Secure Document Disposal for Financial Services Firms in Norwich and Ipswich
East Anglia’s two biggest towns have insurance in their bones. Norwich grew up around what became Aviva and today has one of the UK’s largest general insurance sectors outside London. Ipswich made its own statement in 1975 when Willis Faber & Dumas moved 1,300 staff into a Norman Foster building so far ahead of its time that it is now Grade I listed. Around these anchors sit hundreds of smaller regulated firms: brokers, IFAs, wealth managers, mortgage advisers, accountants and the solicitors who serve them all.
Regulated firms have a paperwork problem that ordinary businesses do not, and it is worth spelling out, because it changes how disposal should be handled.
Caught between two regulators
The FCA requires firms to keep orderly records of their business. Under SYSC 9 of the FCA Handbook, records relating to MiFID business must be retained for at least five years, and the FCA can require longer. Suitability reports, client agreements, KYC files, complaint records: each category has its own clock, and a firm that cannot produce a record when asked has a problem that compounds whatever prompted the request.
Pulling in the other direction is the UK GDPR. The ICO’s storage limitation principle says personal data must not be kept longer than necessary, and client files in financial services are about as personal as data gets: earnings, pensions, health disclosures, family circumstances, bank details, signatures.
So a regulated firm cannot simply keep everything, and it certainly cannot destroy things early. It has to do both jobs properly: hold records securely for exactly as long as required, then destroy them in a way it can evidence. We looked at how the ICO and FCA both approach secure data disposal in an earlier article, and the short version is that the ending of a record’s life gets regulatory attention from both directions.
Where firms slip up
In our experience the weak points in professional firms are rarely the live files. Those sit in locked cabinets and permission controlled systems. The weak points are everywhere else.
Archived client files from ten or fifteen years ago, boxed up when a system was digitised and never looked at since. Paper gathered during office moves, mergers and acquisitions, which happen constantly among advice firms as principals retire and books of business change hands. The day to day printing that professional work still generates, sitting in trays and desk drawers: draft suitability letters, valuations, meeting notes with client names all over them. And the miscellaneous drawer of every compliance function, the old complaint files and closed case papers that nobody wants to be the person who threw away.
None of this paper is covered by the firm’s careful digital security. All of it is covered by the same regulatory obligations. Our guide to the UK GDPR and Data Protection Act sets out what secure disposal means in practice.
Disposal you can evidence
For a regulated firm, the Certificate of Destruction is the point of the exercise. Shredding through a certified provider gives you a documented chain of custody and written proof of when material was destroyed, at what security level, and by whom. When a compliance audit, an ICO enquiry or a professional indemnity insurer asks how client records were disposed of, “securely, and here is the certificate” is the answer you want available. A bin bag has no paper trail, which is a strange way to end the life of a regulated record.
The practical set up is straightforward. Locked consoles in the office, emptied on a schedule under a regular shredding contract, deal with the everyday flow without staff making judgement calls at the wastepaper basket. Archive purges, whether triggered by retention dates, an office move or an acquisition, suit a one-off shredding collection. Firms that want to witness destruction of particularly sensitive files can choose shredding at their own premises, where the material is destroyed in front of you. Everything is cut to DIN Level 3, covered in our guide to shredder security levels, and certificated.
Across both towns
Shredsec provides confidential shredding in Norwich and Ipswich and throughout the surrounding area from our base in Bury St Edmunds. We are used to the standards professional firms work to, and to the difference between clearing paper and evidencing its destruction.
If your firm is holding archives past their retention dates, or its confidential waste arrangements would not stand up to the paperwork test, contact Shredsec and we will put something sensible in place.
Contact Shredsec to discuss your shredding requirements.