Compliance Records a UK Asset Management Software Business Should Keep

If you run an asset management software business in the UK, poor record-keeping can create legal risk long before a regulator contacts you. Founders often make the same mistakes early on: they keep product and compliance documents scattered across inboxes, assume a privacy policy is enough on its own, or sign customer terms and supplier contracts without keeping a clear version history. Another common problem is treating compliance as something to fix later, after launch, after the first enterprise deal, or after an information security questionnaire lands from a client.

The issue is not just paperwork. Good records help you show what you promised customers, what controls you actually put in place, how you handle personal data, and who approved key decisions. That matters when you are selling into regulated clients, tendering for larger contracts, answering due diligence questions, or dealing with a complaint. This guide explains which compliance records an asset management software business should keep in the UK, when those records matter most, and the practical mistakes that tend to trip founders up.

Overview

A UK asset management software business should keep records that prove how it is set up, how it contracts, how it handles data, how it manages security, and how it responds when things go wrong. The right record set makes procurement easier, supports customer trust, and gives you evidence if your business is ever challenged about its conduct or controls.

• Company formation and governance records, including ownership, director decisions and key policies
• Customer, supplier and partner contracts, with signed copies and version control
• Privacy and data protection records, including data mapping, lawful basis notes and processor arrangements
• Information security records, such as access controls, incident logs and internal procedures
• Product, marketing and website records, including terms of use, claims approvals and complaint handling
• Employment and contractor records covering confidentiality, IP ownership and acceptable use
• Industry specific evidence requested by regulated clients, such as due diligence responses and security questionnaires

What Compliance Records a Asset Management Software Business Should Keep Means For UK Businesses

For a UK software company serving asset managers, wealth businesses, advisers or investment operations teams, compliance records are the documents that show how your business meets its legal obligations and honours its contractual promises. They are not limited to formal regulatory filings. They also include the day to day evidence that supports your privacy position, security practices, product controls and commercial arrangements.

This matters because many asset management software businesses are not directly regulated by the Financial Conduct Authority simply for providing software, but they often sell into heavily regulated clients. Those clients will still expect clear records on data handling, confidentiality, resilience, subcontracting and incident management. If you cannot produce them quickly, the commercial impact can be immediate, even if no law has technically been broken.

Corporate and governance records

Your first record set should show that the business itself is properly organised. Buyers, investors and larger suppliers often ask for these documents before they sign.

• Certificate of incorporation and Companies House details
• Register of directors and, where applicable, people with significant control
• Shareholder agreements or founder agreements
• Board minutes or written resolutions for major decisions
• Internal policies adopted by the business, such as information security, privacy, acceptable use and complaints procedures
• Trade mark applications or registrations for your brand, where relevant

Founders often overlook board minutes and approval records. If you later need to show who approved a major outsourcing arrangement, a new product release, or a move to a different hosting provider, informal Slack messages are a weak substitute.

Customer and commercial contract records

Your contracts are one of the main compliance record categories because they define what you promised and what risk you accepted. Before you sign a contract, and after you sign it, you should be able to locate the current version and any changes without guesswork.

• Master services agreements, software subscription agreements and order forms
• Data processing agreements and international transfer terms where needed
• Service level schedules, support terms and security schedules
• Non-disclosure agreements
• Reseller, implementation partner or referral agreements
• Supplier and subcontractor contracts, especially cloud hosting, analytics, development and support providers
• Contract approval records, redlines and version histories

This is where founders often get caught. A sales team sends a customer a side letter, procurement negotiates a security annex, and product teams never see the obligations that now apply. Keep the final signed set together, along with any attachments and later variations.

Data protection and privacy records

If your software handles personal data, your business should keep records that support compliance with UK GDPR and the Data Protection Act 2018. A privacy notice alone is not enough. You need evidence of what data you use, why you use it, who you share it with and how you protect it.

• Privacy notices for your website, platform and recruitment activities, where relevant
• Records of processing activities
• Data flow maps showing where personal data comes from and where it goes
• Lawful basis assessments for key processing activities
• Processor agreements with vendors and subprocessors
• Data retention and deletion schedules
• Data subject request logs and response records
• Data breach and incident logs, including investigation notes and notifications made
• Data protection impact assessments where higher risk processing is involved
• Cookie records and consent settings if your site or platform uses non-essential cookies

Asset management software businesses often process names, contact details, investor information, employee details or usage data, even if they do not handle client money. If your platform ingests regulated customer data sets, buyer scrutiny on privacy records will be higher.

Security and operational records

Security records show what controls actually exist, not just what your marketing says. They become especially important when you complete supplier onboarding for financial services clients.

• Access control policies and user access review logs
• Password, authentication and device security rules
• Incident response plans and test records
• Business continuity and disaster recovery plans
• Vulnerability management and patching logs
• Supplier security assessment records
• Employee and contractor security training records
• Change management approvals for key systems

You do not need to create unnecessary paperwork for every minor operational decision. But you should keep enough evidence to show that important controls are defined, assigned and reviewed.

Employment, contractor and IP records

A software business also needs records proving it owns its code, controls confidential information and sets clear standards for staff and contractors. Without these, a later dispute about ownership or misuse can become expensive very quickly.

• Employment contracts and contractor agreements
• Confidentiality and intellectual property assignment clauses
• Acceptable use, remote working and bring your own device policies
• Onboarding and offboarding checklists
• Training completion records
• Leaver access revocation logs

IP ownership problems often start early, before you spend money on company setup or external development. If a freelance developer built core software without a proper assignment clause, the legal position may be less clear than founders expect.

When This Issue Comes Up

Most businesses notice the value of compliance records when someone asks for evidence at speed. The trigger is usually commercial, operational or reputational, not theoretical.

When selling to regulated clients

If you sell software to asset managers, portfolio businesses or firms with compliance teams, procurement will often ask for records before the contract is signed. That can include privacy materials, security policies, subcontractor information, insurance details and incident procedures.

If your records are incomplete, the sales cycle slows down. In some cases, the buyer may treat that as a sign that your controls are immature, even if your product itself is strong.

When launching a new product feature

A new feature can change your risk profile. For example, adding portfolio reporting tools, AI assisted analytics, investor portals or integrations with third party platforms may create new data flows, new contract commitments and new security questions.

This is the point where records should be updated, not left until after release. Product changes often require updates to customer terms, privacy notices, internal data maps or supplier records.

When using third party providers

Cloud hosting, analytics, customer support tools and outsourced development all create dependency and compliance risk. If a client asks who has access to their data, where data is stored, or which subcontractors are involved, you need a clear record.

Founders sometimes know the answer informally but have never documented it. That becomes a problem when the person who set the system up has left, or when the customer asks for a written list.

When something goes wrong

Complaints, outages, suspected breaches and contract disputes all become easier to manage if your records are organised. You can show what happened, when it happened, which controls existed, and what steps the business took in response.

Without those records, you may struggle to prove that a customer was notified correctly, that a supplier accepted a key obligation, or that access was removed after a contractor left.

When preparing for investment or sale

Due diligence is a record-keeping test. Investors and buyers often want to see evidence of registration, business structure, contracts, privacy compliance, employment contracts and trade mark protection.

Even if your business is not being sold soon, keeping these records now avoids a much larger clean-up later. Legal due diligence usually costs more and takes longer when documents are spread across old inboxes and personal drives.

Practical Steps And Common Mistakes

The best approach is to build a record system that matches how your business actually works. Keep it central, searchable and tied to ownership, so documents are updated when the business changes.

Set up a compliance record register

Create a central register showing what records exist, where they are stored, who owns them, and when they were last reviewed. This can be simple at first, provided it is accurate and maintained.

• Document name and category
• Owner within the business
• Date created and last updated
• Review frequency
• Storage location
• Linked contracts, policies or systems

This helps avoid the common problem of having a document somewhere, but not knowing whether it is current.

Use version control for contracts and policies

Every signed agreement and policy should have a clear final version, with older drafts archived separately. If you cannot tell which customer terms were live on a given date, disputes become harder to handle.

Keep records of approvals too. Before you sign a contract with unusual liability, security or data use terms, record who approved the departure from your standard position.

Map your data and suppliers properly

You should be able to explain, in plain English, what personal data your business collects, where it sits, and which suppliers touch it. That record should match your contract set and your privacy statements.

A practical supplier file should include:

• The services the supplier provides
• Whether the supplier handles personal data
• Where the supplier stores or accesses data
• The contract start date and renewal terms
• Any security or incident commitments
• The business owner responsible for the relationship

This is especially useful before you sign with enterprise clients that want approval over subprocessors or notice of supplier changes.

Keep product claims aligned with the evidence

Marketing and sales records matter more than founders often realise. If your website, pitch deck or proposal says your platform is secure, compliant, encrypted or suitable for regulated workflows, keep internal records showing what those claims are based on.

The main risk is not only misleading a customer. It is also creating obligations in practice that your contract or systems do not support.

Record incidents, complaints and responses

Do not wait for a major breach to start an incident log. Keep a record of complaints, outages, service failures, security events and remediation steps, even if the issue is minor.

• Date and description of the event
• Systems or customers affected
• Initial assessment
• Actions taken
• Whether notification was required
• Lessons learned and follow up tasks

This creates a useful history and shows that the business takes issues seriously rather than improvising every time.

Protect IP ownership from day one

If several founders, contractors or agencies contributed to the codebase, your records should show who created what and who owns it now. Keep signed IP assignments and contractor agreements in one place.

Do not assume payment equals ownership. In UK commercial practice, ownership usually needs to be dealt with expressly in the contract.

Common mistakes to avoid

Most record-keeping failures come from ordinary business shortcuts rather than deliberate non-compliance. The patterns are familiar.

• Keeping signed contracts in personal email accounts instead of a shared system
• Using website terms, privacy notices and sales proposals that do not match each other
• Forgetting to update processor lists when new tools are added
• Letting ex-staff or former contractors retain access without a recorded offboarding process
• Making security claims in tenders without evidence to support them
• Relying on template policies that no one in the business actually follows
• Failing to record who approved non-standard customer commitments

A good rule is simple: if a document would matter in a customer negotiation, regulator query, investor review or internal incident, keep it in a place where someone else could find and understand it quickly.

FAQs

Does an asset management software business need to be FCA authorised?

Not always. A software provider is not automatically FCA authorised just because it serves regulated firms. The answer depends on what your business actually does, including whether you carry on regulated activities or go beyond providing software tools.

How long should we keep compliance records?

There is no single retention period for every document. Retention should reflect legal requirements, contract terms, limitation risk and operational need. Many businesses use a documented retention schedule so records are kept for a defined period and deleted when no longer needed.

Do we need a separate data processing agreement with customers?

Often, yes. If your business processes personal data on a customer's behalf, UK GDPR usually requires certain processor terms to be in place. These are sometimes built into the main contract, but they still need to cover the required points.

Are internal policies enough to satisfy client due diligence?

No. Policies help, but clients often want supporting evidence such as signed contracts, training records, access logs, incident procedures and supplier details. The policy says what should happen, while records show what did happen.

What records matter most before we sell software online?

Focus first on your customer terms, privacy notice, data map, supplier contracts, IP ownership records and key security procedures. These are usually the documents that become relevant earliest when you launch online, onboard users and answer buyer questions.

Key Takeaways

• A UK asset management software business should keep records covering company setup, governance, contracts, privacy, security, IP ownership and staff arrangements.
• These records matter most when selling to regulated clients, launching new features, using subcontractors, managing incidents and preparing for investment or sale.
• Signed agreements, version histories and approval records are just as important as the final policy documents.
• Privacy and security records should show what data you handle, why you handle it, which suppliers are involved and what controls are in place.
• Common mistakes include scattered contracts, outdated policies, unsupported marketing claims and weak offboarding records.
• A central register with clear ownership and review dates makes compliance record-keeping more practical and far easier to defend.

If your business is dealing with compliance records a asset management software business should keep and wants help with customer contracts, data protection documents, supplier agreements, intellectual property arrangements, you can reach us on 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.