Terms of service

Version 2026-10-27

1. The service
1.1 Regulatory Advice Limited ("we") receives the firm's transaction reports, checks them, and submits them on the firm's behalf to an Approved Reporting Mechanism ("ARM"), which passes them to the FCA. We act as a third-party submitter.
1.2 We decide which ARM handles each report. We may use more than one ARM, use different ARMs for different reports or at different times, and use an ARM owned by or connected with us. We do this to keep the service running if an ARM is unavailable and to keep its cost down. Any connected-party ARM is used on arm's-length commercial terms. Use of a connected-party ARM does not weaken the data-protection position set out in clause 5 and the Schedule.
1.3 We tell the firm at least 30 days before we change the ARM that normally handles its reports. Where a change is needed at short notice to keep reports flowing, we make it and tell the firm promptly afterwards. We record who submitted each report and through which ARM, and show this to the firm in its account.
1.4 Before the firm's account is live, reports go to a practice service or to the ARM's test environment. They are not reports to the FCA.

2. The firm's responsibilities
2.1 The firm remains responsible for its reporting obligations under UK MiFIR, for the accuracy and completeness of the data it sends, and for sending it in time for reports to be made by the end of the working day after the trade.
2.2 The firm reviews the feedback the service gives, corrects rejected reports, and decides on reports that carry warnings. A report sent despite a warning is sent on the firm's instruction. Where the firm instructs us to submit a report that carries a warning, we record the instruction, the identity of the user, the time and the warnings that were overridden. We retain that record in a tamper-evident audit trail for the period in clause 5.3, even if the firm later requests early deletion of the underlying reports under clause 5.3 or S12.
2.3 The firm keeps its login details secure and tells us of any unauthorised use.

3. Our responsibilities
3.1 We submit reports that pass our checks to the ARM in our next sending cycle, pass back the ARM's and the FCA's responses, and keep records of what was sent and received.
3.2 We do not guarantee that the ARM or the FCA will accept a report.

4. Fees
4.1 The yearly fee is paid in advance by card and covers the first 1,000 messages in each subscription year. A message is each new report and each cancellation we send to the ARM for the firm. The subscription renews each year unless cancelled before the renewal date.
4.2 Each message beyond those included costs 2p, charged monthly in arrears to the same card. If the ARM's charge to us per message changes, we may change this rate on 30 days' notice.
4.3 The service is designed for firms sending up to 50,000 messages a year. Above that we will contact the firm to agree terms; we will not stop sending its reports meanwhile.
4.4 All fees are subject to VAT.
4.5 If a payment fails and is not made good within 14 days, reports are held and not sent. The firm remains solely responsible for its reporting obligations under UK MiFIR while reports are held. We resume sending as soon as cleared funds are received.

5. Data
5.1 Reports contain personal data. For that data the firm is the controller and we are its processor under UK data protection law. The Schedule sets out how we process it, and prevails over the rest of these terms on that subject.
5.2 For the details of the firm's users (names, email addresses and login records) and its billing details, we are the controller. We use them only to run the service, bill for it, keep it secure and meet our legal obligations.
5.3 We keep reports and their records for five years from submission, so the firm can rely on them for its own record-keeping, then delete them. The firm may ask us to delete them sooner once it has received its copy under clause 7.6. Early deletion does not immediately remove residual copies that sit inside combined files sent to or received from the ARM (which also contain other firms' reports); those copies are kept beyond use until the end of the five-year period, as set out in S12. Audit-trail records of the firm's instructions are retained for the five-year period to the extent necessary for the establishment, exercise or defence of legal claims.

6. Liability
6.1 Our total liability in any year is limited to the fees paid in that year, except as set out in 6.2.
6.2 For breach of the data-protection obligations in clause 5 or the Schedule, and for failure to submit, within the required time, a report that has passed our checks, our total liability in any year is limited to £1,000,000 for all such claims taken together. For the avoidance of doubt, the limit in this clause 6.2 applies instead of, and not in addition to, the limit in clause 6.1.
6.3 We are not liable for indirect loss, or for regulatory fines arising from the content or timing of data the firm sent. That exclusion does not apply to fines caused by our failure to submit, within the required time, a report that has passed our checks, or by a personal data breach caused by our failure to maintain the security measures in S7.
6.4 Nothing in these terms limits liability that cannot be limited by law.

7. Regulatory access, continuity and exit
7.1 The firm, its auditors and the FCA, and any other regulator with authority over the firm, have effective access to the data we hold for the firm and to the information, people and premises they need to oversee the service. We answer reasonable requests for information, including due-diligence questionnaires, within 10 working days. We allow an audit on 30 days' notice, no more than once a year unless a regulator requires it or a security incident has affected the firm's data. Each side bears its own costs of an audit.
7.2 We cooperate with the FCA in connection with the service. We tell the firm promptly if a regulator contacts us about its reports, unless the law prevents us.
7.3 We keep a business continuity plan and test it. It includes encrypted nightly backups held with a second UK provider, a monthly test that the service can be restored from them, and the ability to submit reports by hand through the ARM's own portal if our sending route fails. We tell the firm promptly of any incident that may stop its reports reaching the ARM in time.
7.4 We tell the firm promptly of anything that may materially affect our ability to provide the service, including a change in who controls us or a sub-contractor ceasing to provide its part.
7.5 We remain responsible to the firm for any part of the service we sub-contract.
7.6 When the service ends for any reason, we help the firm move to another provider. Within 10 working days we give it a full copy of its reports, the responses to them and our records of what was sent, in machine-readable form. If the firm asks, we keep sending its reports for up to three months after the end date, at the fees then current, so that it can switch without a gap. The continued-sending assistance in this clause is subject to our continued ability to perform the service. If we are unable to continue (including because of insolvency or cessation of business), clause 8.3 and any agreed take-over arrangements will apply.
7.7 The firm may end the service at any time if the FCA requires it, or if we materially breach clause 5, this clause 7 or the Schedule and do not put it right within 30 days of being told. We then refund fees already paid for the rest of the subscription year, pro rata.

8. Ending the service
8.1 Either side may end the service at the end of a subscription year. We may suspend it if fees are unpaid or the service is misused.
8.2 On ending, clause 7.6 applies.
8.3 We may transfer these terms, with the firm's records, to a company connected with us or to a business that takes over the service, on 30 days' notice. The firm's rights under these terms are not reduced by the transfer.

9. Law
9.1 These terms are governed by the law of England and Wales.

Schedule: data processing
S1 Subject matter and duration. Processing the firm's transaction reports so that they can be submitted through an ARM to the FCA under UK MiFIR. It lasts while the service runs and for the retention period in clause 5.3.
S2 Nature and purpose. Receiving, checking, storing, converting and sending reports; receiving the ARM's and the FCA's responses and showing them to the firm; preparing corrections and cancellations on the firm's instruction; keeping records of all of these; and backing them up.
S3 Personal data. What the reports must contain about individuals: first names, surnames, dates of birth, national identifiers (such as national insurance numbers, passport numbers and identifiers built from name and date of birth), and any other personal data the firm includes in what it sends.
S4 Data subjects. The firm's clients who are individuals; individuals who make investment decisions for those clients, for example under a power of attorney; and the firm's staff responsible for investment decisions and executions.
S5 Instructions. We process the personal data only on the firm's documented instructions, which are these terms and what the firm does through the service, unless UK law requires otherwise. In that case we tell the firm first, unless the law forbids it. We tell the firm if we think an instruction breaks data protection law. The recording of override instructions described in clause 2.2 forms part of the firm's documented instructions and is retained as set out in that clause and in clause 5.3.
S6 Confidentiality. Everyone we authorise to process the personal data is bound by a duty of confidentiality.
S7 Security. We keep appropriate technical and organisational measures in place, and review them at least once a year. They include: encryption in transit (HTTPS for the portal, key-authenticated SFTP to the ARM); encrypted backups; passwords stored only as salted hashes; sessions that expire; access limited to the firm's own users and our operators; an audit trail of logins, uploads and submissions; servers in the United Kingdom; and prompt security updates.
S8 Sub-processors. We use these sub-processors: the ARMs we use under clause 1.2 (currently DTCC), which receive the reports; Mythic Beasts, which hosts our main server in the United Kingdom; Krystal, which holds our encrypted backups in the United Kingdom; Google, for email; and Stripe, for payments. Google and Stripe handle contact and billing details only, not reports. We give the firm 30 days' notice before we add or replace a sub-processor, and pass on notice of a change an ARM makes to its own sub-processors as soon as the ARM tells us; if it objects, it may end the service and we refund fees already paid for the rest of the subscription year, pro rata. We impose the same data protection obligations on each sub-processor by contract, and remain responsible to the firm for them. In the case of an ARM, we ensure that its operating procedures and contractual terms provide a level of data protection that is equivalent in all material respects to the obligations in this Schedule.
S9 Transfers. Our own servers are in the United Kingdom. DTCC, our current ARM, processes reports in its cloud service mainly in Germany, with Ireland as back-up; UK law treats the European Economic Area as adequate, so no further safeguard is needed for those transfers. DTCC's approved sub-processors include affiliates and service providers in the United States; DTCC covers any transfer to them with the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses (DTCC UK MiFIR ARM Data Processing Addendum, clause 4(m)). We transfer personal data anywhere else outside the United Kingdom only with the safeguards UK law requires, and we tell the firm of any material change to where its data is processed or the safeguard used.
S10 Assistance. We help the firm, as far as the nature of the service allows, to respond to requests from individuals exercising their rights, to keep the data secure, to deal with personal data breaches, and with data protection impact assessments and any consultation with the ICO.
S11 Personal data breaches. We tell the firm without undue delay, and in any case within 48 hours of becoming aware of a breach affecting its personal data, with what we know: what happened, the kinds and approximate numbers of people and records involved, the likely consequences and what we have done about it. We update the firm as we learn more. The firm decides whether to notify the ICO and the people affected.
S12 Deletion. At the end of the retention period in clause 5.3 we delete the personal data, checking daily for records that have reached it. If the firm asks under that clause for deletion sooner, we delete its uploads and reports at once; copies inside the combined files we sent to and received from the ARM, which also hold other firms' reports, are kept beyond use until the end of the retention period. Copies the ARM holds are kept by it to meet its own record-keeping duties as an ARM; deletion at the firm's request does not reach them. Our backups are encrypted and kept so that the service can be recovered: daily backups for 30 days and one a month for 12 months, so deleted data leaves them within 13 months. Until then, backup copies are kept beyond use: we restore from them only to recover the service, and after any restore we repeat every deletion made since the backup was taken. Audit-trail records of the firm's instructions (including override instructions under clause 2.2) are retained for the five-year period in clause 5.3 to the extent necessary for the establishment, exercise or defence of legal claims (UK GDPR Article 17(3)(e)).
S13 Information and audit. We make available the information the firm needs to show that this Schedule is being met, and allow audits as set out in clause 7.1.