--- title: "ESMA Q&A 2791 — Q&A — Records / audit trail / digital workflows / use [Question Rejected]" shortTitle: "ESMA Q&A 2791 — Q&A — Records / audit trail / digital workflows / use [Question Rejected]" answer_id: ESMA_QA_2791 topic: "Suitability" status: "Question Rejected" type: qa instrument_type: qa authority: ESMA binding: false binding_character: non_binding legal_status: withdrawn regulation: "MiFID II" mifid_level3: true mica_level2: false legal_basis: "ESMA Guidelines ESMA/2015/1886 (rev.), paras. 4(j), 19, 20(c)-(g); MiFID II (Directive 2014/65/EU), Art. 16(2) and 16(6), Art. 25(1), Art. 25(2), 25(6) and 25(9); Commission Delegated Regulation (EU) 2017/565, Art. 54 and Art. 72." date: 26 February 2026 source_link: https://www.esma.europa.eu/publications-data/questions-answers/2791 lifecycle: "Question Rejected" text_version: "ESMA Q&A register, 26 February 2026" source_url: "https://www.esma.europa.eu/publications-data/questions-answers/2791" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the ESMA publication" source: prepared_by: "not stated in the document" published_by: "ESMA" published_in: "ESMA Q&A tool" evidence: prepared_by: "ESMA_QA_2791" locator: "ESMA Q&A entry ESMA_QA_2791: no answer; no author named" document_type: "qa_question" legal_nature: "not_legislation" addressees: "not stated in the document" dates: question_submitted_on: "2026-02-26" locators: question_submitted_on: "ESMA Q&A Excel export ESMA_QA_2791, column 'Date of submission'" lifecycle_label: "Question Rejected" --- **Question published in the ESMA Q&A tool · no answer · not legislation [Question Rejected]** *Question Rejected · ESMA Q&A register, 26 February 2026 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2791)* | | | |---|---| | **Full title** | ESMA Q&A 2791 — Q&A — Records / audit trail / digital workflows / use \[Question Rejected\] | | **Prepared by** | Not stated in the document | | **Published by** | ESMA, in the ESMA Q&A tool | | **Reference** | ESMA_QA_2791 | | **Document type** | Q&A | | **Legal nature** | No answer · not legislation | | **Addressees** | Not stated in the document | | **Dates** | Question submitted 26 February 2026 | | **Legal basis** | ESMA Guidelines ESMA/2015/1886 (rev.), paras. 4(j), 19, 20(c)-(g); MiFID II (Directive 2014/65/EU), Art. 16(2) and 16(6), Art. 25(1), Art. 25(2), 25(6) and 25(9); Commission Delegated Regulation (EU) 2017/565, Art. 54 and Art. 72. | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the ESMA publication | **Records / audit trail / digital workflows / use of user credentials / Record-keeping and audit trail for “under supervision” in digital/segregated advisory workflows** ### Question I would like to request a general clarification on the interpretation of the ESMA Guidelines ESMA/2015/1886 (rev.) regarding record-keeping requirements for “under supervision” (in particular paragraphs 19, 20(c) and 20(g)). In practice, client communication, suitability documentation and system completion are often performed in a segregated and digital manner (e.g. different staff members involved in the client interaction, documentation and approval). This raises, in particular, the following questions: 1. Minimum requirements for records / traceability What minimum requirements arise from the Guidelines regarding records to enable the competent authority to verify that supervision actually takes place and is carried out to an appropriate extent? 2. Objective evidence of assumption of responsibility Is the mere formal naming of a qualified person in the documentation (e.g. in the suitability statement) sufficient, or do the Guidelines expect objectively verifiable review/approval/sign-off evidence? 3. Digital processes / segregated documentation What requirements apply in digital systems and segregated documentation workflows where client communication, suitability documentation and system completion are not carried out by the same person? 4. Use of user credentials / role awareness How should “under supervision” be assessed under the Guidelines if user credentials of a qualified person are used for system documentation/system completion, but that person does not provide a conscious assumption of responsibility (review/approval/sign-off) or is not aware that they are intended to act as the supervisor? *** **Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2791)