A product page shows a savings rate in large type, a landing page invites visitors to open an ISA, and a comparison table sets your fees beside a rival's. If you are an FCA-authorised firm, each of those is probably a financial promotion. The rules say you must keep a record of it, and a website is the hardest kind of promotion to keep a record of: it has no print run, it changes without anyone signing a proof, and the version that mattered last spring is not the one live today.
This article covers the rule, what an adequate record of a web page holds, how long to keep it, and how to build the record so that you can answer a question about any past version.
Your website is a financial promotion
Section 21 of the Financial Services and Markets Act 2000 says a person "must not, in the course of business, communicate an invitation or inducement" to engage in investment activity or claims management activity. That does not apply where an authorised person makes the communication or approves its content, or where an exemption applies. "Communicate" includes "causing a communication to be made".
The FCA's perimeter guidance applies that to websites directly. PERG 8.22.2 says the test for a website is no different from any other medium: if a website, or part of one, operated or maintained in the course of business, invites or induces a person to engage in investment activity, it is a financial promotion. The FCA takes the view that the person who caused the website to be created is the communicator, not the developer who built it or the company that hosts it.
The regulator does check. In 2024 its interventions led authorised firms to amend or withdraw 19,766 promotions, up from 10,008 in 2023. When the FCA asks about one of yours, the first question is what it said, and when.
What COBS 4.11 asks you to keep
The record-keeping rule for firms under the Conduct of Business sourcebook is COBS 4.11.1R. It says: "A firm must make an adequate record of any financial promotion" that it communicates or approves. Promotions made in a personal visit, a phone call or other interactive dialogue are left out, and so are some categories such as image advertising and non-retail communications.
The rule sets how long the record is kept, by what the promotion is about:
| The promotion relates to | Keep the record |
|---|---|
| Pension transfer, pension conversion, pension opt-out or FSAVC | Indefinitely |
| Life policy, occupational pension scheme, SSAS, personal or stakeholder pension | Six years |
| MiFID or equivalent third country business | Five years |
| Anything else | Three years |
Three pieces of guidance alongside the rule shape what goes in the record:
- Why it complies. COBS 4.11.2G says a firm "should consider maintaining a record of why it is satisfied that the financial promotion complies with the financial promotion rules". The page alone is half the record. The sign-off is the other half.
- Live market data. COBS 4.11.3G says that if a promotion includes market information "updated continuously in line with the relevant market", the rules do not require you to record that information. A live price ticker need not be captured tick by tick. The page around it still needs recording.
- Approvals for others. If you approve promotions for unauthorised firms, COBS 4.11.1R(2B) adds a record of how you satisfied yourself that you had the competence and expertise to approve each one, and COBS 4.11.4R adds a certified record for promotions of non-mass market investments likely to reach retail clients.
Note what the rule leaves open. COBS 4.11.1R(3) sets the length of each period but not when it starts. A page can sit on your site for years. The cautious reading, and the one we would plan around, is to count from the day a version stopped being shown, not the day it was first published. Ask your compliance function which reading your firm uses, and write it down.
Why a web page is harder to record than a leaflet
A printed brochure is approved once and printed once. The approved proof is the record. A website breaks that in three ways.
It is communicated for as long as it is up. The approval rules make this explicit for firms that approve promotions for others. COBS 4.10.2R(1A) says that "for as long as the financial promotion is communicated", the approver must take reasonable steps to monitor its continuing compliance. Rule 4.10.2R(1B) requires a written quarterly attestation from the unauthorised firm that there has been "no material change" to the promotion. A web page is not a single event. It is a promotion that keeps running.
It changes without a sign-off. A rate is updated by a feed. A template change moves the risk warning below the fold. A marketing tool rewrites a call to action as an A/B test. Each can change what the promotion says without anyone in compliance seeing it. Under COBS 4.2.1R, a promotion must be "fair, clear and not misleading", and COBS 4.2.5G says words such as "guaranteed", "protected" or "secure" need the qualifying information shown with "sufficient clarity and prominence". Prominence is a matter of layout, so a record of the approved wording alone does not show how the page looked.
Your content system records what you entered, not what visitors saw. A revision history in a CMS is useful, but it is editable, and caching, templates, scripts and third-party widgets all sit between it and the page a visitor was served. For firms other than common platform firms, SYSC 9.1.1R asks for orderly records sufficient to let the FCA monitor your compliance. For a common platform firm's MiFID business, SYSC 9.1.2-AR goes further: the content of a record before any correction must be easy to see, and records must not be open to manipulation or alteration. A copy of what the public page served, fixed when it was made, meets that standard more easily than a database you can edit.
What an adequate record of a web promotion holds
COBS does not define "adequate". For a web page, these are the things we would expect a reviewer to ask for:
- The page as served, in full: headline, body, footnotes, risk warnings and any panel or table, at the address a visitor reached.
- The address, and the final address after redirects. Campaign links often pass through two or three hops before they reach the page.
- The date and time it was recorded, ideally fixed by someone other than you, so the date does not rest on your own clock. Our post on what a SHA-256 hash proves explains how a digest and an independent timestamp fit together.
- The approval: who signed it off, when, against which version, and why they were satisfied it complied (COBS 4.11.2G).
- The dates each version was live. The start date is when it went up; the end date is when the next version replaced it or the page came down. The end date is what starts the retention clock on the cautious reading above.
- Anything a visitor had to read to understand the offer: a linked "key risks" page, a rate table on another address, the terms a "T&Cs apply" link opens.
How to build the record, step by step
- List the pages that promote. Product pages, rate tables, landing pages for paid campaigns, comparison pages, calculators with an invitation to apply, and any blog post that ends with "open an account". If it invites or induces, it belongs on the list.
- Record the retention category beside each page. A pensions page and a general savings page can sit side by side on the same site with periods of indefinitely and three years.
- Capture every page now. You cannot recover a version you did not keep. Today's capture is the baseline.
- Capture on approval day. When a promotion is approved, capture the live page as soon as it is published, and keep the capture with the sign-off. This is the record that shows the approved version is what went live.
- Capture on a schedule between approvals. Scheduled captures catch the changes nobody approved. How often depends on how often the page moves: our post on how often to capture a web page works through the choice. Rate pages may need daily captures. A pensions explainer that rarely changes may need only weekly ones.
- Compare each capture with the last. A change in wording that did not go through sign-off is the thing you want to find before the FCA does.
- Close the record when a page comes down. Capture it on its last day, note the date, and set the retention end date from it.
Keep the captures read-only, outside the CMS, somewhere that will still exist when the person who made them has left.
Common gaps
- Only the approved draft is kept. It shows what compliance signed, not what was published.
- No capture of the risk warning in place. The wording was approved, but nobody can show it was visible where it needed to be.
- Campaign landing pages are deleted with the campaign. The retention period is still running.
- Records end when the page is edited. The previous version is overwritten in the CMS, and nobody captured it.
How Archivepanel helps
Archivepanel records the public page itself. A real Chromium loads it and saves it as one self-contained HTML file with scripts stripped, alongside a preview, a plain-text version, a WARC file and a JSON manifest holding a SHA-256 digest of each file and the requested and final addresses. As each capture completes, the document's digest is timestamped by DigiCert under RFC 3161, so the date rests on a third party, and anyone can check it with OpenSSL. Snapshots are never rewritten.
A record can carry a note and up to twelve tags, which is where an approval reference and the retention category can go. On the paid plan, scheduled captures run hourly, daily, weekly or monthly; a sitemap schedule can cover a whole section of the site; and any two snapshots of a page can be compared as text. Text comparison will not show a risk warning that moved down the page, so check the preview too.
Know what it does not do. It captures public pages only, one at a time, at a desktop viewport of 1440 by 900. It does not capture pages behind a client login, apps, or what a visitor saw on a phone. It does not record your sign-off for you. The DigiCert timestamp is not an eIDAS qualified timestamp. The free tier holds 100 MB.
Sources
- Financial Services and Markets Act 2000, section 21, legislation.gov.uk.
- FCA Handbook, PERG 8.22: The Internet, paragraph 8.22.2.
- FCA Handbook, COBS 4.11: Record keeping: financial promotion, COBS 4.11.1R to 4.11.4R.
- FCA Handbook, COBS 4.10: Approving and confirming compliance of financial promotions, COBS 4.10.2R.
- FCA Handbook, COBS 4.2: Fair, clear and not misleading communications, COBS 4.2.1R and 4.2.5G.
- FCA Handbook, SYSC 9.1: General rules on record-keeping, SYSC 9.1.1R and 9.1.2-AR.
- Financial Conduct Authority, Financial promotions data 2024, 7 February 2025.