimum from MiFID II applies alongside these commercial law obligations. In practice, most German financial entities apply a ten-year retention standard to avoid maintaining different retention schedules for different categories of email.

FCA (United Kingdom) - SYSC 9

The Financial Conduct Authority's Senior Management Arrangements, Systems and Controls sourcebook (SYSC) applies to FCA-authorised firms in the UK. The UK retained MiFID II record-keeping requirements following Brexit, with the equivalent obligations now set out in UK MiFID and the FCA's SYSC 9.

SYSC 9.1.1R requires firms to retain records of all services, activities, and transactions undertaken, in a form that enables the FCA to monitor compliance. The content of the obligation mirrors MiFID II Article 16(7), with a five-year minimum retention period.

SYSC 9.1.5R addresses the medium and format of records: they must be stored on a durable medium and must be capable of reproduction in a form that allows the FCA to access them promptly. The FCA has published guidance confirming that immutable electronic archives satisfy this requirement, provided the firm can demonstrate that records have not been altered since capture.

The FCA's Market Conduct sourcebook (MAR 1) and the associated UK Market Abuse Regulation impose additional record-keeping requirements for communications relating to market-sensitive information. Communications that could constitute or evidence market abuse must be retained and must be accessible for FCA investigation.

AMF (France) - RG AMF

The Autorite des marches financiers (AMF) supervises investment service providers and market infrastructure operators in France. The AMF's General Regulation (Reglement General de l'AMF) transposes MiFID II record-keeping requirements and adds sector-specific detail.

AMF RG Article 313-48 requires investment service providers to retain records sufficient for the AMF to verify compliance with applicable rules. The retention period for investment services communications is five years from the date of communication, extendable to seven years at the AMF's direction.

The AMF has conducted a series of enforcement actions against firms for inadequate communication record-keeping. Penalties have been imposed where firms were unable to produce email records during AMF investigations, even where the firms maintained that records existed but were not readily accessible. The practical lesson is that retention alone is insufficient - the archive must be searchable and producible within the timeframes the AMF expects during investigations.

AMF Instruction 2007-02 (updated post-MiFID II) provides technical guidance on record-keeping systems, including requirements for data integrity verification and access controls.

CONSOB (Italy) - Testo Unico della Finanza

Italy's Commissione Nazionale per le Societa e la Borsa (CONSOB) supervises Italian investment firms under the Testo Unico della Finanza (TUF) and implementing regulations transposing MiFID II.

CONSOB Regulation 20307/2018 (the Intermediaries Regulation) requires investment firms to retain records of services, activities, and transactions for five years, in a form that enables CONSOB to verify compliance. The requirements mirror MiFID II Article 16(7) and Delegated Regulation Article 76.

CONSOB has specifically addressed electronic communication archiving in its supervisory guidance, requiring that firms implement controls to prevent post-capture modification and to ensure continuity of access during system migrations or changes of service provider. The latter point - continuity during provider transitions - maps directly onto DORA's Article 30 exit provision requirements.

Supervision and Monitoring: Beyond Simple Storage

The requirement to retain email for regulatory purposes is distinct from, but complementary to, the requirement to monitor it. Financial regulators expect firms to operate surveillance and supervision programmes over electronic communications, not merely to archive them passively.

Keyword Alerts and Automated Monitoring

EU and UK market conduct rules require investment firms to have controls in place to detect potential market abuse, misuse of client information, and regulatory breaches. For email, this typically involves:

• Keyword surveillance: automated scanning for terms associated with insider trading, market manipulation, front-running, and client data misuse
• Pattern detection: flagging unusual communication patterns, such as high-frequency email exchanges with external parties before material announcements
• Out-of-channel communication controls: monitoring for instructions to use non-approved communication channels, which is a persistent supervision challenge

The email archive must support these programmes: it must be searchable across its full content (not merely metadata), it must be capable of generating alerts based on configurable rules, and supervisory review workflows must be documented and auditable.

Lexicon Review and Escalation Workflows

Compliance functions in financial services typically maintain a surveillance lexicon - a list of terms and phrases that trigger manual review when they appear in archived communications. The archive must support lexicon-based search, queue flagged messages for reviewer action, record the reviewer's decision, and retain the complete audit trail of the review workflow.

Regulators, including the FCA and BaFin, have reviewed firms' surveillance programmes during thematic supervisory visits and have cited deficient archive search capability as a finding. An archive that stores messages but cannot support structured surveillance workflows does not satisfy the full scope of regulatory expectations.

Retention Enforcement and Legal Hold

Beyond standard retention, financial entities require the ability to apply legal holds to specific communications in response to regulatory investigations, civil litigation, or internal inquiries. A legal hold suspends automatic deletion for specified accounts, date ranges, or message sets, preserving records beyond the standard retention schedule while litigation or investigation is pending.

The absence of a legal hold capability in an archiving system creates operational risk: standard retention schedules may delete records that are the subject of an active regulatory investigation, which is itself a serious compliance failure.

Retention Requirements Summary

The following table summarises the principal retention obligations applicable to email in EU and UK financial services:

Where multiple obligations apply, the longer retention period governs. German financial entities subject to MiFID II, HGB, and AO should apply a ten-year standard to avoid maintaining differentiated schedules. Entities in multiple jurisdictions should map the longest applicable period by record category.

Practical Requirements for a Compliant Financial Services Archive

Synthesising the requirements above, a compliant email archiving programme for a financial services entity must satisfy the following:

Capture completeness: all inbound and outbound email must be captured automatically, without reliance on user action. Selective archiving (capturing only flagged or forwarded messages) does not satisfy MiFID II or national regulator requirements.

Immutability: messages must be stored in a form that prevents modification after capture. This requires either write-once storage or cryptographic hashing that allows detection of any post-capture alteration. ESMA and national regulators treat the ability to demonstrate immutability as a baseline audit requirement.

Retention enforcement: the system must enforce minimum retention periods automatically and must support legal holds that suspend deletion for specified record sets.

Searchability and reproducibility: the archive must support full-content search across its entire scope and must reproduce messages in their original form, including attachments. Metadata-only search does not satisfy MiFID II reproducibility requirements.

Surveillance workflows: the system must support lexicon-based keyword search, flagging and review queues, and auditable reviewer decisions to support the supervision obligations under MiFID II and market conduct rules.

Access audit logging: all access to the archive, including searches, message views, and exports, must be logged and the logs must be retained as evidence of controlled access.

Data localisation and third-party contractual compliance: for EU-regulated entities, archived data must be stored in documented jurisdictions. For DORA-covered entities, the archiving vendor contract must satisfy Article 30's mandatory provisions.

Data portability and exit: the archive must be exportable in standard formats to support DORA's exit provisions and to ensure continuity during provider transitions.

How EasyMailArchive Supports Financial Services Compliance

EasyMailArchive is designed for the compliance requirements of regulated industries, including financial services:

• Tamper-proof, immutable storage using AES-256 encryption and cryptographic integrity verification, satisfying MiFID II Article 16(7), DORA Article 9, and ESMA's record integrity standards
• Configurable retention policies supporting five, seven, and ten-year retention periods with automated enforcement, covering MiFID II, HGB, AO, and national regulator requirements
• Legal hold capability that suspends automatic deletion for specified accounts, date ranges, or search criteria pending regulatory investigation or litigation
• Full-text search across message content and attachments, supporting lexicon-based surveillance and regulatory investigation response
• Complete access audit logging of all searches, views, and exports, providing the evidence trail required for supervisory examinations under BaFin, FCA, AMF, and CONSOB
• EU-only data centres with documented jurisdictions, enabling the DORA Article 30 contract provisions that require identification of data storage locations
• Article 30-compliant contract provisions including audit rights, data localisation guarantees, documented SLAs, and data portability with defined formats and timelines
• Operational independence from primary email platforms, reducing ICT concentration risk under DORA Article 29 and ensuring archive availability during primary system incidents

Financial services compliance and IT teams can request a technical briefing on how EasyMailArchive maps to the specific requirements of MiFID II, DORA, and national regulator guidance applicable to their entity type and jurisdiction.