Correspondence redaction is the removal of personal data from saved letters, emails and chat records. FCA COBS 11.8 requires a firm to record telephone conversations and electronic communications that relate to a transaction, and for MiFID business those records are kept for five years. If a message is a complaint, the FCA's DISP rules put the firm on a clock — a final response within eight weeks, with the Financial Ombudsman Service as the next step. If the client asks for their own file, UK GDPR Art. 15 gives the right and Art. 12(3) sets the deadline at one month, extendable by two. anonym.plus marks each identifier on your device, so the message stays while the writer goes.
When this applies
A saved thread names the writer, quotes an account number and mentions a balance in passing. A compliance review, a complaint file or a subject access response needs the exchange, not every third party inside it. You trim the identifiers before the thread is released.
How anonym.plus handles it
- Open the thread in anonym.plus on your device.
- Local OCR reads scanned paper letters and printed emails.
- The tool flags names, account numbers, contacts and money figures.
- Keep the body text, timestamps and message order intact.
- Swap or black out the marked items.
- Save the clean copy locally.
What you need to provide
- The letters or emails (PDF, DOCX, TXT, scan).
- An operator (Replace keeps the prose readable).
- Optional batch for a whole thread, up to 20 files per run.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | writer H. Cole → [WRITER] |
| Contact | EMAIL_ADDRESS | h.cole@example.co.uk → [EMAIL] |
| Financial | UK_BANK_NUMBER | acct 5521 → [ACCOUNT] |
| Identifiers | UK_NINO | QQ 33 07 71 C → [NINO] |
| Money | MONEY | transfer £40,000 → [AMOUNT] |
| Phone | PHONE_NUMBER | +44 20 7946 0920 → [PHONE] |
Compliance achieved
- FCA COBS 11.8 requires telephone conversations and electronic communications relating to a transaction to be recorded, with a five-year retention for MiFID business — redaction applies to a shared copy, never to the retained record.
- Where the message is a complaint, FCA DISP requires a final response within eight weeks and an explanation of the Financial Ombudsman Service route; the substance of the exchange must survive redaction.
- A subject access request under UK GDPR Art. 15 must be answered within one month under Art. 12(3), extendable by two further months for complex requests — redaction of third parties is usually how that response is made safe to send.
- FCA SYSC 9.1.1R requires the underlying records to stay orderly; working copies are protected with AES-256-GCM at rest.
Anonymise client correspondence offline — see plans & start free →
Limitations & cautions
Free-text correspondence carries the most indirect clues — a referenced meeting, a family event, an internal nickname. The tool flags named items, not context, and it cannot decide which exemption applies to a subject access response. Read each message before you release the thread.
Frequently asked questions
Does COBS 11.8 cover saved emails as well as calls?
Yes. COBS 11.8 covers telephone conversations and electronic communications that relate to a transaction, and for MiFID business the records are kept for five years. A redacted copy is for review or disclosure; the retained record is untouched.
How does this help with a subject access request?
Art. 15 gives the client a right to their own personal data, but not to other people's. Redacting third-party names and identifiers from a thread is the usual way to release it inside the one-month deadline set by Art. 12(3).
Can I clean a whole thread at once?
Yes. Batch mode handles up to 20 files per local run, with OCR for scanned letters and a shared alias map so one correspondent maps to one label throughout.