Back to home

Document Version Control for UK Mortgage Brokers

By Casefile

Document Version Control for UK Mortgage Brokers

Document version control is the practice of tracking every version of a document so you can show which one is current, which was approved, who changed it and when. For a UK mortgage broker the term covers two jobs: controlling your own internal files, such as fact-finds, suitability records and checklists, and controlling the evidence clients send you, such as bank statements, payslips and tax forms. This guide covers both, with the rules that apply, a naming and numbering scheme you can adopt today, and the checks that catch a client file that has been edited after the fact.

TL;DR

  • Version control separates drafts from approved documents and keeps an audit trail of each change, so you can prove which version was in force at any date.
  • FCA record-keeping rules in MCOB set minimum retention periods, with three years common for advice records. Many firms keep records longer to answer complaints.
  • The same discipline supports GDPR storage limitation: keep the final record, securely delete superseded drafts you no longer need.
  • For client evidence, version control also means comparing uploads against each other and against the stated income, and flagging edited or mismatched files before the lender sees them.
  • A simple naming convention and a v0.x / v1.0 numbering scheme remove most version errors without new software.

Table of Contents

What document version control means in a brokerage

The ICO's own version and document control policy describes the core idea plainly: differentiate drafts from final versions, track significant changes and maintain an audit trail. The aim is that only the latest approved version is used, which reduces duplication, errors and confusion.

In a brokerage that idea splits into three document families:

  1. Firm-owned documents. Client agreements, fact-find templates, suitability report templates, compliance checklists and procedures. You write these, so you control the versions.
  2. Case documents you produce. Suitability reports, illustrations, key facts and file notes. These are created per client and may be revised as the case changes.
  3. Client evidence. Bank statements, payslips, P60s, SA302s, tax year overviews, ID and proof of address. You do not write these, so you cannot number them yourself. You can only control how they are received, stored, compared and approved.

Most generic guides on this topic cover only the first family and focus on Word, Google Docs or shared drives. Broker risk sits mainly in the second and third.

Why it matters: regulation, complaints and insurance

Version control is not an organisational nicety. It is how you demonstrate accountability. An audit trail that shows how a document was created and authorised lets you prove which version applied at a given time, which is the question a regulatory review or a complaint will ask.

FCA record retention

The FCA Handbook, MCOB Schedule 1 sets out record-keeping requirements by subject, with the content of each record, when it must be made and how long it is kept. Retention differs by record type. Many advice-related records carry a three-year minimum, some items such as offer documents carry shorter periods, and some, such as affordability records for sale and rent back agreements, carry five years. Check the schedule for each record type you hold rather than applying one period to a whole file.

Mortgage record retention periods vary by record type

The practical point for version control is that a retention period applies to a record, and a record may exist in several versions. If a suitability report was revised after a change in the applicant's income, you need to know which version the client received and which one you relied on. Keeping the superseded draft may be right in some cases and wrong in others, which is why the policy has to say so explicitly.

Complaints and indemnity

Firms often keep records beyond the regulatory minimum. The FCA's questions and answers from its mortgage market review roadshows explain that this supports potential complaints or claims to the Financial Ombudsman Service. They also note that failing to hold adequate records can lead to indemnity insurers declining claims, because the broker cannot show the advice was suitable. If you cannot show which version of a document you relied on, you weaken your own defence.

Consumer Duty and digital competence

The occupational standard for the level 3 mortgage adviser includes a duty to accurately update and maintain customer information on digital systems while keeping to data protection and confidentiality requirements. Accurate, versioned customer data is part of treating customers fairly, not a back-office extra.

Version control and GDPR: keep the final, delete the drafts

Version control is often described as keeping everything. For personal data, the opposite also applies. The ICO's retention guidance in its records management toolkit flags the risk of information being held for the wrong period when processing changes and the retention schedule is not updated.

In practice, once a document reaches its approved state and has served its regulatory purpose, working drafts should be securely deleted unless you have a reason to keep them. Holding obsolete drafts containing names, addresses and financial details increases the data you hold and the impact if a breach occurs. Distinguishing "final" from "working" is what makes safe deletion possible.

A workable rule for a brokerage:

  • Label every file as working or final in its name or metadata.
  • Record the retention trigger and period for each document type in one schedule.
  • Review the schedule regularly and whenever you change how you process a type of data.
  • Delete superseded working versions on a defined cycle, and log the deletion.
  • Where retention rules differ between versions of one document, keep each version for its own period.

This also applies to client uploads. If a client sends three versions of a payslip because the first was cropped, you need a rule on which is retained as evidence and what happens to the others.

A naming and numbering scheme that works

You do not need a document management suite to get 80% of the benefit. Two conventions do most of the work.

File names

HMRC publishes its naming convention principles for electronic records in an internal manual. The recommended order is date in YYMMDD, customer name, document name, author initials and version number, separated by spaces rather than underscores for readability and file-system compatibility. Adapted for a brokerage, a file might read:

260312 Patel Payslip March JS v1.0

Starting with the date means a folder sorts chronologically. Putting the version last keeps the descriptive part of the name stable between revisions.

Version numbers

The same HMRC guidance distinguishes internal drafts (v0.1, v0.2) from final or approved versions (v1.0, v2.0). A minor amendment to a finalised document increments only the decimal, such as v1.1, so v1.0 stays identifiable as the approved baseline. For a brokerage this gives a clear language:

VersionMeaningTypical example
v0.1, v0.2Internal working draftSuitability report being written
v1.0Approved and issuedReport signed off and sent to the client
v1.1Minor amendment to an approved documentCorrected typo in a figure label
v2.0New approved version after a material changeReport reissued after a change in income or product

Write the rule down once, train everyone on it and check a sample of files each quarter.

Comparing document versions

Readers ask how to compare two versions of the same document. For text documents you author, the built-in compare and version history features in word processors show insertions and deletions, and a change log within the document should record who approved each version and why. Three habits make comparison meaningful:

  1. Keep a short change note on every new version, stating what changed and why.
  2. Never overwrite an approved version. Save the new one with a new number.
  3. Compare against the approved baseline, not against the last draft, when you need to know what changed since sign-off.

For client evidence the comparison is different. You are not comparing your own drafts, you are comparing a document with other documents and with what the client has told you. The next section covers this.

Version control for client evidence: spotting edited files

A client who uploads a bank statement, then a second statement for the same month, has created two versions of the same evidence. Usually that is innocent: the first upload was a screenshot, or a page was missing. Occasionally the second differs because something was changed. Treat any duplicate or replaced upload as an event to log and check.

Useful checks for edited documents:

  • Arithmetic and continuity. Opening and closing balances should reconcile with the listed transactions, and each statement should start where the previous one ended.
  • Wage matching. The net pay on the payslip should appear as a deposit of the same amount, from the employer, in the bank statement for that period.
  • Consistency across documents. Name, address, employer and account details should match across statements, payslips, tax documents, ID and utility bills.
  • Declared versus visible commitments. Regular payments to lenders or finance providers that the client did not declare on the application need a conversation before submission.
  • File properties. Documents that look edited, or whose creation details do not fit what they claim to be, deserve a closer look and, where doubt remains, a request for a fresh copy direct from the source.
  • Tax documents. Figures on a tax calculation should agree with the overview for the same year. Our guide to tax return verification for mortgage brokers walks through that comparison.

None of these checks proves fraud on its own. They tell you where to ask a question. A mismatch might be a timing difference, a second job or a refund. The broker's job is to resolve it before the lender finds it, and to record the resolution.

Why manual checking breaks down

Checking this by eye across many cases is slow, and it gets worse when a file arrives in several versions through email, messaging apps and portals. The failure modes are familiar: the wrong version is forwarded to the lender, an old payslip is mistaken for the current one, or a note about a discrepancy sits in one adviser's inbox. A single place where each upload is logged, compared and approved removes most of these.

Perspective: how we think about version control

We build Casefile for UK mortgage brokerages, and we see the same pattern in document handling. Brokers rarely lose control of their own templates. They lose control of client evidence: several uploads of the same document, no record of which one was approved, and no trace of why a discrepancy was dismissed.

Perspective: how we think about version control — overview diagram

Our view is that version control for a broker means three things. First, every client document is received into one place, with the document list built from the client's payment type so that nothing is requested twice or forgotten. Second, each document is cross-checked against the others, so a wage deposit that does not match a payslip, or a commitment that was not declared, is flagged before a lender raises it. Third, every approval leaves an audit trail that a reviewer can follow. We describe the approval side in more detail in Document Approval Workflow: 5 Controls Auditors Can Trace.

We also hold that access is part of version control. If anyone can replace or approve a document, the audit trail means little. That is why we argue for permissions based on tasks rather than job titles, covered in Role Based Access Control for UK Brokers: Tasks Beat Titles. And because client documents are personal data, we keep data handling in the UK and out of manual or offshore processing.

— Darren

Five controls to put in place this quarter

  1. Write a one-page version policy. Define working, final, superseded and deleted, and the numbering scheme.
  2. Adopt one file-naming convention and apply it to firm documents and stored case files.
  3. Log every replaced client upload, with the reason and which version was kept.
  4. Cross-check evidence at intake, not at submission: wage deposits against payslips, commitments against the declaration, identity details across documents.
  5. Set retention by record type using MCOB Schedule 1, review the schedule regularly and delete superseded drafts on a cycle.

If you are also looking at automation upstream of these controls, the steps are laid out in Mortgage Document Automation: 5 Steps From MISMO to DU for Brokers. Note that the MISMO and DU references there relate to US standards, so apply them with care to UK cases.

Where Casefile fits

Casefile is a cloud-based platform for UK mortgage brokers that automates the collection and review of client documents. It builds the document list from the client's payment type, cross-checks bank statements, payslips, tax forms, ID and utility bills, flags discrepancies and undeclared commitments, matches wage deposits, checks for tampering, and manages the approval queue. It carries your own branding, supports multiple applicant types and keeps data in the UK. You can see how documents are handled on the data security page, or start from the Casefile homepage.

FAQ

What are the three types of version control?

The usual split is local (copies kept on one machine), centralised (one shared repository everyone works from) and distributed (each user holds a full history). These terms come from software development. In a brokerage the practical equivalent is a single central location for case documents with locked approved versions, which is closest to the centralised model.

How long must a mortgage broker keep records?

It depends on the record. MCOB Schedule 1 lists retention periods by record type, with three years common for advice-related records, shorter for some offer documents and five years for some others. Many firms keep records longer to deal with complaints. Confirm the period for each record type with your compliance lead or network.

Should I keep every draft of a document?

Not by default. Keep the approved version and any drafts you need for a specific purpose, such as showing why a decision changed. Delete other working versions securely, because holding unneeded personal data conflicts with GDPR storage limitation. Record the rule in your retention schedule.

How do I version control a Word document?

Save each approved issue under a new version number, keep a change note at the top or in a log, and never overwrite the approved file. Use the built-in version history and compare features to review changes. Restrict who can edit approved versions, so the saved history stays trustworthy.

How can I tell whether a client's PDF has been edited?

Start with content checks: reconcile balances, match wage deposits to payslips and compare details across documents. Look for inconsistencies in the file itself, and ask for a fresh copy from the bank or employer when doubt remains. A mismatch is a reason to ask a question, not proof of fraud.

Sources

This article was generated with AI, and whilst it is our expectation that the article is accurate, it should not be taken as advice.