Why version-dependent on-prem recording platforms increase regulatory and outsourcing risk

A new, potentially high-impact problem

For sure, unlike ESMA/MiFID, DORA is not about market conduct but about operational resilience. One of the areas that falls under its remit is the operational risk you run when you outsource an IT service: in effect, you’re no longer in full control of that, so what happens if your partner has an issue or there is some other disruption to your continuity?

Would it surprise you to know that many recording platforms effectively operate as an outsourced service?

But even if everything runs 100% smoothly all the time, that still means operational control is based on:

• Vendor-defined release schedules—not yours
• Certified upgrade paths
• End-of-life decisions outside your CIO’s and compliance team’s control.

Many of even the biggest and most successful financial institutions continue to rely on traditional on-prem recording platforms that also fall under this definition.

After all, they are all tightly coupled to vendor-specific software versions, certification matrices and upgrade cycles.

This is especially true if you’re working with a legacy/on-prem platform. Despite the infrastructure being physically hosted within your four walls as an enterprise, you are dependent on the supplier and maintainer of this software in a way that makes it functionally an outsourcing agreement.

Has a sudden new call recording vulnerability just opened?

Yes—as without really being aware of it, you may well be operating with a hidden form of ICT outsourcing and concentration risk. When any ICT services are outsourced, the financial entity retains full responsibility for compliance with DORA, and outsourcing does not reduce your company’s regulatory accountability.

To see just how extensively, we just need to quote directly from DORA Article 28:

“Financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law”

So, now is the time to review the situation and see what you may need to mitigate the situation and protect yourselves.

Version-dependent on-prem recording now equals ICT outsourcing!

We’ve only mentioned DORA so far—but there are actually a number of other, non-MiFID II or MAR (Market Abuse Regulations) compliance laws that impinge on your call recording process here.

You may well already know that voice recording is a mandatory regulatory control under MiFID II and MAR—it’s deemed to be a “critical or important function” under these rules.

Why: it is a foundational evidence mechanism during supervisory reviews, investigations and enforcement actions, especially in the context of market abuse detection and investigation and therefore needs high auditability and supervisory access levels of visibility.

As a direct result, your recording solution falls squarely within the scope of DORA Article 28 but also other new ICT outsourcing regulations.

Here, the EBA/ESMA outsourcing frameworks are the most critical.

EBA is the European Banking Authority, whose guidance on best practice outsourcing is here, while the European Securities and Markets Authority’s (ESMA) parallel rules are here. Again, we can quote directly from the latter to underline the risk:

“The administrator takes appropriate action if it appears that the service provider may not be carrying out the outsourced functions effectively and in compliance with applicable law and regulatory requirements”

In essence, these tell us that institutions seeking the convenience of outsourcing need to:

• Identify outsourced critical functions
• Perform adequate pre-outsourcing risk assessments
• Ensure operational continuity and exit options
• Maintain effective access, audit and inspection rights

Outsourcing risk under DORA Article 28

So far, then, we have learnt that under DORA Article 28, financial institutions are obliged to manage all potential ICT outsourcing risk for critical functions – including risk assessment, contractual safeguards, exit strategies, and ongoing oversight.

We have also seen that other regulations from important EU financial services oversight entities like ESMA also think outsourcing is potentially risky and needs to be very tightly controlled and overseen.

But why is your old on-prem call recording stack now an issue? It’s because version-dependent, on-prem recording platforms have several inherent outsourcing-like issues:

• Proprietary data formats and compliance logic, limited substitutability
• High switching costs and complex migration of historical recordings
• High (unacceptable?) dependence on vendor support timelines concentration risk when a single vendor controls capture, storage and replay.

Alignment with EBA and ESMA Outsourcing Guidelines

That would be bad enough on its own, but under the latest EBA and ESMA risk management guidance on how to protect yourself in the context of an outsourcing arrangement for an important financial back-office process, you always need to be able to:

• Identify outsourced critical functions
• Perform pre-outsourcing risk assessments
• Ensure operational continuity and exit options
• Maintain effective access, audit and inspection rights.

Bottom line: you’re really going to struggle to satisfy these requirements with inflexible, old style, on-prem recording platforms.

Why: they require frequent upgrades and vendor intervention, particularly in anything to do with exit readiness (‘If we needed to move, how quickly could we?’), and continuity of regulatory evidence.

So, what should you look for in an alternative?

Why Touch Call Recording Service reduces outsourcing risk

 A recording architecture that minimises outsourcing risk needs to address three key areas. Here’s what that looks like in practice:

• High vendor lock-in and limited exit feasibility versus vendor-agnostic architecture with portable data
• High operational dependency on vendor lifecycle versus clear separation of recording and communication layers
• Complex access and migration of historical evidence versus centralized, regulator-ready access to recordings.

By decoupling capture and storage from communication platforms and vendor release cycles, Touch Call Recording Service therefore:

• Supports credible and defensible exit strategies
• Enables easy substitutability
• Simplifies outsourcing assessments
• Strengthens audit and supervisory readiness.

Your next call recording outsourcing risk reduction steps

Under the new DORA and the EBA/ESMA outsourcing frameworks, how you choose to do your mandated call recording has stopped being just a technical decision, and is now a compliance one.

Yesterday’s version-dependent on-prem recording create hidden outsourcing, concentration and exit risk that must be formally assessed.

The Touch Call Recording Service provides a resilient, regulator-aligned alternative designed to support long-term compliance and operational confidence—and has reference customers and sites to help crystallize your decision.

Don’t let too much of 2026 go by with any more potential outsourcing call recording dangers building up.

Get in touch today to discuss your specific situation.