What Should a Boutique Bank Do With Deal Data When a Mandate Ends?

1. Define the mandate-end event and the decision owner

Start by recording what actually happened: the mandate closed after a transaction, expired without completion, was withdrawn, or was terminated while a dispute, audit, complaint or regulatory inquiry remains possible. The event affects handover timing, the scope of any hold and the people who may authorize disposition. Do not let a project manager mark a workspace closed simply because a final presentation was delivered.

Name one accountable owner for the disposition decision and one reviewer for legal, compliance or information-security questions. The owner should be able to point to the engagement letter, internal retention schedule and applicable rules. Where the firm is a registered broker-dealer, FINRA says retention varies and firms must adopt policies covering applicable recordkeeping obligations. Its Rule 4511 overview describes a six-year default for certain FINRA books and records with no other specified period, but that is not a universal retention period for every mandate or every firm. [1]

2. Build a complete data inventory before choosing delete or retain

Create an inventory by system and record type, not just by folder name. Include the signed engagement and amendments, conflict checks, diligence files, valuation work, buyer lists, outreach logs, emails, messaging, call notes, presentations, data-room exports, approval records, invoices and complaints. Add local downloads, shared drives, document-management systems, CRM records, collaboration channels, model prompts, uploaded source files, generated outputs, chat histories, embeddings or indexes where applicable, and backup or archive locations.

For each item, record the system of record, owner, client or matter identifier, sensitivity, creation and last-use dates, access group, retention basis, export requirement and disposition status. The AI portion needs special attention because an input may have been copied into a prompt log, retrieval index, evaluation set or vendor workspace. NIST describes AI RMF as a voluntary framework for incorporating trustworthiness considerations into the design, development, use and evaluation of AI systems. Use that as a governance lens, not as a certification or compliance conclusion. [3]

3. Separate required records from reusable relationship knowledge

A closed mandate usually contains several different classes of information. Required books and records, client-owned material, confidential deal analysis, personal information, internal work product and general relationship knowledge should not receive the same treatment. A contact’s public business role and a note that a buyer prefers a particular sector may be useful relationship records, but a client’s non-public financials, deal strategy, identity of a confidential bidder or diligence exception should remain tied to the matter unless an authorized basis allows another use.

Use a two-part test for reuse. First ask whether the item is confidential, restricted by the engagement, subject to a data-use limitation or likely to identify the client or transaction. Then ask whether the proposed reuse has a documented business purpose and an authorized owner. If either answer is unclear, quarantine the item and seek a compliance or legal decision. Do not train a general-purpose workflow on a closed client file merely because the file is convenient or because the information seems commercially useful.

4. Map retention duties without turning one rule into a blanket answer

Retention is a matrix, not a single number. The engagement letter may require return or destruction, while securities rules, tax rules, litigation holds, employment duties, privacy requirements or firm policy may require preservation. The applicable answer depends on the firm’s registration, the record type, the jurisdiction, the event that starts the clock and whether a hold overrides routine disposal. Have qualified counsel or compliance confirm any conclusion that depends on law rather than operational preference.

For a broker-dealer using electronic recordkeeping, the SEC explains that Rule 17a-4 permits either a WORM approach or an audit-trail alternative that preserves a time-stamped history of modifications and deletions and allows recreation of the original record. The SEC also requires prompt production in a reasonably usable electronic format when requested under the rule. [2] This makes format, accessibility and audit evidence part of retention design, not merely storage capacity.

5. Make vendor and AI copies explicit

Send the inventory to every approved service owner and ask concrete questions. Does the provider retain prompts, uploaded files, outputs, logs, telemetry, indexes, support copies or derived data? Are those items used for service improvement or model training? What deletion scope is available? What happens to backups, legal holds, disaster-recovery replicas and derived data? Can the firm independently export records, or must it ask the provider to intervene? Record the provider’s answer, contract version and the person who assessed it.

The SEC’s electronic-recordkeeping guidance illustrates why third-party control matters: certain cloud arrangements require the broker-dealer to have independent access and require the provider to facilitate examination, access, download or transfer. [2] That does not mean every AI vendor is subject to Rule 17a-4. It does mean a firm should not assume that a workspace closure, account deletion or vendor ticket proves that all regulated or confidential copies are gone.

6. Use an owner-approved export, restriction and deletion checklist

Turn the decision into a checklist with a status for each system and record class. The owner should approve: retain in the source system, export to an approved archive, return to the client, restrict access, anonymize for a defined use, or delete. The checklist should identify the approved destination, file format, access controls, reviewer, completion date and exception reason. Preserve the decision record separately from the material being disposed of so the firm can show what it decided without keeping unnecessary client content.

A useful export test is to open a sample from the delivered package, compare item counts and key metadata with the inventory, check permissions and confirm that links do not point back to a disabled workspace. A useful deletion test is to inspect the system’s completion record, search for known identifiers in the locations it exposes, and obtain a vendor confirmation where the contract or system requires one. Treat inaccessible backups or immutable regulatory archives as documented exceptions, not as silently completed deletion.

7. Put human review and stopping conditions around AI-assisted work

AI can help classify records, find duplicate matter identifiers or draft an inventory, but a named human should review each disposition recommendation. The reviewer checks the source-of-truth record, sensitivity label, applicable hold, owner approval and vendor result. The AI should not send notices, approve retention, disclose a file, contact a buyer or negotiate with a provider. Keep the task narrow: identify candidate records and missing evidence, then route the decision to the accountable owner.

Run a limited pilot on non-client or already-approved sample material before processing a live closed matter. Stop the pilot if the tool invents locations, misses known copies, exposes restricted text, cannot reproduce its result or cannot preserve an understandable review trail. Compare findings with a human-built sample and record false positives and false negatives. Do not describe the output as complete, accurate, privileged, secure or compliant without separate evidence.

8. Close the mandate with a reviewable evidence pack

The final pack should contain the mandate-end date and reason, inventory version, retention decisions, hold exceptions, export manifest, deletion or restriction evidence, vendor responses, access changes, unresolved items and owner sign-off. Include enough identifiers to reproduce the check without copying the underlying confidential material into the review note. Schedule a later review for temporary holds, expiring retention periods and vendor actions that were pending at closure.

For lawyer-led work, professional obligations can add another boundary. ABA Model Rule 1.6 states that lawyers generally must not reveal information relating to a representation without consent, implied authorization or a permitted exception, and must make reasonable efforts to prevent unauthorized disclosure or access. [4] Model Rule 1.16 addresses termination and says lawyers should take reasonably practicable steps to protect the client’s interests, including surrendering papers and property to which the client is entitled, while retention remains subject to other law. [5] These are model rules, not a universal rule for every bank. Obtain jurisdiction-specific advice before applying them to a particular file.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. In a user-operated workflow, the platform can be treated as one inventory location among others, while the bank’s authorized owners remain responsible for deciding what may be retained, exported, restricted or deleted.