Does MiFID II apply to video calls as well as phone calls?

Yes. MiFID II Article 16(7) applies to all communications that relate to the conclusion of client transactions, regardless of the communication medium. The European Securities and Markets Authority's guidance has confirmed this applies to video conferencing. The pandemic enforcement actions by the FCA (which enforces MiFID II in the UK) against firms that moved to video calls without updating their recording compliance frameworks confirmed that video calls are within scope.

What's the technical difference between Governance mode and Compliance mode in S3 Object Lock?

In Governance mode, users with the s3:BypassGovernanceRetention IAM permission can delete or modify locked objects before the retention period expires. This provides protection against accidental deletion while allowing authorized administrators to override. In Compliance mode, no user, including the AWS root account, can delete or modify locked objects before the retention period expires. For call recording finance compliance use cases where regulations mandate that records cannot be deleted for a fixed period, Compliance mode is the appropriate choice. Be careful: objects in Compliance mode with long retention periods create permanent storage obligations that cannot be reversed.

How do you handle recordings when an employee leaves the firm?

The recording obligation runs with the communication, not the employee. Recordings made while the employee was at the firm must be retained for the required period regardless of their employment status. Archive recordings associated with departed employees to cold storage (S3 Glacier) to reduce cost, but maintain the same retention policy and access logging. The metadata record linking the recording to the employee should remain queryable. Include a process in your employee offboarding checklist that verifies recording metadata is updated with the employee's departure date and that retention policies are confirmed.

Is transcription required for MiFID II compliance, or just the audio/video recording?

MiFID II as written requires retention of the communication itself, which means the audio or video recording. Transcription is not explicitly required. However, the practical cost of responding to regulatory inquiries without transcripts is high, scrubbing through audio is slow and error-prone. Many compliance-focused firms treat transcription as a de facto requirement because the cost of not having searchable transcripts during an inquiry is significant. It's worth discussing with your compliance officer whether to treat transcription as required or as a best practice in your specific context.

Compliance Recording for Financial Services: Meeting Bot API Guide

Q: Can you use a meeting recording API for compliance if the API vendor isn't in the EEA?

Under GDPR, transferring personal data (which meeting recordings containing identifiable individuals are) to a third country requires either an adequacy decision, Standard Contractual Clauses, or other approved transfer mechanism. For a US-based meeting recording vendor, you need appropriate transfer mechanisms in place. This is a legal question for your data protection officer, but the technical implementation should ensure that data processing agreements (DPAs) are in place with all vendors who process personal data, and that data residency requirements (some regulated firms need data to remain in the EU) can be met. Discuss your specific jurisdictional requirements with legal counsel befo

The best meeting bot API for financial compliance provides secure, reliable recording and long-term storage for audit trails. Financial institutions must maintain detailed records of client interactions for regulatory adherence. This requires a system that can capture complete conversations across platforms like Zoom, Google Meet, and Microsoft Teams. The data must be stored securely and be easily accessible for internal review and external audits.

MeetStream provides an API to deploy bots into meetings on all major platforms. It acts as the agent-first voice infrastructure, allowing you to build applications that join calls, listen, and record. For compliance workflows, you can direct all recordings to your own S3 storage. This ensures your organization maintains full control over sensitive financial data, meeting retention policies and security requirements for audit purposes.

A wealth manager takes a client call on Zoom and discusses a portfolio rebalancing recommendation. Under regulations in the European Union, that conversation must be recorded and retained for a minimum of five years. The wealth manager uses the native Zoom recording feature, which stores the file in Zoom's cloud. When a compliance audit request arrives two years later, the legal team discovers an auto-delete setting was enabled. The recording is gone.

This scenario is common in financial services firms that treat meeting recording as an afterthought. The regulatory requirements are specific, but the tooling to implement them correctly requires more than checking a box. It requires a dedicated recording infrastructure layer that your organization controls. Let's get into the technical requirements and how to build for them.

The Regulatory Landscape for Call Recording

Three regulatory frameworks create the primary recording obligations for financial services firms communicating with clients about investment products and services.

MiFID II, or the Markets in Financial Instruments Directive, requires European investment firms to record all communications that relate to a transaction. This applies to orders received via telephone, video call, or any electronic communication. Recordings must be retained for at least five years, and up to seven years if requested by a national authority. Firms must inform clients that their communications will be recorded.

FINRA Rule 3110 in the United States requires broker-dealer firms to supervise their business activities. The Financial Industry Regulatory Authority has interpreted this to include retaining client communications. FINRA Rule 4511 requires firms to keep books and records in the form and for the periods set by SEC Rule 17a-4, which for most business communications is three years, the first two in an easily accessible place. While the rule does not specify video calls, enforcement actions have made complete recording the standard for broker-dealers.

Dodd-Frank requirements for swap dealers include mandatory recording and retention of communications related to potential swap transactions. The relevant CFTC regulation requires retention for at least five years. Rule 17a-4 also governs how electronic records are stored: since the SEC's 2022 amendments, a firm can use either a write-once, read-many (WORM) format or a system that keeps a complete, time-stamped audit trail of every change. This technical requirement has significant implications for how you store recordings.

These are baseline frameworks. Many jurisdictions have additional requirements. If you are building for a firm that operates globally, you should assume the most stringent requirement across all jurisdictions applies to every recording.

Technical Requirements for Compliance Recording

The regulations translate to a specific set of technical requirements that go well beyond storing a video file. Here is what you need to implement.

Retention period enforcement means recordings must be retained for the required period and must not be deletable by unauthorized parties. This maps to a write-protected storage configuration with time-locked deletion. AWS S3 Object Lock in Compliance mode implements this at the storage layer. Objects in Compliance mode cannot be deleted by anyone, including the root account, until the lock expires.

Verifiable integrity requires you to demonstrate that a recording was not tampered with. The standard approach is to compute a hash, like SHA-256, of the recording file at the time of storage. You store this hash in a separate, append-only audit log. When producing the recording in an audit, you recompute the hash and compare it to the stored value. A mismatch indicates tampering.

Access logging means every access to a recording must be logged, including who viewed it, when, and for what purpose. Audit logs themselves must be retained and tamper-evident. This requires an append-only log store, such as a separate database table where rows cannot be updated or deleted.

Financial meeting transcription can also be a compliance artifact. While not always explicitly required, searchable transcripts with speaker attribution and timestamps substantially reduce the cost of responding to regulatory inquiries. Searching text is much faster than listening to hours of audio.

Implementing a Compliant Retention Workflow

When deploying a recording bot with the MeetStream API, the recording_config parameter helps you start the capture process. For compliance use cases, you will configure your system to receive recordings and manage them in your own infrastructure. This is critical because the regulatory obligation is yours, not your vendor's.

Here is the implementation pattern. First, you create a bot and tell it to join a meeting, record it, and use an in-house transcription provider. You also provide a webhook URL to receive notifications.

curl -X POST "https://api.meetstream.ai/api/v1/bots/create_bot" \
  -H "Authorization: Token <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "meeting_link": "https://zoom.us/j/123456789",
    "bot_name": "Compliance Recorder",
    "callback_url": "https://your-app.com/webhooks/meetstream",
    "recording_config": {
      "transcript": {
        "provider": {
          "meetstream": {}
        }
      }
    }
  }'

After the meeting ends, your webhook handler receives an audio.processed event with a download URL. At this point, your compliance pipeline takes over. Your application should download the file immediately, compute its SHA-256 hash, and upload it to your S3 bucket with Object Lock enabled. When uploading, you set a retention date equal to today plus the required retention period. Finally, you write a record to your audit log containing the file hash, S3 location, recording date, participants, and meeting ID.

Flowchart showing a meeting starting, a MeetStream bot joining to record, a webhook firing after the meeting, and the customer's application storing the file in S3 for compliance. — *A compliant recording workflow separates capture from storage, giving you full control over retention and integrity.*

This download, hash, and store sequence should be atomic from an audit perspective. If the pipeline fails after download but before storing the hash, it creates an unverifiable recording. You should build idempotent webhook handlers to manage this. If a step fails, the process should be able to re-download and re-hash the file safely.

Encryption and Security Requirements

Encryption at rest is required under most financial services information security frameworks. For recordings stored in S3, server-side encryption with AWS Key Management Service (SSE-KMS) provides encryption at rest with key management under your control. Use customer-managed keys, not AWS-managed keys. This gives you the ability to rotate, audit, and revoke access to decryption keys. You should log all key usage in AWS CloudTrail.

Encryption in transit is provided by HTTPS for both the MeetStream API callback and the download URL for completed recordings. You should verify that your webhook handler enforces TLS 1.2 or higher on incoming connections and that your S3 upload uses the AWS SDK with signature v4 authentication.

The audit log also requires encryption. A tamper-evident audit log that is unencrypted and accessible to database administrators is not secure. Use database-level encryption or a separate encrypted log store. Access to the audit log should be restricted to compliance officers and logged separately from general application access.

Disclosure and In-Meeting Bot Configuration

MiFID II explicitly requires that clients be informed that their communications will be recorded before services are provided. In a video call, this typically happens in two places: in the pre-call disclosure, like a meeting invitation, and in the call itself when the recording bot joins.

The bot_name parameter in the MeetStream API controls how the bot appears in the meeting. For compliance, use a name that clearly identifies its function, such as "Compliance Recorder" or "[Firm Name] Compliance Bot." This provides visible, in-meeting disclosure that a recording is in progress.

To provide an explicit in-meeting message, you can have your application make a second API call after the bot joins. When your application receives the bot.inmeeting webhook event, it can call the send_message endpoint to post a chat message like: "This meeting is being recorded for regulatory compliance purposes. By continuing, you consent to this recording." Storing the disclosure confirmation as part of your call record, using the timestamp from the webhook, creates a defensible compliance record.

Responding to Regulatory Requests

The value of this infrastructure becomes clear when a regulator requests records. A typical request might specify a date range, one or more parties, and the type of communication. Your system needs to retrieve matching recordings and transcripts within a legally specified timeframe, often just a few business days.

This requires a queryable metadata store indexed on recording date, participant names, account numbers, meeting platform, and meeting ID. The recordings themselves live in S3 and do not need to be indexed, but the metadata about each recording must be easy to search.

You should build the regulatory request workflow as a primary feature. This could be an admin interface that accepts request parameters, queries the metadata store, and retrieves the relevant recordings from S3. The workflow should automatically verify the hash against the stored hash and package the output, including recordings, transcripts, and access logs, into a structured response.

How MeetStream Fits In

It is important to be precise about the split of responsibilities to avoid compliance gaps. The MeetStream API provides reliable bot join and leave across Google Meet, Zoom, and Teams. It also handles audio and video recording, speaker-attributed transcription, and webhook delivery of recording artifacts. These are the recording capture components.

A diagram with three layers. The bottom layer is Meeting Platforms. The middle layer is the MeetStream API for capture. The top layer is Your Application, which handles the compliance logic. — *MeetStream provides the reliable capture infrastructure, while your application implements the specific compliance controls.*

Your application is responsible for the compliance layer. This includes the storage architecture that meets regulatory requirements like Object Lock and encryption. It also includes hash computation, integrity verification, access logging, retention period enforcement, disclosure workflows, and the regulatory request response system. MeetStream provides the raw material. Compliance is a system-level property of your implementation.

Conclusion

Building for compliance recording for financial services requires more than just capturing a meeting. It demands a system that enforces retention, verifies integrity, and logs all access. By using a meeting bot API for the capture layer, developers can focus on building the specific compliance controls their organization needs. This approach provides the control and auditability that regulations like MiFID II and FINRA demand, turning a complex requirement into a manageable engineering task. See the full API reference at docs.meetstream.ai.

Related guides

Frequently Asked Questions

Does MiFID II apply to video calls?

Yes. MiFID II Article 16(7) applies to all communications related to client transactions, regardless of the medium. The European Securities and Markets Authority has confirmed this includes video conferencing. Enforcement actions have made it clear that video calls are within the scope of the regulation.

What is the difference between S3 Object Lock Governance and Compliance modes?

In Governance mode, users with the s3:BypassGovernanceRetention IAM permission can delete locked objects. In Compliance mode, no user, including the AWS root account, can delete locked objects before the retention period expires. For financial compliance use cases, Compliance mode is the appropriate choice.

How should recordings be handled when an employee leaves?

The recording obligation is tied to the communication, not the employee. Recordings made while an employee was at the firm must be retained for the full required period. You can archive these recordings to cold storage like S3 Glacier to reduce cost, but the retention policy and access logging must be maintained.

Is transcription required for MiFID II compliance?

MiFID II requires retention of the communication itself, meaning the audio or video recording. Transcription is not explicitly required. However, many firms treat transcription as a best practice because searchable text significantly lowers the cost and time needed to respond to regulatory inquiries.

Can you use a recording API if the vendor is outside the EU?

Under GDPR, transferring personal data to a third country requires an approved transfer mechanism, like Standard Contractual Clauses. MeetStream offers both US and EU data residency, allowing you to store data in your preferred region. A data processing agreement (DPA) is also available. This is a legal question for your data protection officer.