Data Retention for Brokerage AI Voice Campaigns

Your AI agent finishes 2,000 reactivation calls in a week and leaves behind 2,000 recordings, 2,000 transcripts and a spreadsheet nobody owns. An AI voice data retention brokerage policy decides what happens to all of that next, and most brokers write it after the campaign instead of before.

The rules pull in two directions. MiFID II says keep the call for five years. GDPR says don't keep personal data a day longer than the purpose needs. This guide walks through what an AI voice campaign actually stores, which rule sets the clock on each piece, and how to write a schedule your DPO and your compliance officer will both sign.

Key Takeaways

• MiFID II Article 16(7) keeps records of client calls that may result in a transaction for five years, up to seven if the competent authority asks.
• FCA SYSC 10A.1.14R sets the same five-year floor for UK firms, extendable to seven years where the FCA requests it.
• CFTC Regulation 1.31 keeps regulatory records for at least five years and records of oral communications for at least one year.
• GDPR Article 5(1)(e) caps storage at what the purpose needs, so call lists and marketing tags get a shorter clock than the recording.
• An AI campaign creates at least seven data elements per call, and a working schedule gives each one a store, a period and an owner.
• Topcalls includes recording, transcription and analytics in its $0.35 per minute rate, so audio and transcript start on one platform with one deletion path.

1. What does an AI voice data retention brokerage policy cover?

An AI voice data retention brokerage policy lists every data element an outbound campaign creates, where each element is stored, how long it stays there and who deletes it. For a broker that means the audio, the transcript, the call summary, the outcome code, the callback time, any sentiment tag, the consent record, the suppression list and the input list itself, each with its own clock.

Brokers carry more here than a typical outbound team. A dormant trader is still a client, the call might end with a deposit, and the recording is a regulated record from the second it exists. Most brokers settle the scope question first; the guide on compliant AI calling for forex brokers covers who signs what. This one covers the data.

Inventory before policy. Here's what one AI call leaves behind:

• Audio recording: the file itself, usually the longest-lived element because MiFID II or FCA rules set its clock.
• Transcript and summary: the same content as the audio in text form. Treat it as a copy of the regulated record, not as a marketing note.
• Outcome and callback fields: "not interested", "call back Tuesday", "deposit promised". These land in the CRM and outlive the campaign by accident.
• Sentiment and intent tags: analytics output. Useful for 30 days, personal data for as long as you keep them.
• Input list and consent record: the numbers you called and the proof you were allowed to call them.

• Suppression list: the opt-outs. The one element that should outlast everything else.

2. How long must brokers keep AI call recordings?

Five years, extendable to seven, for any call with an EU or UK client that results or may result in a transaction. MiFID II Article 16(7) sets that period for investment firms, FCA SYSC 10A.1.14R mirrors it for UK firms, and CFTC Regulation 1.31 asks US registrants to keep regulatory records for at least five years and records of oral communications for at least one year.

A reactivation call to a funded but inactive trader can end with "I'll put $500 in tomorrow." That's a call that may result in a transaction. So most compliance desks treat every AI call to a live client as in scope rather than argue it one call at a time; the MiFID II call recording guide goes through the scope test in detail.

Read the source text before you pick a number. The EU wording is in MiFID II Article 16, the UK rule is SYSC 10A.1.14R and the US rule is 17 CFR 1.31. The MiFID II paragraph adds something brokers miss: the records "shall be provided to the client involved upon request", so retrieval by client name isn't optional.

The mistake we see most often is one period for the whole campaign. Seven years for everything, including the sentiment tags and the CSV of phone numbers. That's the opposite of what GDPR asks for, and it's the reason the schedule needs one row per element instead of one number at the top.

The AI Calling Compliance Planning Checklist for Brokers has a data retention and deletion section that inventories every element the campaign creates, maps where each one is stored, and asks you to test the deletion process on one record before launch.

3. What does GDPR storage limitation mean for AI call data?

GDPR Article 5(1)(e) says personal data is "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed" (full text). For an AI campaign that means the recording can sit under a five-year regulatory purpose while the marketing tags, callback notes and input list get a shorter clock tied to the campaign itself.

Two purposes, two clocks. The recording exists because a regulator says it must, so its purpose lasts as long as the rule. The callback field exists so a human can ring the trader back on Tuesday. Once Tuesday has passed and the trader has either deposited or said no, that field has done its job.

The trap is the transcript. It's a copy of the regulated record, so it can share the recording's clock. But the moment an agent pastes it into a CRM note or a Slack channel, it becomes a second copy on a clock nobody set. The GDPR review for AI voice calls covers lawful basis and DPIAs; for the broader outbound picture there's also our guide to GDPR and AI outbound calling.

Erasure requests get a split answer. The marketing elements go. The regulated recording stays for as long as the rule that requires it says so, and the trader gets a written reply that says which is which. Write that reply before the first request lands, because the first one usually arrives within a fortnight of launch.

4. Where does AI voice campaign data actually live?

In more places than the calling platform. A typical brokerage campaign puts the audio and transcript on the calling platform, the outcome and callback fields in the CRM, the analytics in a warehouse or dashboard, and copies of all of it in email inboxes and chat channels. Each store needs its own line in the schedule, and the vendor's sub-processors count as stores too.

Topcalls includes call recording, transcription and analytics in its $0.35 per minute rate, so the audio, the transcript and the analytics for one call start on one platform under one call ID. One deletion path instead of three. The platform's compliance posture covers TCPA, TSR, DNC and GDPR, and the secure infrastructure page describes how recordings are handled.

Then you connect it to the CRM and every outcome becomes a second copy. Topcalls reaches 5,000+ tools through Integrations, which is how a call summary lands on the right MT5 account record in seconds. It's also exactly how a transcript ends up in a HubSpot note with no retention rule. Decide which fields cross over and which stay on the platform before you switch the connection on.

Sub-processors are the part brokers forget. Speech-to-text, the voice model and telephony each see the call, and each may run in a different country from the one the trader lives in. Ask the vendor for the list and put it in the data processing agreement. Where the recording is stored versus where the trader lives is a transfer question, and the guide to cross-border AI calling for brokers walks through the mechanisms.

5. How do you write the retention schedule?

One row per data element with five columns: element, store, purpose, retention period, owner. Set the recording and transcript to the longest regulatory rule that applies to any of your licensed entities, set the marketing elements to the campaign's life plus a short review window, and set the suppression list to never expire. Then delete one real record end to end and time it.

• Start from the entities, not the list: a group with an FCA entity and a CySEC entity picks the longer rule for shared systems, because the recording store doesn't know which entity made the call.
• Pin the transcript to the audio: same call ID, same store, same period. A transcript with its own lifecycle is a second record you'll have to explain.
• Give marketing fields a date, not a vibe: callback time, sentiment tag and outcome expire at campaign end plus 90 days, or whatever window your DPO agrees, written down.
• Set the consent age cut-off: agree the oldest consent you'll rely on and drop input rows older than that before the first dial, not after.
• Make the suppression list immortal: an opt-out has to survive every purge, so it lives outside the marketing data with its own owner. The suppression rules guide covers how to structure it.
• Test deletion on one record: pick a test call, delete it from the platform, the CRM, the warehouse and the inbox, and write down how long it took. If it took a week, the schedule isn't real yet.

US numbers add a layer. State recording consent rules decide whether the recording can exist at all, and the state-by-state recording consent guide lists which states need every party to agree.

Retention isn't free, but it's cheap next to the campaign. Five years of audio on 20,000 three-minute calls is a storage line item; the calls themselves cost $0.35 per minute on Topcalls, so $1.05 per call and about $21,000 for the batch. Before you commit to either number, check what the dormant book is worth: the dormant trader revenue calculator turns your account count and average deposit into a recovery estimate, and the customer reactivation solution page shows what the campaign itself looks like.

6. When doesn't a full retention schedule fit?

A full schedule is more than you need in three situations: you're an introducing broker or affiliate with no regulated entity, you're running fewer than a few hundred test calls, or your firm already has a records management system with a schedule the AI data can join. In each case a single page beats a new process, but the page still has to exist.

• No regulated entity: the MiFID II and FCA clocks don't apply to an IB that only passes leads on. GDPR still does, so the marketing rows stay and the five-year row goes.
• A small pilot: 200 calls to internal numbers and a handful of real traders don't need a warehouse mapping. They do need a deletion date and someone who owns it.
• An existing records schedule: don't build a parallel one. Add "AI call recording", "AI call transcript" and "AI campaign outcome fields" as new rows in the schedule you already have and reuse its owners.

And if your compliance desk hasn't decided whether reactivation calls fall under recording rules at all, stop here. Settle scope first. Retention periods for a record you haven't agreed to keep are a debate with no ending.

7. What should a broker do this week?

Three things, in order. Pull the inventory: list every element one AI call creates and where each copy lands, including inboxes. Assign a period and an owner per row, using the longest rule your entities fall under for the recording and transcript. Then delete one test record end to end and time it. That's a working schedule, and it usually takes an afternoon.

If you'd rather walk through it with someone who has set this up for other brokerages, book a 30-minute call and bring your entity list. You'll get a proposal within 48 hours, and most brokers have a campaign live within about two weeks, with the retention rows agreed before the first dial.

The checklist below covers consent, US TCPA setup, MiFID II recording, retention and deletion, cross-border jurisdictions and a sign-off gate, with a named approver for each section.