Most financial service firms can tell you they record calls. Far fewer can produce a specific conversation with a specific client from three years ago within an afternoon. Those are different capabilities, and only one of them is what the obligation actually asks for. The record button is where compliance starts, not where it finishes.
Where most firms stop
A licence audit or compliance review raises call recording; somebody procures a recorder, it gets bolted onto the phone system, and the item is marked closed.
What has usually been bought at that point is capture. The calls are being recorded. They are landing somewhere, probably as timestamped files, probably on a server nobody has looked at since commissioning. The retention period is whatever the storage allows, which means it was set by disk capacity rather than by an obligation. And retrieval has never been tested, because nothing has ever needed retrieving.
Then, something does. A client disputes advice from 2022. An adviser leaves and takes a book of clients with them. A complaint reaches AFCA, and the firm has 30 days to substantiate what was said. At that moment, the question is not whether you recorded the call. It is whether you can find it.
What does a financial services firm need from call recording?
Four things, not one:
- Capture the call.
- Retain it for the required period.
- Retrieve a specific call on demand.
- Produce it in a usable form.
ASIC requires records of personal advice to retail clients to be kept for at least seven years and to be accessible throughout that period, so storage alone does not satisfy the obligation.
That accessibility requirement is the part worth reading twice. It sits in notional section 912G, inserted by ASIC Corporations Instrument 2024/508, and it means a record that technically exists but cannot practically be found is not doing the job the rules describe.
It’s worth being precise about scope, too. ASIC requires records, and recording calls is a practical way of keeping them rather than a blanket mandate on its own. Advice licensees, credit licensees, market participants and AML reporting entities all carry different obligations, and market participants have their own specific telephone recording rules. Confirm which regime applies to your licence with your compliance adviser rather than assuming the general position covers you.
Four stages, and most firms solve one
| Stage | What the obligation implies | What most firms actually have | Where it breaks |
| Capture | Every relevant client conversation recorded, on any device | Desk extensions recorded, mobiles not | The adviser who takes the call in the car |
| Retain | The full required period, deliberately set | A rolling deletion cycle set by disk space | Year four, quietly |
| Retrieve | Find one call by client, adviser and date, quickly | A folder of timestamped files | The AFCA complaint |
| Produce | Supply the recording with enough context to be evidence | A file and somebody’s recollection | The audit |
The retain row catches firms out most often because nobody decided it. A phone system ships with a storage-management default, an engineer sets it so the disk doesn’t fill, and four years later, the recording that would have settled a dispute was deleted by a setting no compliance officer ever saw. Retention should be a documented decision with a name against it.
The produce row is the subtle one. A recording without metadata is an audio file, not evidence. What makes it usable is the surrounding record: which extension, which client number, what time, how long, and what happened next. That is why call recording is far more useful when it lives inside the phone system rather than beside it, with recordings tied to the same call logs and history that hold the metadata.
The retrieval test
Pick a client name and a date from three years ago and ask how long it takes to produce that call. If the answer involves searching a folder of timestamped files, or asking the adviser which day it was, you have a recording system rather than a compliance system. The obligation is accessibility, not storage.
Run it as a genuine drill rather than a thought experiment, because the gap between what people believe the system can do and what it does is almost always larger than expected. Give someone a client name, a rough month and no help, and time it.
Two failure modes show up. The first is that recordings are searchable by extension and date but not by client number, so finding the call requires knowing which adviser handled it and roughly when, which is exactly the information a three-year-old dispute may not come with. The second is that the recordings sit on a system the current IT provider inherited, and nobody has admin access to. Both are fixable, and neither gets discovered on the day you need it unless you look first.
What happens to client calls taken on an adviser’s mobile?
They are usually not recorded and not logged, which means the conversation exists nowhere in the firm’s records. That gap does not close when the adviser leaves. Bringing client calls onto firm extensions, including on mobile apps, is the only way to keep the record where the licensee can reach it.
Advisers take client calls on personal mobiles for the same reason they do in any professional practice: it is convenient, and clients ask for the number. In most sectors, that creates a service continuity problem. In financial services, it creates a records problem because the conversation that informed the advice is not in the licensee’s possession at all.
The departure case is the sharp one. Record-keeping obligations attached to personal advice continue to bite after an authorised representative stops being authorised, which means a firm can find itself needing a record of a conversation that only ever existed on a former adviser’s handset. Extending the firm’s extensions onto 3CX mobile and web apps closes that gap without asking anyone to carry two phones, which is the only version staff will actually adopt.
One system or two
Financial firms often end up with a phone system and a separate recording platform, because the recorder was bought later to satisfy a compliance finding. It works, but it costs more than it looks.
Two vendors mean two support paths, two upgrade cycles, and two points of failure. And when recording stops silently after a phone system update, nobody finds out until someone goes looking for a call. It also splits the recording from its metadata, which is the reason retrieval is slow.
Consolidating onto one platform is mostly a retrieval improvement rather than a cost one, though it usually is more affordable. Recordings, call logs and extension records sit together. One retention policy applies across every office, and a 3CX phone system with recording configured per queue or per extension lets you record the advice line without recording reception. Where the data sits matters, too: confirm your recordings are held in Australia, which for Com2 deployments means 3CX SIP trunks and hosting in Brisbane data centres rather than offshore.
Where to start, in order of exposure
Not everything here is urgent. Sequence it by what would hurt most if tested tomorrow.
- This week: Check your retention setting. It takes ten minutes, and it is the only item on this list where the damage is already accruing. If recordings are being deleted on a rolling cycle nobody approved, every day that continues destroys records you may be obliged to hold. Find the setting, find out who set it, and document the decision.
- This quarter: Run the retrieval test and audit the mobile gap. Both produce findings rather than costs. Time a real retrieval, then work out what proportion of client conversations happen on numbers the firm doesn’t control. Neither requires buying anything.
- At renewal: Consolidate. If you are running a phone system and a bolt-on recorder, that is the point to fix it, not before. Contract timing gives you a stronger negotiating position, and there is no compliance benefit to rushing it.
Com2 is a certified 3CX partner working with businesses across Australia. Our experienced team can tell you what your current setup captures, how long it holds it, and how quickly it produces records. What your licence obligations require is a question for your compliance adviser, not for us. Call 1300 887 495 or get in touch for more information.