Records Management and Retention

1. What a record is

A record is any information, in any form, that evidences a decision, a transaction, an obligation or a communication made in the course of the group business. A signed mandate is a record. So is the order ticket, the committee minute, the valuation workbook, the model validation report, the recorded telephone line and the message in which a client gave an instruction. A draft that was never issued is not a record and is deleted when the final version is filed.

Records exist so that the group can show what it did and why, to a client, to a regulator, to a court or to its own Board. The value of a record lies in its provenance: who created it, when, from what source and whether it has been changed since. Every record in the archive carries that metadata, which is the third principle of the Ethical Technology Charter applied to the group's own memory. A document whose provenance cannot be established is not treated as a record of authority.

The policy applies to every entity, every office and every person in the group, and to third parties who hold records on the group's behalf. It covers records in paper, in native electronic form, in rendered form and in the audio of recorded lines. Where the same record exists in more than one form, the archive copy is the record of authority and every other copy is a convenience copy that may be deleted.

2. The archive and the record of authority

The group archive is a single indexed repository administered from George Town, with a replica in Luxembourg and a copy of each region's records at the regional hub for continuity. The archive index listed 2.6 million records at 30 June 2026. Every record is filed within five business days of being finalised and is thereafter immutable: a correction is filed as a new record that references the original, and the original is never altered.

Records are filed in native form together with a rendered form that will remain readable if the native software is withdrawn. Recorded telephone lines are archived as audio with a transcript. Messaging on approved channels is captured at source; messaging on any other channel is prohibited for business purposes under the Code of Conduct and cannot be filed as a record. Personal drives, local folders and email inboxes are not record stores, and their contents carry no evidential status.

The archive is administered by the Group Records Officer, who reports to the Chief Operating Officer. Each division names a records coordinator who confirms each quarter that the division's records for the period have been filed. Internal Audit samples the archive against the order management, client onboarding and committee systems on a two-year cycle to confirm that what those systems produced was filed.

3. Record classes and retention periods

Every record belongs to one of six classes, and the class fixes the minimum period for which it is kept. Governance records, meaning Board and committee minutes, constitutional documents, licences and registrations, are kept permanently. Client and transaction records, meaning due diligence files, mandates, orders, confirmations, statements, complaints and client correspondence, are kept for seven years after the relationship ends. This is the group minimum; the George Town entities keep them for ten years and several local schedules set their own longer periods.

Financial and accounting records, including ledgers, tax filings, treasury records and audit working papers, are kept for ten years after the financial year to which they relate. Investment records, meaning Investment Committee minutes, valuation records, model documentation and the model inventory maintained under the Model Risk Management policy, are kept for ten years after the position closes or the model is retired, in the George Town archive. People records are kept for seven years after employment ends. Operational records, including system logs, access logs and monitoring output, are kept for 24 months unless they are attached to an incident, in which case they follow the incident record.

Where a local law or a local regulator sets a period longer than the group minimum, the local period applies to the records of that entity and is recorded in the local retention schedule appended to this policy. Where a local law sets a shorter period, the group minimum still applies unless the local law requires destruction, in which case the Group Records Officer and the General Counsel record the conflict and its resolution.

• Governance records: permanent.
• Client and transaction records: seven years after the relationship ends (ten in George Town).
• Financial and accounting records: ten years after the financial year.
• Investment records, model documentation and the model inventory: ten years after closure or retirement.
• People records: seven years after employment ends.
• Operational records and logs: 24 months, or the life of any incident they evidence.

4. Legal holds

When the General Counsel becomes aware of litigation, a regulatory inquiry, an internal investigation or a complaint that may lead to any of these, the General Counsel issues a legal hold that suspends destruction of every record that could bear on the matter. The hold names the custodians, the systems and the date range. Custodians acknowledge the hold in writing within two business days and the archive flags the records so that the destruction process cannot select them.

A hold remains in force until the General Counsel lifts it in writing. It is reviewed every six months while it stands. Records under hold are not moved, reformatted or migrated without the General Counsel's approval, and any access to them is logged. Four holds were in force at 30 June 2026, the oldest dating from 2024.

5. Destruction

Records are destroyed when their retention period expires, and not before. Destruction is run once a year, in the first quarter, from a list generated by the archive of every record whose period has expired and which is not under hold. The list is reviewed by the Group Records Officer, by each divisional records coordinator for their division's records and by the Group Data Protection Officer for records containing personal data. Only after all three have signed does the run proceed.

Destruction is complete and irreversible: electronic records are deleted from the archive, the replica, the regional copies and every backup within 90 days of the run, and paper records are shredded under supervision. The archive retains a destruction certificate for each record, stating the class, the retention period applied and the date of destruction. The certificate is itself a governance record and is kept permanently.

The Chief Operating Officer certifies the annual run to the Audit Committee, with the number of records destroyed by class and the number withheld under hold. The 2026 run, completed in March, destroyed 214,000 records and withheld 9,300 under the four holds then in force. Destruction outside the annual run is not permitted, except deletion of drafts and convenience copies, which are not records.

6. Access, production and client copies

Access to archived records follows the classification in the Information Security policy. A client may ask for a copy of any record of its own relationship, and the group produces it within 30 days, in the form in which it was filed, together with the metadata that shows when and by whom it was created. This is the sixth Charter principle, transparency to clients, applied to the archive. The group does not charge for the first copy in any year.

A request from a regulator, a court or a public authority is handled by the General Counsel, who confirms the legal basis of the request before any record is produced and records what was produced, to whom and under what authority. Production of a client record to a public authority is disclosed to the client unless the law of the jurisdiction prohibits it.