KeyarqThree regulators. Three retention clocks. One archive.
SEBI, RBI and IRDAI each set their own minimum record-retention periods, and each is moving to require more, not less. If your systems treat "keep it somewhere" as compliance, the gap shows up the day an examiner asks for a specific communication from a specific date.
Different clocks. Same requirement: prove it, on request, years later.
What's already in force
The floor every regulated entity is already required to meet.
SEBI: 5 years, minimum
Regulation 18 of the SEBI (Stock-Brokers and Sub-Brokers) Regulations, 1992 requires every stock broker to preserve its books of account and other records for a minimum of five years.
RBI: 10 years, under PMLA
Banks must maintain records of transactions for at least ten years, per RBI's notification under Section 12 of the Prevention of Money Laundering Act — long enough to serve as evidence if a transaction is later investigated.
IRDAI: every policy, every claim
The IRDAI (Maintenance of Insurance Records) Regulations, 2015 require insurers to keep records of every policy issued and every claim made, in electronic form, backed by security features and a documented data governance framework.
Sources: SEBI (Stock-Brokers and Sub-Brokers) Regulations, 1992, Regulation 18 · RBI notification on PMLA record-keeping ·IRDAI (Maintenance of Insurance Records) Regulations, 2015.
What's proposed, and pointed one direction: more
Not yet final rules. Worth building for now, not scrambling for later.
SEBI: 8 years for mandatory communications
A 2024 SEBI consultation paper proposes a new Regulation 17A requiring stock brokers to keep records of every mandatory communication — and its acknowledgment, where applicable — for a minimum of eight years, and to produce them to SEBI on request. SEBI's own working group has since reaffirmed the general books-of-account period at five years, so the two rules would run side by side rather than replace each other.
IRDAI: records held in India only
A 2024 IRDAI exposure draft proposes that electronic insurance records be held in data centres located and maintained within India — a data-localisation requirement layered on top of the existing electronic-recordkeeping mandate.
Sources: SEBI consultation paper on maintenance of records of mandatory communication (Aug 2024) ·IRDAI exposure draft, 2024.
What this means for how you archive
Retention periods that don't drift
Five years, eight years, ten years, permanent — each set by rule, not by whoever configured the storage bucket. An archive should enforce the period per record type, not rely on someone remembering it.
Acknowledgment tied to the message
SEBI's proposed rule wants the communication and its acknowledgment together. If those live in two different systems today, retrieval on request means reconciling them by hand.
Ready before the deadline is final
Consultation papers and exposure drafts become binding rules on their own timeline, usually with little notice once finalised. The organisations unaffected by that timeline are the ones already keeping the records the draft describes.
Building CUSTOS with design partners now. Selling from Q1 2027.
If SEBI, RBI or IRDAI retention rules are a live problem for your organisation, and you want a say in what ships, talk to us.