Esta página aún no está disponible en español y se muestra en inglés. Páginas disponibles en español
Nobody can know, and nobody should need to. A practice carries other people's clocks, and it carries them for years after the matter closed. Exedra Gate puts every engagement on one rail: each closes the same way, and each answers on its own. Whichever client is asked, the answer is an export rather than a reconstruction.
A practice does not carry one obligation calendar. It carries one per client, each with its own trigger, its own filing channel and its own penalty, and it carries the professional exposure for the ones that are missed. Each entry below is a fixed, published fact with its primary source attached.
Showing rules for European Union
The argument on this page does not change with the selection. The citations do.
Every jurisdiction is shown below, grouped and labelled.
Where a client is a regulated firm, the record standard is explicit. Records must be kept so that the authority can reconstitute each key stage of the processing of each transaction, and so that it is not possible for the records otherwise to be manipulated or altered. That is a specification for an evidence store, written into a conduct regulation.
One anti-money-laundering rulebook, every member state. The harmonised regulation applies directly across the Union from 10 July 2027, supervised by an authority in Frankfurt with a mandate and a calendar. The floor rises for every client at once, which is the version of a rule change a practice feels hardest.
Germany changed what a client has to be advised about. The Standortfördergesetz, in force since 10 February 2026, removed the obligation to route a prospectus-free offer through an intermediary and permitted English-language prospectuses, and from 5 June 2026 the prospectus-free ceiling stands at EUR 12,000,000 over twelve months. More clients now raise without a prospectus, which moves the work from drafting to proving.
Annual clocks run per entity, and a practice usually holds several per client. Annual accounts are filed within twelve months of the balance-sheet date, four for a capital-market-oriented company, and the penalty process opens with a warning threatening EUR 2,500 and a six-week grace period. Dormant project vehicles are the ones that slip.
Nominee arrangements became comprehensively reportable on 1 October 2025. Whether or not they affect ownership or control, and clients that had been exempt lost the exemption. A professional representative may file on the client’s behalf, with a liability safe harbour that does not extend to intent or gross negligence, and a Compliance-Package may only be filed by one.
The confirmation runs for twelve months and does not renew itself. Beneficial owners are re-checked at least annually, the confirmation is filed within four weeks of the review date, supporting foreign extracts must be no older than six weeks when filed, and the penalties reach EUR 200,000 for an intentional breach and EUR 100,000 for a grossly negligent one. The silence when it lapses is the problem, not the filing.
The retention duty has two edges, a floor and a ceiling. A relevant person must keep the customer due diligence documents and the transaction records for five years from the end of the business relationship, and must not keep them beyond ten years.
The test is whether the transaction can be put back together. The transaction records must be sufficient, on their own, to let the transaction be reconstructed later.
The rule defines what a copy has to be good enough for. Where the rules allow a copy instead of the original, the rule defines a copy as one that would be admissible in court proceedings as evidence of the original document.
When the clock runs out, the duty reverses. Once the retention period ends the personal data must be deleted, unless another enactment, a court proceeding, the data subject’s consent or a reasonable belief that legal proceedings need it says otherwise.
The regulator wrote the tamper-evident standard into the Handbook. A common platform firm must hold its records so that the regulator can reconstitute each key stage of the processing of each transaction, so that corrections and the contents before those corrections can be easily ascertained, and so that the records cannot otherwise be manipulated or altered.
Five years is the floor, and other rules run longer. A common platform firm must retain the records it keeps under that chapter, in relation to its MiFID business, for at least five years.
An article number can be live in one jurisdiction and dead in another. Since 23 October 2025 the assimilated Organisational Requirements Regulation is revoked in the United Kingdom, so a firm looking for its record-keeping duty now finds it in the FCA Handbook rather than in retained EU law.
The restriction lands on the communication itself. A person may not, in the course of business, communicate an invitation or inducement to engage in investment activity unless that person is authorised, the content is approved by an authorised person, or an exemption applies.
The exemption stands on a signature and its date. The high net worth individual exemption turns on a statement the individual has completed and signed within the twelve months ending on the day the communication is made, and on the prescribed warning being given with the communication.
The same twelve-month clock runs on the second route. The self-certified sophisticated investor exemption turns on a statement the individual has completed and signed within the twelve months ending on the day the communication is made.
Financial Services and Markets Act 2000 (Financial Promotion) Order 2005 (SI 2005/1529), art. 50A(1)
Admissible, and nothing beyond admissible. In any legal proceedings an electronic signature, and the certification of that signature by a person, are each admissible in evidence on the question of the authenticity or the integrity of the communication or data.
Granting access is on the same footing as shipping goods. Transferring military software or technology by electronic means out of the United Kingdom is prohibited unless it is licensed or an exception applies, which puts the act of granting access on the same footing as shipping the goods.
Export Control Order 2008 (SI 2008/3231), art. 3(b), subject to arts. 13 to 18 and 26
The definition reaches a description given out loud. The Order defines transfer by electronic means to include transmission by facsimile, by telephone or by other electronic media, and expressly includes describing the technology orally over the telephone.
Export Control Order 2008 (SI 2008/3231), art. 2, definition of "transfer by electronic means"
A general licence comes with a register attached. A person acting under a general licence must keep registers or records naming the act, the technology, the date, the recipient and, so far as known, the end user, for at least four years from the end of the calendar year for trade-controlled acts and at least three years otherwise.
The statutory floor is shorter than the claim window. Accounting records must be preserved for three years from the date they are made by a private company, and for six years by a public company.
A deed sets a twelve-year horizon on the evidence. An action founded on simple contract cannot be brought more than six years after the cause of action accrued, and an action on a specialty cannot be brought more than twelve years after.
Accountability is an evidence duty in terms. Personal data may be kept in identifiable form no longer than is necessary for the purposes it is processed for, and the controller must be able to demonstrate compliance with that and the other principles.
The organisation carries the burden, in the past tense. Where an associated person bribes to win business for a commercial organisation, it is a defence for the organisation to prove it had adequate procedures in place designed to prevent that conduct.
One Act runs two retention clocks of different lengths. Every company must keep copies of members’ written resolutions and minutes of general meetings for at least ten years from the date of the resolution, meeting or decision, and failure is an offence by every officer in default.
The Law Commission stated the position, and the formalities survive it. The Law Commission’s statement of the law is that an electronic signature is capable in law of executing a document, a deed included, provided the signatory intends to authenticate it and any formalities for that document are satisfied, and that an electronic signature is admissible in evidence in legal proceedings.
Four conditions, each leaving a dated artefact behind. A firm must not communicate a direct offer financial promotion for a restricted mass market investment to a retail client unless four conditions are satisfied: a cooling off period, a personalised risk warning, categorisation and appropriateness.
FCA Handbook, COBS 4.12A.15R, with COBS 4.12A.18R, 4.12A.20R, 4.12A.21R and 4.12A.28R
Verification is a document review with a date on it. An issuer relying on Rule 506(c) must take reasonable steps to verify that every purchaser is an accredited investor, and each of the safe harbour methods the rule lists is a document review or a written confirmation with a date attached to it.
17 CFR 230.506(c)(2)(ii), Regulation D under the Securities Act of 1933
Reasonable care is not established without a recorded inquiry. An issuer cannot establish that it exercised reasonable care over disqualifying events unless it made a factual inquiry into whether any exist, and the scope of that inquiry varies with the circumstances.
The rule describes evidence rather than process. The issuer must exercise reasonable care that purchasers are not underwriters, and the rule says that care may be demonstrated by a reasonable inquiry into who is buying, a written disclosure before sale that the securities are unregistered, and a legend on the certificate.
The clock runs from the last entry, not from the document. An investment adviser must keep the required books and records in an easily accessible place for not less than five years from the end of the fiscal year in which the last entry was made, the first two of those years in an appropriate office of the adviser.
The rule accepts an audit trail in place of immutability. A broker-dealer keeping records electronically may satisfy the rule either by preserving them in a non-rewriteable, non-erasable format or by maintaining a complete time-stamped audit trail of every modification and deletion, with the date and time and the identity of the person, sufficient to permit re-creation of the original record.
A release inside the country is still an export. Releasing or otherwise transferring controlled technology or source code to a foreign person inside the United States is itself an export, treated as an export to that person’s most recent country of citizenship or permanent residency.
15 CFR 734.13(a)(2) and (b), Export Administration Regulations
Handing over the means of access is the controlled act. Technology and software are released by visual or other inspection that reveals them to a foreign person, or by oral or written exchange, and any act causing a release, including through use of access information, needs the same authorisation the export would need.
The clock starts at the latest event, not the first. All records required to be kept by the Export Administration Regulations must be retained for five years from the latest of the export, any known reexport or transfer, or any other termination of the transaction.
The requirement is that a change cannot happen silently. A registrant keeping records electronically must store them so that none of the information can be altered once it is first recorded without also recording all the changes, who made them, and when they were made.
The operative word is "solely". For a transaction in or affecting interstate or foreign commerce, a signature, contract or record may not be denied legal effect, validity or enforceability solely because it is in electronic form.
15 U.S.C. 7001(a), Electronic Signatures in Global and National Commerce Act
Accuracy, accessibility and reproducibility are the three conditions. Where a law requires a record to be retained, an electronic record meets that requirement if it accurately reflects the information and remains accessible to those entitled to it, for the period the law requires, in a form capable of being accurately reproduced for later reference.
Self-authentication removes a witness, not an objection. A record generated by an electronic process that produces an accurate result, and data copied from an electronic device that is authenticated by a process of digital identification, are each self-authenticating on a certification by a qualified person, so no extrinsic evidence of authenticity is required to admit them.
The offence reaches conduct before the subpoena arrives. Knowingly altering, destroying, concealing, falsifying or making a false entry in a record, with intent to impede or influence a federal investigation or the administration of a federal matter, carries up to twenty years, and the offence reaches conduct in contemplation of such a matter.
The statutory duty sits on the accountant. An accountant auditing an issuer to which section 10A(a) of the Securities Exchange Act applies must keep all audit and review workpapers for five years from the end of the fiscal period in which the audit or review concluded.
The substantiation has to exist before the claim is made. An adviser’s advertisement may not include a material statement of fact that the adviser does not have a reasonable basis for believing it will be able to substantiate upon demand by the Commission.
17 CFR 275.206(4)-1(a)(2), Investment Advisers Act marketing rule
A uniform act binds only where a state has enacted it. Under the Uniform Electronic Transactions Act as enacted in Delaware, a record or signature may not be denied legal effect or enforceability solely because it is in electronic form, and a retention requirement is met by an electronic record that accurately reflects the information and remains accessible for later reference.
Delaware Uniform Electronic Transactions Act, 6 Del. C. §§ 12A-107 and 12A-112(a)
The statute states the duty and defers the period. Financial institutions, designated non-financial businesses and professions and virtual asset service providers must retain all records, documents and data relating to transactions and make them immediately available to the competent authorities on request.
The five years live in the Executive Regulations. Records, documents, instruments and data for domestic and international transactions and commercial dealings must be retained for not less than five years from completion of the transaction or the end of the business relationship.
The clock restarts on the most recent of several triggers. Customer due diligence records, account files, business correspondence and suspicious transaction reports run for not less than five years from the most recent of several triggers, so a later inspection, investigation or final judgment restarts the clock rather than the account closure alone.
Holding the documents is not the same as holding them usably. Retained records must be organised so that individual transactions can be reconstructed, so the duty is not merely to hold the documents but to hold them in a form that can be put back together years later.
An original can be electronic where its integrity is evidenced. Where UAE law requires a document to be submitted or stored in its original form, an electronic document meets that requirement if there is technical evidence confirming the integrity of its information from the moment it was first created in final form, and if it can still present that information whenever it is requested.
Admissible, not presumed. The admissibility of an electronic document, electronic signature or electronic seal as evidence in legal proceedings cannot be denied merely because it is in electronic form.
Equivalence attaches to the qualified tier only. Equivalence to a handwritten signature is attached to the qualified tier only: a Qualified Electronic Signature has the same legal effect as a manual signature where it meets the conditions in the Decree-Law and its Executive Regulations, and a signature below that tier does not carry that equivalence.
The duty is to comply and to be able to show it. A controller or processor must establish a programme to demonstrate compliance with the Law, and must implement appropriate technical and organisational measures to demonstrate that processing is performed in accordance with it, so the obligation is not only to comply but to be able to show it.
Data Protection Law, DIFC Law No. 5 of 2020, Article 14(1) and 14(2)
The record of processing is itself a required document. A controller must maintain a written record of the processing activities under its responsibility, which may be in electronic form, covering at least the purposes, the categories of data subjects and personal data, the categories of recipients including those in Third Countries, and where possible the time limits for erasure.
The duty catches the analysis that led to no report at all. A Relevant Person must maintain sufficient records of transactions to enable individual transactions to be reconstructed, together with the customer due diligence documents, the business correspondence relating to the customer’s account and its own internal findings and analysis on unusual or suspicious business.
Where the record sits is a decision with conditions attached. Where these records are kept outside the DIFC, the firm must take reasonable steps to ensure they are held in a manner consistent with the Rules, ensure they remain easily accessible to it, and ensure that on the DFSA’s request they are immediately available for inspection.
The record has to exist and to be handed over on request. Each controller must maintain a record of the processing activities under its responsibility, the record must be in writing including in electronic form, and it must be made available to the Commissioner of Data Protection on request.
Data Protection Regulations 2021, sections 28(1), 28(3) and 28(4)
The word in the rule is "immediately". A Relevant Person must maintain sufficient records of transactions to enable individual transactions to be reconstructed, and must immediately provide a copy of those records to the Regulator on request.
ADGM Anti-Money Laundering and Sanctions Rulebook, Rules 4.5.1(b)(ii) and 4.5.2
The same conditions, from a second regulator in a second jurisdiction. Where these records are kept outside ADGM, the firm must take reasonable steps to ensure they are held consistently with the Rules, keep them easily accessible to itself, and ensure that on the Regulator’s request they are immediately available for inspection.
ADGM Anti-Money Laundering and Sanctions Rulebook, Rule 4.5.5
Electronic retention satisfies the enactment only on conditions. Where an ADGM enactment requires a record to be retained, an electronic record satisfies that requirement only if it stays accessible for subsequent reference, keeps its original format or one demonstrably replicating the original information, and retains the information identifying the record’s origin, destination, the parties who sent or received it and the date and time.
One sentence, and it attaches no weight. An electronic record may be used as evidence of a record in any ADGM Court proceedings.
This clock runs the other way: it is a duty to stop. An organisation must cease to retain documents containing personal data, or remove the means of associating that data with particular individuals, as soon as it is reasonable to assume that the collection purpose is no longer served and retention is no longer necessary for legal or business purposes.
A refusal creates a preservation duty. Where an organisation refuses an individual’s request for access to their personal data, it must preserve a complete and accurate copy of that data for not less than the prescribed period.
Three conditions, and the list is not exhaustive. A legal requirement to retain a document is satisfied electronically only if the information stays accessible for subsequent reference, the record keeps its original format or a format demonstrably representing it accurately, and the information identifying the record’s origin, destination and the date and time it was sent or received is retained as well.
One objection removed, nothing more. Information is not to be denied legal effect, validity or enforceability solely on the ground that it is in the form of an electronic record.
The written notice limb bites on one branch only. Where a prospectus has been registered and an offer is nonetheless made in reliance on the private placement or accredited investor exemption, the offeror must first have notified the Authority in writing of that intent and taken reasonable steps to inform the offeree in writing that the offer relies on the exemption.
Securities and Futures Act 2001, sections 272B(1)(d)(ii) and 275(1)(c)(ii)
The exemption turns on a running count. The private placement exemption holds only where offers are made to no more than 50 persons within any 12 month period and none of them is accompanied by an advertisement making the offer or calling attention to it, which makes the running count of who was approached, and when, part of what establishes the exemption.
The duty is to be able to hand it over, on a clock. Every record required to be kept under the Regulations must be kept in such a way that it can be provided to an authorised person within 30 days after a request to examine it is made.
Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, SOR/2002-184, section 149
One figure hides three different start dates. Records required under the Regulations must be kept for at least five years, running from account closure for account records, from the last business transaction for records proving an entity’s existence, and from the day of creation for all other records.
Electronic retention is conditional on producing paper. A record required under the Regulations may be kept in machine-readable or electronic form only if a paper copy can readily be produced from it.
Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, SOR/2002-184, section 147
The modal verbs differ inside one clause. Personal information used to make a decision about an individual must be retained long enough to allow that individual access to it after the decision has been made, and information no longer required for the identified purposes should be destroyed, erased or made anonymous.
Personal Information Protection and Electronic Documents Act, Schedule 1, clauses 4.5.2 and 4.5.3
Part 2 reaches requirements under federal law. A requirement under federal law to retain a document for a specified period is satisfied by an electronic document only if it is kept for that period in the format in which it was made, sent or received, or in a format that does not change the information, if it stays readable to those entitled to it, and if the information identifying its origin, destination and the date and time it was sent or received is retained too.
Personal Information Protection and Electronic Documents Act, section 37
Three cumulative conditions, and a defined term. Where federal law requires a document in its original form, an electronic document satisfies that requirement only where the provision is listed in Schedule 2 or 3, the regulations are complied with, and the document carries a secure electronic signature added when it was first generated in its final form which can be used to verify that it has not been changed since.
Personal Information Protection and Electronic Documents Act, section 42
There is no federal securities regulator to answer to. Canada has no federal securities regulator: the Supreme Court of Canada held in 2011 that the proposed federal Securities Act as then drafted was not valid under the general trade and commerce power, so an issuer answers to provincial and territorial regulators rather than to a national one.
Ledger entries are published in English only, and cite each instrument by its own official name.
The enforcement record behind these calendars, statute by statute and figure by figure, is kept on its own page. The risk, sourced.
Each client has its own review date, its own filing window and its own renewal, and they are held in a matter-management system that was designed to record time rather than evidence, in a shared calendar, and in the head of whoever has run that relationship longest. The practice is not short of diligence. It is short of one place where every clock is visible at once.
A client is audited, acquired or sued, and asks the practice for the record of work done four years ago. The matter is archived, the associate who ran it has left, and the file is a folder whose contents are complete and whose order and dates are whatever the file system says they are. Producing it is a project.
Where a practice files on a client's behalf, the safe harbour it relies on stops at intent and gross negligence. What separates a defensible position from an indefensible one, in that moment, is the practice's own record of what it was given, what it checked, what it told the client and when. That record is usually an email thread.
A twelve-month confirmation does not renew itself, and nothing arrives to say the clock has run out. Across a book of clients, the exposure is not one missed date. It is the absence of any view of how many are approaching one.
A client changes counsel and asks for everything. What leaves is a folder assembled by hand, and whatever the practice believes it sent is disputed a year later. A handover is the moment a practice's record-keeping becomes visible to a successor who has every reason to look closely.
Each client's counterparty receives a differently-shaped bundle, learns the practice's format from scratch, and argues about it. The argument is not about the substance. It is about the packaging, and it is paid for by the hour.
Signing sits with one vendor, identity with another, the data room with a third, the working documents on a shared drive, and the thread that connects them in a mailbox. Each tool timestamps in its own way and keeps records for its own retention period. Multiply that by a book of clients and the practice is not running one evidence system with a few gaps; it is running as many partial systems as it has matters, none of which was designed to be read by a stranger.
The consequence shows up at the two moments that matter most. When a client is examined, the record has to be assembled by hand under a deadline, and an assembled reconstruction invites the question of how anyone knows it is what the file said at the time. When a client leaves, the same assembly happens again, in front of a successor.
On Exedra Gate each engagement is its own room: onboarding, identity, documents, contracts, signing, deadlines and the correspondence that carries them, in one flow. Everything that happens becomes proof automatically, sent, opened, read, signed and timestamped by an independent authority, so the record showing that a matter ran in the order the practice says it did is a byproduct of running it.
Read against the six situations above: every client's clocks sit in one view, each duty carrying the artefact that answers it, so a confirmation with a twelve-month life is a dated obligation rather than a silence. What the practice was given, what it checked and what it told the client are entries with dates and signatures, which is the difference between a defensible position and an argument about recollection. A handover is an export rather than an assembly, and what left is provable. And every matter closes with an identical evidence pack, so counterparties learn the format once and stop arguing about it.
Documents, clients, signing and evidence are scoped to one engagement. Nothing is designed to cross between them: isolation is enforced by row-level security in the database rather than in the interface, and the isolation tests include the cases that must be refused, which are executed and recorded rather than asserted.
A grid of entity tiles, drawn as a shape rather than a literal count. Inside every tile the same five-step rail runs, ending in a signed close, and the same evidence pack leaves every tile. Whichever entity is asked, the export has one identical shape.
Every signature is independently timestamped and verifiable offline, by the other side as readily as by the practice. The claim is narrow and checkable: a reviewer confirms with free standard tools that the documents are unchanged and existed at that moment, because the timestamp comes from an authority that is not Exedra Gate. Whether a record satisfies a particular legal standard remains a question for counsel.
Exedra Gate supports the professional obligations counsel carries. It does not assume them, and it gives no advice. The full control set is on the security page.
Client confidences do not belong on whichever continent a vendor found convenient. Where four vendors meant four legal bases, four processor agreements and four registers to search on every subject-access request, one place means one: managed, on a server of the practice's choosing, in Germany, in Switzerland, or inside infrastructure the practice controls. Deployment models, stated.
Seats for the team are priced flatly and usage runs on a prepaid balance, so the practice pays Exedra Gate for its own platform usage and nothing else, never a share of a client's raise. See pricing.
Prepaid balance for the practice's own usage. Not client funds, never custody.
The book, as workspaces. One room per client, one per matter inside it, held side by side and switched deliberately. Existing clients are brought on one at a time, starting with the ones whose clocks are nearest.
The clocks. Each client's recurring duties enter with their deadlines, and each deadline carries the artefact that answers it, in the calendars the practice already uses.
Identity, once per person. The people behind each client are verified and the check is an entry with its own date. Ownership above 25% is declared under signature and corroborated where public registers permit, never described as verified.
Documents and signatures. Documents are generated in the room, signed on the phone and independently timestamped as they are signed, with a certified translation delivered beside the original rather than instead of it.
Correspondence that counts as evidence. What the client was told goes out from the room and comes back with receipts per recipient, with a polite email follow-up when a message goes unanswered.
The export. One evidence pack per matter, in one shape, handed to the client, the counterparty or a successor rather than assembled for them.
The compliance rail is live in production today. The mobile app is arriving and is named as arriving wherever it appears. What runs today, in full.
The rules are published and the calendars are fixed. The questions arrive on their own schedule, usually about work done years earlier, and they are answered from records or from memory. A practice that prepares answers in minutes, for whichever client is asked. Exedra Gate exists for it.
A note on the practice is enough. Where there is a fit, the team is walked through a live scenario and the workspaces are set up.
Email reaches the same place: office@exedragate.com.
Exedra Gate is a technology platform, not a broker, dealer, custodian, escrow provider, or investment adviser. It never holds, routes, or settles investor funds, does not recommend offerings to investors, and charges no success-based fees on raises. Records and timestamps attest integrity and existence as of a date, not compliance with any particular regime; that judgment remains with the practice and its clients.
Regulatory references on this page are orientation, not legal advice: see Sources & verification.