Record-Keeping for POSPs: What You Must Retain, For How Long, and Who Will Ask For It

Ask an advisor who regulates him and he will say IRDAI. That is true in the sense that IRDAI writes the rules, and misleading as a description of how the work actually goes. IRDAI does not telephone a POSP. It does not audit a POSP's cupboard. The entity that will ask you for a document is the one whose code you sell under: the insurer or the intermediary that engaged you, allocated your POS Code, and signed your appointment letter.

The reason is structural, and it is worth understanding rather than memorising. Under the IRDAI Master Circular on Point of Sales Products and Persons, Life Insurance (IRDAI/LIFE/CIR/MISC/215/12/2019), the life insurer is responsible for the conduct of the POSP representing it, and misconduct by that POSP makes the insurer liable to penalty under Section 102 of the Insurance Act, 1938. Where an intermediary engages the POSP, the intermediary carries that responsibility and that exposure. A POSP is tied to one insurer or one intermediary at any given time, and that single tie is also the single channel through which regulatory pressure reaches you.

Read the consequence carefully, because it cuts both ways. The regulatory penalty for your conduct lands on your principal rather than on you. And precisely because it lands on your principal, your principal will require from you, by contract, every record it needs to defend itself. Your retention obligation is owed to your principal, and it flows from what IRDAI requires of your principal. That sounds like a weaker basis than a direct regulatory duty. In practice it is stronger, because a contract can be terminated inside a week, and there is no appeal to a regulator that never engaged you.

Most retention questions in Indian insurance distribution do not have a clean, published, POSP-specific answer. One does.

The master circular is explicit: training and examination records must be retained for at least five years. That is the number, and it attaches to those records rather than to records in general. It is worth knowing exactly what sits inside the category, because advisors routinely hold none of it:

• Evidence of the fifteen hours of in-house training conducted by the engaging insurer or intermediary before the examination. Conducting the training is the principal's obligation. The record of your having completed it is what shows the appointment was validly made.
• The examination result. The POSP examination is conducted by the insurer or the intermediary itself, against a model syllabus specified by IRDAI. It is not a centrally administered IRDAI examination, and it is not IC-38, which is the agent route and a heavier one. Your result lives in your principal's system. It should also live in yours.
• The certificate and appointment letter, which the principal must issue within 15 days of your passing, and the POS Code allocated alongside them.
• Your eligibility evidence: 18 years completed and 10th standard passed, together with the identity documents the circular names, which include PAN and Aadhaar.

Here is the thing an honest post has to say plainly. The POSP is required to collect and maintain KYC documentation and product sales records, and to submit KYC documents and declarations truthfully and promptly to the engaging entity. That obligation is not in doubt. The retention period for KYC records specifically is not something a POSP should assume, and neither is the precise allocation of anti-money-laundering responsibility between you and your principal.

Both sit in the space where the operative documents are your contract of engagement and your principal's own AML and records policy. You should ask for them in writing rather than reason your way to an answer that feels right.

An uncertain clock is not hard to handle:

• Get the retention period in writing from your principal, at onboarding or at your next review. This is a two-line email, and it converts an open question into an instruction you can follow and later point to.
• Absent an answer, hold KYC for the life of the policy plus a comfortable margin. The events that make anyone want a KYC file (a claim dispute, a mis-selling complaint, a replacement query) are triggered by the policy, not by the calendar.
• Keep KYC inside the client's household file rather than in a separate KYC pile. A KYC document you cannot connect to the policy it supported does not answer the question it gets pulled for.

The data-protection overlay points the same way rather than the opposite one. Under the Digital Personal Data Protection Act, 2023, and the Rules notified alongside it, the obligations land on the data fiduciary. For a POSP, the fiduciary is realistically the insurer or intermediary that engaged you, and you are handling client personal data on their behalf. Expect consent, purpose-limitation, retention and breach-notification requirements to reach you through your contract ahead of 14 November 2026, when the enforcement powers and penalty framework commence, and 14 May 2027, when the substantive provisions come into force at the end of the transition. The instruction on how long to keep a KYC file is likely to arrive down that same wire.

Retention is a dull subject right up to the day it is the only thing standing between you and somebody else's account of what you said.

Complaints that reach a POSP are almost always about the sale rather than the product. The client says he was told the health policy covered a pre-existing condition from day one, or that the term plan would build a corpus. Your principal receives that complaint, and your principal is the one exposed. It then turns to you and asks one question: what do you have?

What answers that question is a sales record with a shape:

1. The proposal as submitted, carrying the disclosures as the client actually made them.
2. The issued policy schedule, showing what the insurer recorded, including your POS Code.
3. The benefit illustration or product material you actually used in the conversation, in the version current on that date.
4. The delivery evidence: the message or email by which the document reached the client, with its date.
5. A dated note of the conversation, two lines, written the same day: what the client asked for, what you recommended, and what you told him it did not cover.

The fifth item is the one nobody keeps and the one that decides outcomes. A dated contemporaneous note, written before anyone was in dispute, carries weight that a reconstruction written afterwards cannot. It does not have to be elegant. It has to exist, be dated, and be findable.

One related exposure is worth naming. Section 41 of the Insurance Act, 1938 prohibits offering any rebate of commission or of the premium shown on the policy as an inducement to take out or renew a policy, with a fine that may extend to INR 10 lakh, and it reaches the policyholder who knowingly accepts a rebate as well as the person offering it. Visible enforcement lands on insurers through Section 102, because insurers carry responsibility for their distributors' conduct. Your own practical exposure is contractual, which is to say immediate: a principal that finds a rebate in your book ends the tie. A clean record of what was actually offered on each sale is the only reply to an allegation that something else was.

A POSP may not issue or publish any advertisement or sales material without the prior approval of both the engaging entity and the insurer. That rule is long-standing, well understood by principals, and almost universally broken, because the definition of "advertisement" advisors carry in their heads is a hoarding, while the thing they actually do is post a rate comparison on a WhatsApp status.

Wherever your principal draws that boundary, the record-keeping instruction is unambiguous. Keep the approval, not just the creative. An approved piece of sales material with no approval attached to it is, in a dispute, an unapproved piece of sales material. The pack is three items: the artwork or message exactly as published, the approval reference with its date, and the period over which it was used. Attach them to each other rather than filing them in three separate places.

This bites hardest on material you did not create. Insurer and principal-supplied creatives circulate in advisor WhatsApp groups and keep getting forwarded for months after they are withdrawn or superseded. A rate card that was accurate in January and forwarded in July is a misrepresentation with your name on it, and "it came from the group" is not a record. If you cannot point to the approval and confirm the version is current, do not send it.

The conduct requirements sit alongside: ethical selling, proper disclosure, no push-selling, no misleading representation of what the policy does. Each is judged after the fact and from documents, which is another way of saying it is judged from your filing.

A POSP is tied to one insurer or intermediary at any given point in time. Ties end. The advisor moves to a principal with a better product range, or the principal exits a line, or the relationship simply stops. What almost nobody plans for is that the records do not travel automatically.

Two things are true at once when a tie ends, and they pull against each other. Your principal's systems hold your book: the policies, the codes, the statements, the client contact records. Access to those systems ends when the engagement does, often on the same day and with no notice. Meanwhile the obligations that produced those records do not end when the engagement does. A complaint about a sale you made in 2024 can arrive in 2027, and "what do you have?" will be asked of a person who no longer has a login.

The set worth holding is narrower than instinct suggests: your training and examination records, your certificate and appointment letter, your POS Code, your remuneration statements, and your own sales notes and delivery evidence. Those are records of your conduct and your pay.

Client personal data is a different category, and this is the line to be careful about. That data was collected for the principal, who is the fiduciary for it. Do not treat a client file as a portable asset because the relationship feels like it belongs to you. What you carry forward is evidence of what you did, not a database to sell from. Ask your principal, in writing, what you may retain and in what form, and ask before you need the answer.

Assembled into something a single advisor can run without a compliance function and without software:

1. Training and examination file. Evidence of the fifteen hours of training, the examination result, the certificate, the appointment letter, the POS Code allocation, and your eligibility documents. Retain at least five years per the master circular. In practice keep them permanently: it is one folder and it never grows.
2. Per-policy sales file. Proposal, issued schedule, material used, delivery evidence, dated conversation note. Hold for the life of the policy plus a margin, and do not let the margin stay a guess. Ask your principal for the number.
3. KYC. Filed inside the household rather than in a KYC pile. Retention as your principal instructs in writing. Do not import the five-year training figure here by analogy.
4. Sales material. Creative, approval reference, and period used, held together as one item.
5. Remuneration records. Statements from your principal, policy by policy, period by period. A POSP is remunerated by the entity that engaged it, under the contract of engagement, so these are the record of what you were paid and against what.

Two habits make the schedule real rather than aspirational. First, a quarterly hour: open the last quarter's policies and confirm each has all five items of the sales file. Gaps found at ninety days are fixable. Gaps found at a complaint are not.

Second, ask rather than assume. Your principal's retention instruction, its AML policy, its advertising approval process, and its position on what you may keep when the tie ends are four written answers you can request in one email, and each replaces a guess with an instruction. In a channel where the rules reach you through your principal rather than directly, that email is the highest-yield compliance work available to you.