RIS Marketing Records: The Rule That Breaks Paid Media

To see the cost of running this properly, use the calculator, or start a conversation.

Notes from a European Operator

The Retail Investment Strategy is being read as an inducements story. The clause that reaches a marketing team first is a record-keeping rule, and it collides with the way paid media gets assembled. How AI actually answers buyers is now the first step in any funnel.

This is part of the EU AI Act marketing compliance guide.

Victor Roodhorst20 July 20268 min read

What the platform keeps 1 year. DSA Article 39 ad repository window.

What the rule requires Duration of the client relationship. Up to 25 years for a long-term fund investor.

THE RETENTION GAP Bars to scale. Sources: DSA Article 39; RIS amendments to MiFID II Articles 24c and 9(3).

On 18 December 2025 the Council and the Parliament reached provisional agreement on the Retail Investment Strategy. Three weeks later ESMA and the national regulators published a factsheet aimed at finfluencers. Both were covered as investor-protection stories, and almost all of the follow-up commentary went to inducements and value for money, because that is where the money is.

The clause that reaches a marketing team first sits in a different chapter. RIS inserts a new Article 24c into MiFID II on marketing communications and practices, and amends Article 9(3) to require a marketing policy defined, approved and overseen by the management body. Inside that package is a record-keeping obligation: firms must keep records of all marketing communications made accessible to retail clients, including those made by a third party acting on the firm’s behalf, retained for at least the duration of the relationship between the firm and the customer.

I spent several years running a £10M European paid-media operation across regulated markets. From that seat the sentence reads differently. For a large share of modern paid media, the artefact you must retain was never stored anywhere, by anyone, in a form you can retrieve. The platform assembled it at the moment of delivery, served it once, and discarded it.

The obligation is broader than a filing requirement

Four provisions, each landing on a different desk.

Attribution

Article 24c requires marketing communications to be clearly identifiable and correctly attributed to the investment firm on whose behalf they are made. Responsibility for content and for use is divided between manufacturers and distributors, For a European asset manager that means the fund house and the bank, platform or IFA network selling the fund each hold a defined piece.

Ownership at board level

The amended Article 9(3) puts the marketing communications policy in the hands of the management body, and requires an annual report to that body covering use of marketing communications, compliance, irregularities found and proposed fixes. Marketing output becomes a standing board paper, which changes who asks about it and how often.

Retention

Records of all marketing communications provided or made accessible to retail clients, by the firm or by a third party acting on its behalf, kept for at least the duration of the client relationship. There is no cap. A twenty-five-year pension relationship carries a twenty-five-year record.

The third-party perimeter

The agreement makes intermediaries responsible for marketing carried out on their behalf, including through social media, celebrities and other remunerated third parties. The ESMA finfluencer factsheet published in January 2026 is the supervisory signal that arrived first, ahead of the legal text.

The retention gap

Article 39 of the Digital Services Act requires very large online platforms to hold an advertisement in their public repository for as long as it runs and until one year after it was last presented. Meta’s EU ad repository is built to exactly that specification: creative, advertiser, payer, run dates, targeting parameters and aggregate reach per member state, on a rolling twelve-month window.

One year on one side. The duration of the client relationship on the other. Compliance teams reading the RIS text assume the platform archive sits underneath as a fallback. It is a rolling window. Twelve months after the last impression, the platform deletes the row.

The second half of the problem is worse. It concerns whether the record was ever created at all. Dynamic creative optimisation builds the ad a person sees at delivery time, drawing from a pool of assets. A single Meta dynamic creative setup of five images, three videos, five headlines and three body texts can generate up to 270 distinct combinations, and Advantage+ enhancements add further per-placement variants on top of that: reframed aspect ratios, generated backgrounds, relocated text.

The team uploaded sixteen assets. The regulator’s question is about the thing the retail client in Milan actually saw on a Tuesday. Those are not the same object, and only one of them is in your DAM.

I have not seen this detail in a single law firm note on RIS. The people reading the directive do not run media buying, and the people running media buying do not read the directive. My own paid-social work has been written up by Lunio, and no operator I have worked with has been asked to archive a served combination. The capture step does not exist because nothing has required it.

The compliance question is no longer “did we approve this creative”. It is “can we reproduce what a specific retail client was shown, eleven years after the campaign ended, when the agency that ran it no longer exists”.

“A third party acting on its behalf” is a supply chain, not a vendor

For a single-market retail broker the third-party perimeter is an agency and a handful of affiliates. For a European asset manager running multi-market distribution the perimeter is a different shape, and it multiplies by market.

• Local distributors running co-marketing. The bank in Belgium producing its own Dutch and French creative using your fund materials. Manufacturer and distributor now each hold a defined piece of the responsibility.
• Affiliate and referral partners. Creative you did not write, published on inventory you do not control. I have built referral programmes that Buyapowa featured. Partner autonomy over the message is what makes them work commercially and what makes them hard to retain.
• Paid influencers. An Instagram story that expires in twenty-four hours is a marketing communication made accessible to a retail client. Its native lifespan is one day. Its required lifespan may be two decades.
• Local agencies. Retention obligations outlive agency contracts, and the assets usually sit in the agency’s account, not yours.

Multiply the perimeter by the number of markets and the arithmetic gets away from you. The estimator below shows the working.

Six markets, four campaigns a year, a twelve-year relationship and a standard channel mix puts the gap well into six figures. Treat that number as a planning input. It belongs in the launch plan for the next market rather than in a remediation project two years after the rules apply.

There is more time than it feels, and less than you need

The sequence is public. Provisional agreement on 18 December 2025, legal texts finalised through 2026, formal adoption not expected before Q4 2026. Member states then get 24 months to transpose, the rules apply at 30 months, and the PRIIPs changes apply at 18. That puts real application somewhere in 2029.

Four years is comfortable for a policy document and short for a data-retention capability that has to reach into every distributor contract in every market. It is also the same pattern as the AI Act: a deferred deadline is a window with a known closing date. The firms that use it are the ones that treat the requirement as a build rather than a filing.

The cheapest moment to solve this is at market entry, when the distributor contract is still being drafted and the media plan is still a document. Every market you open between now and 2029 without a capture clause is a market you will have to go back and renegotiate. That is the same argument as deciding whether to localise or rebuild before the launch rather than after: the decision is cheap in the plan and expensive in the retrofit.

Frequently asked

What does the Retail Investment Strategy require for marketing communications?

The Retail Investment Strategy inserts a new Article 24c into MiFID II requiring marketing communications to be clearly identifiable and correctly attributed to the investment firm on whose behalf they are made, and splits responsibility for content and use between manufacturers and distributors. An amended Article 9(3) requires firms to hold a marketing communications policy defined, approved and overseen by the management body, with an annual report to that body covering use of marketing communications, compliance, irregularities and proposed fixes. Records must be kept of all marketing communications made available to retail clients, including by a third party acting on the firm's behalf.

How long must firms keep records of marketing communications under RIS?

Records must be retained for at least the duration of the relationship between the investment firm and the customer. For a long-term fund or pension investor that can mean fifteen to twenty-five years, which is far longer than the retention period built into any advertising platform.

How long do platform ad repositories keep EU advertising?

Article 39 of the Digital Services Act requires very large online platforms to keep an ad in their public repository for the period it runs and until one year after it was last presented. Meta's EU ad repository follows that rule. So a platform archive covers roughly one year, while the RIS obligation can run for decades. That difference is the retention gap.

Does RIS apply to influencer and affiliate marketing?

Yes, where those parties act on the firm's behalf. The record-keeping obligation covers marketing communications made by a third party acting on behalf of the investment firm, and the agreement makes firms responsible for marketing carried out via social media, celebrities and other remunerated third parties. ESMA and the national regulators published a finfluencer factsheet in January 2026 setting out disclosure and authorisation expectations, which signals where supervision is heading.

When does the Retail Investment Strategy start applying?

Provisional political agreement was reached on 18 December 2025, with legal texts finalised during 2026 and formal adoption not expected before Q4 2026. Member states then have 24 months to transpose, and the rules apply 30 months after publication in the Official Journal, with the PRIIPs changes applying at 18 months.

Why is dynamic creative a problem for marketing record keeping?

Dynamic creative optimisation assembles the ad a person actually sees at delivery time from a pool of images, videos, headlines and body copy. A single setup of five images, three videos, five headlines and three body texts can produce up to 270 distinct combinations, and automatic enhancements add further per-placement variants. The retainable artefact is therefore not the asset the team uploaded, it is the combination that was served, and most firms have no capture step for that.

Victor Roodhorst runs roodhorst.eu, where he publishes original studies on how European financial services actually markets. Twelve years, five languages, seven EU regulators, retail brokerage and institutional asset management. If you are working this through for a specific market, victor@roodhorst.eu. No form to fill in.

the cross-border fund marketing rules are the distribution side of this rule.