A 2024 Inspection Became a 2026 Show-Cause Notice. That Lag Is Your Record Retention Requirement

In mid-August 2026, PB Fintech said that its insurance broking subsidiary had received a show-cause notice from IRDAI arising out of findings from an inspection conducted in 2024. The company said it expects no material financial impact, a position reported by NDTV Profit on 14 August 2026 and by the Financial Express on 17 August 2026.

Whether that assessment holds is the company's problem and its shareholders' interest. For every other broking firm in India, the useful number in that disclosure is not the expected impact. It is the gap. Roughly two years separated the on-site inspection from the notice that formally asked the firm to explain itself.

That gap is not unusual and it is not a criticism of the regulator. An inspection team gathers material at a large number of intermediaries, findings are collated, internal review runs its course, and enforcement action issues when it issues. The same firm was penalised Rs 5 crore in August 2025 for violations that included biased and misleading representation of products, so the enforcement pipeline clearly runs on its own clock.

The operational consequence sits entirely with the broking firm. When a notice arrives in 2026 about a placement made in 2023 and inspected in 2024, the firm answers from whatever survives in retrievable form. Not what was true at the time. What can be produced, with dates, authors and version history, from a system that has since been migrated, from a mailbox that has since been deprovisioned, and from a relationship manager who has since resigned.

Most mid-size broking firms have a retention policy that reads roughly as follows: records are retained for a period of X years. It is one sentence, it applies to everything, and it is enforced by nobody because it maps to no system.

A blanket period fails in both directions at once. It over-retains low-value material that costs storage and creates discovery risk, and it under-retains the handful of artefact classes an inspection will actually ask about, because those artefacts live in systems the policy never named.

Build the schedule by artefact class instead. For each class, record four things:

1. What it is, named precisely enough that an operations person can find it. Not "client records" but "quote comparison sheet exported from the placement system, per placement, per renewal cycle".
2. Where it lives, naming the system of record. If the honest answer is a shared mailbox or a relationship manager's laptop, that is the finding, and it is better found now than in a reply window.
3. How long it is kept, expressed as a period running from a defined trigger. The trigger matters more than the number. Policy expiry, final claim closure and contract termination give very different end dates for the same file.
4. Who can produce it when the person who created it has left.

On duration, the two-year inspection-to-notice lag is a floor and not a target. A finding raised in a notice concerns conduct that predates the inspection, so the working assumption should be that the firm may need to reconstruct a file three to five years after the transaction closed, and longer where a claim or a policy of long-tail liability is involved.

The single artefact that decides how an inspection finding on conduct resolves is the placement file, and specifically the part of it that explains the recommendation.

A defensible placement file contains the quotes obtained, the terms compared on a like-for-like basis, and a written reason for the insurer recommended to the client. The reason is the part firms skip, because at the time it is obvious to everyone in the room. Two years later it is obvious to nobody, and the absence of a recorded rationale is what turns a routine question into an allegation about biased representation.

The comparison itself has to be capable of standing up. Quotes compared on premium alone, where the recommended insurer carried a narrower policy wording, a higher deductible or a tighter claims service commitment, read badly in reconstruction even when the advice was sound. Record what was compared and what was traded off.

Communications are part of the file

Most placement discussion now happens on WhatsApp. Terms are negotiated there, client approvals are given there, and insurer confirmations arrive there. If those messages sit on personal handsets, the firm's placement file is incomplete and the firm does not know it.

The fix is not a prohibition that nobody follows. It is a channel that is archived by default, used for anything that constitutes advice, a quote, a client instruction or an insurer confirmation, with the archive indexed to the client and the policy number so retrieval does not depend on remembering who was in which group.

IRDAI's direction on intermediary accountability has been moving toward more disclosure, not less. Reporting on 31 July 2026 in ET BFSI and Business Standard described the regulator tightening intermediary rules and accountability through new disclosure norms, alongside an easing of insurers' investment norms. The direction of travel matters for retention because disclosure obligations create records whose value is entirely in being producible later.

Three items belong in the retained set for every client relationship:

• Terms of engagement, in the version that was in force on the date of the transaction being examined. A current template proves nothing about a 2023 placement. Version control with effective dates is the whole point.
• What was disclosed to the client about remuneration, in the form it was actually communicated, with the date and the recipient.
• Client instructions and approvals, particularly where the client selected an option other than the one recommended, or declined a cover the firm proposed. A declined recommendation that is documented is a defence. The same decision undocumented is exposure.

Firms preparing for the wider disclosure requirements described in the intermediary disclosure pack workstream will find that the underlying data assembly overlaps heavily with the retention schedule. The same source systems feed both.

Commission findings are the most common substance of a broking inspection and the hardest to answer from memory, because the number in question is an output of a calculation that ran inside a system two years ago.

Retain the working, not just the result. That means the rate applied, the base it was applied to, the treatment of reversals and cancellations, the split where a placement was co-broked, and the reconciliation between what the placement system recorded and what the audited accounts show as revenue.

The agreements sit alongside the workings and are the item most often missing:

• Insurer agency or broking agreements, in the version in force on the transaction date, including every amendment and addendum.
• Reward agreements and their approval trail.
• Administrative or marketing services agreements with insurers, where they exist, together with the evidence that services were actually delivered against them. An agreement with no delivery evidence invites a conclusion the firm will not enjoy.
• Co-broking and sub-broking arrangements with the share basis stated.

The mechanics of how these findings are raised and remediated are set out in the piece on IRDAI inspections of broker commission. The retention point is narrower: the calculation and the contract that authorised it must be retrievable together, as a pair, keyed to the transaction. A contract in a filing cabinet and a number in a general ledger are not a file.

Three further classes attract inspection attention and are systematically under-retained because each lives in a system nobody thinks of as a record system.

Advertising and marketing approvals

Every customer-facing asset that describes a product, a comparison or a benefit needs its approval trail retained: the version published, the approver, the date, and the period it was live. Digital assets make this harder, not easier, because a landing page is edited in place and the version that ran in 2023 leaves no copy behind unless the firm deliberately archived it. Where the underlying conduct question is about representation of products, the surviving asset is the evidence.

POSP and salesperson records

Training completion, examination results, and the certification that supported an appointment are what an inspection uses to test whether a person who sold was entitled to sell. Retain them keyed to the individual and to the appointment period, and keep them after the individual leaves. The obligations on the individual side are covered in record-keeping for POSPs; the firm-side obligation is to hold the appointment and training evidence independently of the person it concerns.

Grievance registers need turnaround evidence. A grievance register that records receipt and closure but not the intervening steps cannot demonstrate turnaround. Retain the timestamps: intimation, acknowledgement, substantive action, resolution, and the communication to the complainant at each stage. This is one of the few areas where the record either exists in the ticketing system with timestamps intact or does not exist at all.

The outsourcing due-diligence pack belongs in the same tier. Where a vendor handles policyholder data or performs an activity the firm is answerable for, retain the due-diligence assessment, the contract with its data and audit clauses, and the periodic review evidence for the full term plus the retention period applying to the underlying activity.

Every retention schedule assumes someone will retrieve the record. Almost none of them name that person, and broking has high enough relationship-manager turnover that a two-year lag routinely outlasts the tenure of the person who owned the file.

Assign the retrieval obligation to a role rather than to a name. The role sits in operations or compliance, not with the client-facing team, because the client-facing team is the part that churns. That role needs three things to function:

1. A map from artefact class to system, so retrieval starts with a query rather than a search for institutional memory.
2. Standing access to every system on that map, including archived mailboxes, the message archive, the document store and the placement system's historical records. Access requested at the moment of a notice is access that arrives late.
3. A tested retrieval. Pick two closed placements from three years ago at random each quarter and reconstruct them end to end. The exercise takes a day and reveals precisely which artefact class has gone missing, at a point where the answer can still be fixed prospectively.

The handover itself deserves a short written record: which clients moved to whom, which matters were open, and where the files sit. It costs an hour and it is the difference between a file that can be reconstructed and one that can only be described.

When a notice does arrive, the reply window is short. The procedure and the timelines are set out in the piece on the 21-day show-cause clock. What that window does not allow is the assembly of records from scratch across four systems and two former employees.

Structure a response so that each finding is answered with documents rather than recollection:

1. Restate the finding in the regulator's terms, without softening it. A reply that answers a question nobody asked reads as evasion.
2. State the firm's position in two or three sentences, before any evidence.
3. List the documents relied on, each with a date, an author or system of origin, and a reference. Attach them in that order.
4. Separate the contemporaneous from the reconstructed. A document created in 2023 and a summary prepared in 2026 carry different weight, and presenting the second as if it were the first is a far worse problem than the original finding.
5. Describe what changed since, where the firm has already remediated, with the date the change took effect and the evidence that it is operating.

The honest test of a retention programme is not whether the policy document exists. It is whether the firm can take a placement from three years ago, name the client, and produce the quote comparison, the recommendation rationale, the disclosure sent, the remuneration working, the agreement that authorised the rate, and the communications trail, within a working day, without contacting anyone who has left. Firms that can do that treat a show-cause notice as a drafting exercise. Firms that cannot spend the reply window discovering what they lost.