AI Voice Call Recording and MiFID II Considerations

Recording the call is the easy part. For a brokerage, MiFID II call recording for AI voice calls turns on three harder questions: which calls fall under Article 16(7), what the trader has to hear before the recording starts, and where the audio has to sit for the next five to seven years. Answer those three before launch and most of the compliance work is done.

This guide is for the compliance desk of a forex or CFD broker that wants to put an AI voice agent on dormant-trader, KYC and deposit follow-up calls. It quotes the directive, the Delegated Regulation and the FCA rulebook directly, and it ends with the cases where recording every call on a seven-year clock is the wrong default.

Key Takeaways

• MiFID II Article 16(7) covers telephone conversations relating to client order services and own-account dealing, plus conversations intended to result in those transactions.
• Records must be kept for five years, or up to seven years where the competent authority asks, counted from the date the record was created.
• A firm may not provide investment services by telephone to a client who hasn't been told in advance that the calls are recorded.
• Article 76 of Delegated Regulation 2017/565 requires a written recording policy and storage in a format that doesn't allow the original record to be altered or deleted.
• Topcalls includes recording and transcription in its $0.35 per minute rate, so for a broker the recording decision is a policy question, not a budget line.

1. Does MiFID II call recording apply to AI voice calls?

Yes, whenever the call relates to client order services or dealing on own account. MiFID II Article 16(7) covers telephone conversations "relating to, at least, transactions concluded when dealing on own account and the provision of client order services", including conversations "intended to result in" those transactions. The directive doesn't separate human callers from AI voice agents. It looks at what the conversation is about.

The words "at least" matter. They set a floor, and a national regulator can go wider. A reactivation call that stays on "your account has been quiet since March, is anything blocking you?" may sit outside the order-related scope. The moment the trader asks the agent to close a position or size a trade, that same call is inside it. Your compliance officer draws the line, and the AI agent has to be configured to stay on the right side of it or hand off.

ESMA's Q&A 1766 adds that internal conversations between sales and trading desks are also in scope when they're intended to result in a transaction, while back-office staff are excluded. For an AI campaign the equivalent is the transfer leg: when the agent passes a trader to a human dealer, that second conversation is a firm communication too, and it's usually where the order talk happens.

One rule is easier to defend than a per-call decision. Record every AI call, tag each one with its call type, and let compliance decide which tags fall under the Article 16(7) clock. The wider planning steps sit in our compliance planning guide for AI calling.

2. What must traders hear before an AI agent records the call?

Traders must be told in advance that calls which result or may result in transactions will be recorded. Article 16(7) is blunt: an investment firm "shall not provide, by telephone, investment services and activities to clients who have not been notified in advance about the recording". For an AI voice agent that puts the notice in the opening line, in the trader's language, before any account talk starts.

The UK version goes a step further. FCA SYSC 10A.1.11R carries the same notification duty, and SYSC 10A.1.12AR(1) requires firms to tell clients that recordings "will be available, upon request, for a period of: (i) 5 years to the client; and (ii) 7 years to the FCA". A UK opening line has to carry more than "this call is recorded".

The notice is one approved sentence, but it has to exist in every language the campaign dials. Topcalls runs calls in 32 languages, which means 32 approved variants, not one English sentence and a hope.

• Recording notice: one sentence, approved by compliance, delivered before the agent asks anything about the account.
• AI disclosure: who is calling and that the caller is an AI agent. Our guide to AI call disclosure for brokers covers the wording per jurisdiction.
• All-party consent: several countries and US states require every participant's consent to record regardless of MiFID II. The state-by-state recording consent guide lists them.

Get the notice wrong and the problem isn't one bad call. It's every call the campaign made before someone noticed.

The AI Calling Compliance Planning Checklist for Brokers has a call recording section with eight items, from classifying each call type as in or out of MiFID II scope to naming who signs off the recording policy, alongside consent, TCPA, retention and cross-border sections.

3. How long must a broker keep AI voice call recordings?

Five years, and up to seven where the competent authority asks for it. The directive sets the floor: records "shall be kept for a period of five years and, where requested by the competent authority, for a period of up to seven years". Article 76(11) of Delegated Regulation 2017/565 starts the clock "on the date when the record is created", not when the account closes.

The FCA mirrors the same five and seven in SYSC 10A.1.14R(2). GDPR pulls the other way: personal data is kept no longer than needed. Both are satisfied if you decide retention per data element rather than per campaign. The audio and transcript of an order-related call sit on the MiFID II clock. Outcome tags, callback preferences and sentiment scores follow your marketing retention rule, which is usually shorter. Our data retention guide for brokerage AI voice campaigns walks through that table, and the GDPR outbound calling guide covers the lawful-basis side.

Cost changes the conversation here. At Topcalls' $0.35 per minute all-inclusive rate, recording and transcription are already in the price, so a five-year archive is a storage and access-control line rather than a per-call fee. If you're sizing a reactivation campaign, the dormant trader revenue calculator gives you the minutes and revenue side; retention is the one cost that doesn't scale with call volume.

One record outlasts all of the above: the opt-out. When a trader's marketing data expires, the suppression entry survives it, or the same person gets called again next year.

4. How should MiFID II recordings from AI calls be stored?

In a durable, unalterable store backed by a written policy. Article 76 of Delegated Regulation 2017/565 requires a recording policy "set out in writing", storage in "a durable medium, which allows them to be replayed or copied", retention "in a format that does not allow the original record to be altered or deleted", and records "readily accessible and available to clients on request", plus periodic risk-based monitoring.

Five requirements, five questions for whichever platform records the AI calls.

Whether the durable archive is the calling platform, your CRM or a separate write-once store is a decision for compliance and IT together. What Article 76 cares about is that the original can't be edited and that a regulator asking for "all calls with client X in Q2" gets a filter result, not a project. Topcalls' secure infrastructure page sets out its compliance posture (TCPA, TSR, DNC, GDPR) and 99.9% uptime, and the real-time analytics dashboard is where recordings and transcripts are pulled per call.

Access control is the part most plans skip. Recordings hold personal data and sometimes an ID number read aloud. Role-based access, every play and download logged, log reviewed on a schedule.

5. What changes when the caller is an AI agent, not a human?

Three things change: the firm's side of the conversation is a script your compliance team approved in advance, a recording exists on every call by default, and the transcript is machine-generated. MiFID II doesn't mention AI callers. The obligations stay the same; the way you meet them shifts from training people to configuring the campaign and reviewing what it produced.

• Scripted words are firm communications: the opening line, the objection answers and any sentence about spreads, margin or a deposit offer are the broker speaking. Sign off the script the way you'd sign off a financial promotion, and version it, because the recording will show exactly which version ran.
• No unrecorded side channel: SYSC 10A.1.7R asks firms to take all reasonable steps to stop staff using privately owned equipment the firm can't record. An AI agent has no personal mobile. Every call runs through the platform, which closes the gap human desks struggle with.
• The transcript isn't the record, the audio is: transcripts are for search and monitoring. In a dispute over what the agent said about a margin call, the audio is the evidence. Keep both, on the same call ID.
• The handoff leg is where the order talk lives: a reactivation agent that transfers a trader to a human dealer has just started the conversation Article 16(7) was written for. Record the human leg under the same policy and link it to the AI leg.

• Monitoring gets cheaper: Article 76(6) wants risk-based, proportionate monitoring. With every call transcribed, reviewing a week of calls for a banned phrase is a search, not a listening session.

Topcalls handles 63,000+ AI calls a day across its customers, so the volume a customer reactivation campaign produces is real. Design the recording and QA plan for that volume from day one.

6. How do you set up an AI calling campaign for MiFID II recording?

Classify the call types, write the notice into the opening line, set retention to the longest rule that applies, test the export end to end, restrict access, and get a named sign-off. A first Topcalls campaign takes about 15 minutes to set up, a live campaign typically runs within two weeks, and recording adds nothing to the $0.35 per minute rate.

1. Classify every call type. Dormant check-in, KYC reminder, failed deposit, demo-to-funded, webinar follow-up. Mark each as in or out of Article 16(7) scope and write down who decided.
2. Write the recording notice into the opening line. One sentence per language, approved once, delivered before any account question. Add the five and seven year availability wording for UK clients.
3. Set retention per data element. Audio and transcript on the MiFID II clock from the creation date. Marketing tags on your shorter marketing rule. Suppression entries outlast both.
4. Test retrieval on one call. Pull audio and transcript by client name, by phone number and by date. Confirm both land on the same CRM record with the same call ID. Then try to edit the original and confirm you can't.
5. Lock down access. Role-based listening and download rights, every access logged, log reviewed monthly by someone outside the campaign team.
6. Get the recording policy signed for AI calls specifically. The policy names the AI agent, states that its scripted words are firm communications, and names the approver. That signature is the launch gate.

If you'd rather walk through the list with someone who has set it up for a brokerage before, book a 30-minute call and bring your call-type list. You'll have a written proposal within 48 hours of the call, including how recordings and transcripts reach your archive.

7. When this doesn't fit

Recording every AI call on a seven-year clock is the safe default for a MiFID II firm, but it isn't the right answer everywhere. Four situations where you should stop and think instead of copying the plan above.

• The calling entity isn't a MiFID II firm: an offshore entity with no EU or UK clients doesn't carry the Article 16(7) clock. Local recording and consent rules still apply, and they differ. Our cross-border AI calling guide for brokers covers how to plan a list that spans several regulators.
• You don't have a durable archive yet: if the original recording can still be edited or deleted from a campaign screen, don't launch order-related AI calls. Run account-status-only calls first and fix the archive.
• Compliance ruled the call out of scope and GDPR wants it gone: a pure marketing call with no order content shouldn't be kept for seven years by reflex. Data minimisation applies; set the shorter rule and document why.
• The notice can't be delivered before recording starts: voicemail-first flows or all-party-consent jurisdictions where the trader hasn't heard the notice yet. Restructure the flow so the notice comes first, or don't record that leg.

MiFID II wrote its recording rule for human dealers on recorded lines. An AI voice agent meets it more easily in some ways, since there's no unrecorded side channel and the script is approved before the first call, and needs more care in others, because one wrong opening line repeats itself thousands of times.

Classify the calls, fix the notice, set the clock, prove the retrieval. Then launch.