FRE2 AC7.2: Records, AML, data protection, complaints, the FOS and the FSCS

Assessment criterion 7.2 asks you to understand and apply the main rules of the regulatory framework: record keeping, reporting and notifications; anti-money laundering and proceeds of crime; data protection; complaint handling; the Financial Ombudsman Service; the Financial Services Compensation Scheme; and treating customers fairly and conduct risk. This is the most number-heavy part of FRE2, so this note gathers the time limits and limits you need. Figures are those in force on 30 October 2026. CeMAP® questions here often hinge on which date a clock starts from.

Record keeping, reporting and notification

Record keeping

A firm must keep orderly records of its business and internal organisation, sufficient for the FCA to check compliance (SYSC 9.1.1R).

Record	Minimum period	Source
Mortgage advice: customer information and why advice is suitable	3 years from the advice	MCOB 4.7A.25R
Complaints	3 years from receipt	DISP 1.9.1R
Customer due diligence and transaction records	5 years from the end of the business relationship; not beyond 10 years	MLR 2017 reg 40
Mortgage arrears handling	3 years	MCOB 13.3.9R

Reporting and notifications

1. Regular returns. Firms submit periodic regulatory returns. Mortgage and insurance intermediaries use the Retail Mediation Activities Return (RMAR).
2. Complaints data. Firms report complaints from eligible complainants to the FCA twice a year (DISP 1.10).
3. Notifications. Under Principle 11, firms must disclose anything the FCA would reasonably expect notice of. SUP 15 lists events such as significant rule breaches, fraud and matters with a serious regulatory impact.
4. Change in control. Anyone proposing to acquire control of an authorised firm needs the regulator's approval first.