Practical Durable-Medium Checklist for Financial Firms

Start with one communication, not the whole system

A durable-medium review is easier if you test a specific communication flow rather than asking whether an entire platform is “compliant”.

For example:

• an annual statement
• a contract or agreement
• a regulatory disclosure
• a policy document
• a periodic report
• a formal notice
• a set of terms and conditions

For that communication, identify:

1. the FCA rule or other legal requirement that applies
2. what information must be provided
3. when it must be provided
4. whether it must be provided in a durable medium
5. whether the rule also permits another route, such as a qualifying website
6. whether any paper-choice, consent or notification requirements apply

The FCA Handbook definition of durable medium contains different conditions for different areas of business, so the applicable rule should be checked before reviewing the technology.

The core durable-medium checklist

The FCA’s guidance on durable medium identifies three central characteristics: personal addressing, storability and unchanged reproduction.

Use the following questions to test how your process works in practice.

1. Is the information addressed personally to the customer?

Check:

• Is the information intended for an identified individual customer?
• Is the customer receiving their own information rather than being directed only to general public content?
• If a portal is used, is the information available inside the customer’s authenticated area?
• If email is used, is it sent to the intended recipient through an appropriate process?

Review if:

The process merely publishes information on a general webpage and relies on the customer finding it.

Personal addressing is one of the basic durable-medium characteristics.

2. Can the customer store or retain the information?

Check:

• Can the customer keep the information supplied to them?
• Can they download it, retain it within an account, or otherwise return to it later?
• Does the process preserve a customer-specific record rather than only displaying current information?

Review if:

The customer can view information temporarily but has no reliable way to retain or revisit what was provided.

The FCA describes this requirement as storability.

3. Will the information remain accessible for long enough?

Check:

• How long will the customer be able to access the information?
• Is that period appropriate for the purpose of the document?
• Is the retention period defined rather than dependent on an incidental system setting?
• Does the access period reflect how long the customer may reasonably need the information?

Review if:

Documents disappear after an arbitrary period that has not been considered in relation to the purpose of the information.

The FCA definition requires future access for a period adequate for the purposes of the information. It does not prescribe one universal retention period for every document.

4. Can the exact information originally supplied be reproduced later?

Check:

• Can the customer return to the version that was originally provided?
• If the underlying information changes, is the previous version preserved?
• Can the historic document be reproduced in the same form later?
• Are settled documents protected from being silently overwritten?

Review if:

The system only shows the latest information and replaces earlier versions.

This is especially important for portals and other live systems. The FCA uses historic online statements as an example: previous information must remain capable of unchanged reproduction rather than being replaced by the current position.

Test what happens after delivery

Passing the three core questions is the starting point. The next group of questions tests whether those characteristics survive real operational events.

5. Can the provider alter the settled information after it has been supplied?

Check:

• Once a document is delivered, can its content subsequently be changed?
• If corrections are required, does the process create a new version rather than silently changing the old one?
• Can the customer still retrieve the version originally provided?

Review if:

A staff member or automated process can alter previously supplied information without preserving the original.

The FCA explains that unchanged reproduction is intended to prevent providers from unilaterally modifying information after it has been given to the customer.

6. What happens when the customer relationship ends?

Check:

• Does the customer still need the document after account closure?
• If portal access ends, where will the previously supplied documents be available?
• Is long-term document access dependent on maintaining an active service account?
• Is there a defined process for former customers?

Review if:

Closing the customer’s operational account automatically removes access to documents they may still need.

This is one of the most important practical tests for a portal-based model. See how customers can keep documents after an account closes.

7. What happens when the portal or system is replaced?

Check:

• Will historic documents migrate to the replacement system?
• Will their original content and dates remain intact?
• Will former customers still be able to obtain required documents?
• Is preserving historical access part of the migration plan?

Review if:

The firm’s ability to reproduce old documents depends on keeping a legacy platform running indefinitely.

A portal can be a durable medium, but relying on it for permanent document access creates a continuing obligation whenever that portal changes. See Can a Customer Portal Be a Durable Medium?.

8. What happens if the customer loses access credentials?

Check:

• Is there a reliable recovery process?
• Does password or account recovery remain available for as long as the information needs to remain accessible?
• Does recovery work for former as well as active customers where continued access is required?

Review if:

The documents technically still exist but the customer has no practical route back to them.

Future accessibility needs to work operationally, not only in the database.

Check the delivery method itself

9. Are you relying on email, a portal or both?

Different channels can satisfy the durable-medium definition, but they create different practical issues.

Method	Durable-medium question to test
Email	Can the customer retain and reproduce the information, and is the email itself the intended long-term record?
PDF attachment	Is the document personally delivered, retained and reproducible unchanged?
Customer portal	Are historic versions preserved and available for the necessary period?
Website link	Does the applicable rule permit website delivery, and does the website satisfy the relevant conditions?
Dedicated document delivery	Does the service preserve customer-specific, unchanged, long-term access as intended?

The FCA expressly says that email can be a durable medium and that an interactive secure website can also qualify if the conditions are met.

So the review should focus on implementation rather than assuming one technology is automatically compliant or non-compliant.

10. If you send a link, what is at the other end?

Check:

• Does the link take the customer to a settled customer-specific record?
• Can the information behind the link later change?
• Is the page itself being relied upon as the durable medium?
• Does the applicable FCA rule instead permit delivery through a website subject to separate conditions?

Review if:

The process treats “we emailed the customer a link” as automatically equivalent to supplying the information in a durable medium.

The regulatory treatment depends on the underlying information and the applicable rule.

Check customer choice and paper rights

11. Does the applicable rule require paper to remain available?

The answer depends on the business and the particular FCA rules involved.

For certain MiFID-related communications, the FCA changed the durable-medium definition so electronic communication is now the default, while retail clients must be informed of their right to paper and paper must be supplied free of charge if requested.

Other parts of the definition retain different conditions.

See FCA Electronic Communications and the 2026 Durable-Medium Changes for the distinction.

Check:

• Does this communication fall within an electronic-by-default provision?
• Must the customer be told that paper is available?
• Must paper be provided free of charge on request?
• Is customer consent or choice required for the particular rule?

Review if:

The firm has adopted one electronic-delivery rule across every product and business line without checking the relevant Handbook provisions.

Check the evidence and controls around the process

These are not separate elements of the FCA’s three-part durable-medium definition, but they are useful controls when a firm needs to demonstrate how its process works.

12. Can you evidence what was provided and when?

Useful evidence may include:

• the identity of the recipient
• the document or information supplied
• the version supplied
• the delivery time
• the method used
• the retention policy applying to the document

This can make internal compliance testing, complaints handling and later reconstruction much easier.

13. Are retention and deletion controls deliberate?

Check:

• Is there a defined retention policy?
• Can customer-facing documents be deleted unintentionally?
• Who has permission to remove or alter them?
• Are operational deletion policies consistent with the period for which customer access is required?

A system that is technically capable of long-term access is not much use if ordinary housekeeping processes remove the information earlier.

14. Have you tested the process from the customer’s side?

A useful final test is to behave like the customer rather than the system administrator.

Try to retrieve a document:

• a week after delivery
• several months later
• after the document has been superseded
• after a password reset
• after the customer account has closed
• after a system or portal migration

The question is not simply whether the firm still has a copy.

The question is whether the customer can access the information in the way the chosen durable-medium model is supposed to provide.

A simple review summary

For each communication, record the answer to these questions:

Area	Question	Result
Regulatory scope	Which rule applies and what medium does it require?	Pass / Review
Personal addressing	Is the information supplied to the individual customer?	Pass / Review
Storability	Can the customer retain or revisit it?	Pass / Review
Access period	Is it available for an adequate period?	Pass / Review
Unchanged reproduction	Can the original version be reproduced later?	Pass / Review
Settled copy	Can the provider change or overwrite what was supplied?	Pass / Review
Account closure	Does necessary access survive the end of the relationship?	Pass / Review
System migration	Will historic access survive a portal replacement?	Pass / Review
Access recovery	Can customers regain access when needed?	Pass / Review
Delivery method	Are email, portal, PDF or links being used appropriately?	Pass / Review
Paper rights	Have any applicable choice or paper requirements been handled?	Pass / Review
Evidence	Can the firm show what was supplied and when?	Pass / Review

A Review result does not automatically mean the process is non-compliant.

It means there is a question worth resolving against the applicable rule and the way the system actually works.

Where Documentd fits

Documentd is designed to remove some of the long-term document responsibilities from systems whose main job is something else.

A firm can keep:

• email for communication
• its portal for live information and customer interaction
• its existing systems for creating and managing documents

Documentd adds a separate delivery layer for important point-in-time documents the customer should receive and be able to keep.

The customer’s copy is delivered into their own Keepd document space, separating long-term document access from the continued operation of the sender’s live portal.

See the Documentd durable-medium approach.

The key question

The most useful durable-medium test is not:

What technology are we using?

It is:

Can this customer reliably return to the information we gave them, for as long as they need it, and reproduce that information unchanged?

If the answer remains yes after account closure, password recovery, document updates and system migration, the delivery process is addressing the practical characteristics the FCA describes.

---

This checklist is a practical implementation aid, not legal advice. Whether a particular communication satisfies a regulatory requirement depends on the applicable rules, the information being provided and the way the delivery process is configured.