A trading firm generates four kinds of record that regulators care about: identity documents collected at onboarding, payment and account histories, trade and order logs, and communications with clients. Each one can end up in a different system, and each system sits on a server in a specific country. Data residency is the question of which countries those servers may be in, and who else can reach the data once it is there.
The confusion starts because two separate rulebooks apply at once. Privacy law governs personal data about the client. Financial regulation governs record keeping and supervisory access. They are written by different bodies, they answer different questions, and satisfying one does not satisfy the other.
Privacy law asks who can reach the data
Under the European framework, personal data may move outside the bloc only if the destination is covered by an adequacy decision, or the parties sign standard contractual clauses, or a narrow exception applies. The mechanism matters less than the paperwork trail: a supervisor asking about your Manila support desk wants to see the contract, the transfer assessment and the list of who has access, not a promise that the data is safe.
The subtlety most firms miss is that access counts as transfer. If your database physically sits in Frankfurt but a developer in a third country can log into it, that is a cross-border transfer and it needs the same paperwork as a copy of the file. Remote access by a support contractor is the single most common gap we see in privacy reviews at trading firms.
Financial regulation asks whether the regulator can reach it
A financial supervisor has a different worry. It needs to be able to demand order records, client files and communications, and receive them promptly, without depending on a foreign court. That is why licence conditions in many jurisdictions require records to be kept in a form and place from which they can be produced to the regulator on request, and why some regulators require a copy held locally regardless of where the primary system lives.
Retention periods sit here too. Five years is a common floor for order and transaction records, with some regimes extending to seven and some requiring communications to be kept for shorter windows. The practical consequence is that deletion requests from clients and record keeping obligations collide. Privacy law usually resolves that in favour of the legal obligation, but you have to be able to explain which records you kept, why, and for how long.
Hard localisation, and where you actually meet it
Full localisation, meaning the data may not leave the country at all, is rarer than the internet suggests, but it exists. Several jurisdictions in Asia, the Middle East and Latin America apply it to some category of financial or personal data, sometimes only to payment records, sometimes to anything a licensed institution holds. Russia and China are the widely cited examples. India has applied storage rules to payment system data. The point for a broker is not to memorise a list, because the list changes, but to ask the question before opening a market: does a licence here force a local copy, and can my vendor provide one.
Multi-region hosting is not free. Every extra region means another database to back up, another set of encryption keys, another audit surface, and a real risk that the two copies drift. Add a region because a rule requires it, not because it sounds safer.
The vendor question that decides everything
Most of a firm's data lives in software it did not write. The CRM holds the client file. The KYC provider holds the identity documents and the selfie video. The payment processor holds the card data. The email tool holds the marketing history. Each of those vendors has its own hosting map, and the honest ones publish it.
Three questions decide whether a vendor works for your residency posture. Where is the primary data stored, and can you pick the region. Where are the backups, because a European primary with a US backup is still a transfer. And which of the vendor's own staff or subprocessors can read production data, from where. If a vendor will not answer the third question in writing, that is your answer.
Self-hosting solves residency cleanly and creates a different problem: you now own patching, backups and key management and encryption. For a firm without an infrastructure team, a hosted platform with a region choice and a signed data processing agreement is usually the better trade. When we deploy the Broker CRM, the region is a setup decision made once, before any client record exists.
What to write down before launch
A data map is dull and it is the document that saves you. One row per system, listing what personal data it holds, which country the primary and backup sit in, which vendor operates it, what transfer mechanism covers it, and how long records are kept. Six systems, six rows, one page. Regulators ask for exactly this, and firms that have it answer in a day rather than a fortnight.
The second document is an access list: who inside the firm and inside each vendor can read production client data, and from which country. Review it when someone joins or leaves. Most incidents involve an account that should have been closed months earlier, not a clever attack, which is also the pattern behind most AML control failures.
Finally, decide the answer to the question you will be asked in a support ticket at some point: a client in a localisation jurisdiction asks for their file to be deleted, and your record keeping rule says you must retain the trade log for five years. Write the answer now, in a policy, in plain language. Deciding it live, in a chat window, is how firms end up saying something they cannot defend.
"Pick your storage region before you sign the CRM contract, not after the regulator asks. Moving a live database across borders takes weeks and everyone hates it."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- Two rulebooks apply at once: privacy law governs who may reach client data, financial regulation governs whether the supervisor can obtain records on demand.
- Remote access counts as a cross-border transfer, so a support contractor logging into a European database from abroad needs the same paperwork as a copy.
- Ask every vendor three questions in writing: primary region, backup region, and which staff or subprocessors can read production data.
- Keep a one-page data map and an access list. They are what regulators actually ask for, and they take a day to build before launch.
Frequently Asked Questions
Does data residency mean my servers must be in the country where my clients live?
Usually no. Most regimes allow storage abroad provided a valid transfer mechanism is in place and the regulator can obtain records on request. A minority of jurisdictions impose hard localisation on financial or payment data, so check the specific licence conditions before entering a market.
How long must a trading firm keep client records?
It depends on the regime, but five years from the end of the relationship is a common floor for order and transaction records, and some rules extend beyond that. Retention obligations generally override a client deletion request for the records covered, so the policy should say which records are kept and why.
Is a cloud provider with a European region enough for compliance?
It is a good start and it is not the whole answer. Backups, disaster recovery regions and vendor support access all need to be checked, along with a signed data processing agreement. A European primary with backups elsewhere is still a transfer.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.