A lot of businesses in financial services, legal, and healthcare are confident they have call recording covered. They record, the calls are stored somewhere, the box is ticked.
But the confidence that comes with that tick in the box is worth examining. Because European regulators are examining it too, and what they're finding suggests the gap between "we record our calls" and "we are compliant" is wider than most people assume.
In 2024, European regulators imposed MiFID II penalties totalling more than EUR 44.5 million. That’s a 143% increase on the year before, according to ESMA's Annual Sanctions Report. That's not a one-off spike. It reflects a pattern of regulators moving from framework-setting to active enforcement, with fines that reflect the seriousness of the obligation.
The FCA added to that picture in August 2025. Its review of off-channel communications examined 11 wholesale banks and found 178 confirmed policy breaches over a single 12-month period. Forty-one percent of those breaches involved director-level staff or above.
Two things stand out in those figures. First, the scale: 178 breaches across 11 institutions is not a rounding error, it's a systemic pattern. Second, the seniority: this is not a junior compliance officer failing to follow a procedure. It's a problem sitting at the top of organisations, where the stakes for a firm's regulatory standing are highest.
For financial services businesses, the question is no longer whether regulators are looking. Because the stats tell us they are. The question is what they find when they do.
Call recording compliance under MiFID II isn't simply a matter of having a recording. The regulation sets out specific requirements for what that recording must do and how it must be kept.
Recordings must be tamper-proof. Every access, playback, and copy must be logged and traceable. Retention periods run to five years as a minimum, extendable to seven at the request of a competent authority. This means that firms in some jurisdictions need to be thinking about long-horizon storage from day one, not retrofitting it when asked. Payment card data must be kept out of recordings, either by agent intervention or automatic protection. And when a regulator asks for a specific recording, the firm needs to be able to produce it, accurately, quickly, and with a complete audit trail showing nothing has been altered.
That's a meaningful operational requirement. It goes well beyond capturing audio and parking it on a server.
The gap most businesses have isn't that they're not recording. It's that their recording setup doesn't do all of this reliably, and they may not know it until someone asks.
A regulatory enquiry, an internal dispute, a customer complaint; these are the moments when the quality of a compliance recording setup becomes visible. And they tend to arrive without warning.
Can the relevant call be retrieved quickly? Is there an audit trail showing it hasn't been accessed or altered? Was payment data automatically excluded? Is the retention period right for the regulation that applies? These questions have clear answers if the recording infrastructure is built to answer them, and no answer at all if it isn't.
The call recording software market is growing at roughly 8% a year — the compliance driver is well understood, and businesses are investing. But investment in recording doesn't automatically mean investment in the right recording. A setup that captures calls without meeting the full MiFID II requirements isn't a partial solution. For the purposes of enforcement, it's a non-compliant one.
For service providers, the regulated accounts in their base like financial services firms, legal practices, healthcare providers are facing a compliance environment that is tightening. Regulators are more active, fines are larger, the scrutiny is reaching senior leadership.
Most of those customers are already using cloud voice. Many already have some form of call recording in the mix. The conversation isn't about introducing them to recording but whether the recording they have actually meets the standard being enforced.
That's a different kind of sales conversation, and it's a more useful one. It doesn't start with a feature list. It starts with a question: if a regulator asked you to produce a recording from eight months ago, with a full audit trail, and confirm no card data was captured during the call, could you do that today?
For the service providers who can help their customers answer yes, reliably, within the relationship they already have, the compliance conversation is a commercial one.
Talk to your Dstny partner manager about the regulated accounts in your base and what the compliance conversation looks like for them.
Dstny Call Recording Intelligence is designed for compliance-grade recording on Dstny Voice, tamper-proof, auditable, with retention from 30 days to 10 years and automatic card data protection. Available across four tiers, activating on Dstny Voice.