AML Record Keeping: What to Keep, for How Long, and How to Prove It to an Auditor

Record keeping is the least glamorous part of an AML program, and one of the most consequential. If you can't produce a record, you can't prove that a check was done. To a supervisor, an auditor or a court, an undocumented control is the same as a missing one.

This guide covers what AML records you need to keep, for how long, how to keep them so they stand up to scrutiny, and how to balance retention with data protection.

What the international standard requires

FATF Recommendation 11 sets the baseline that national laws build on. Firms should keep:

• Transaction records — all necessary records on transactions, both domestic and international, for at least five years following completion of the transaction. They must be sufficient to permit reconstruction of individual transactions, including amounts and currencies, so they can provide evidence for prosecution if needed.
• Customer due diligence records — records obtained through CDD, such as copies of identification documents, account files and business correspondence, including the results of any analysis undertaken, for at least five years after the business relationship has ended or after the date of an occasional transaction.

Records must also be available swiftly to competent authorities when they ask for them.

National laws generally follow this five-year minimum, though details differ: when the clock starts, whether longer periods apply in certain cases, and whether records must be deleted at the end of the period.

What to keep

The FATF categories above are the minimum. In practice, a supervisor reviewing your program will expect to see records of every part of it.

Customer records

• Identification and verification documents and data, for the customer and beneficial owners
• Ownership and control structure charts for legal entities
• Information on the purpose and intended nature of the relationship
• The customer risk assessment and rating, and the reasoning behind it
• Enhanced due diligence evidence: source of funds and wealth, senior management approvals
• Screening results and how matches were resolved
• Periodic and trigger-based reviews and their outcomes
• Decisions to decline or exit a relationship, and why

Transaction and monitoring records

• Transaction details sufficient to reconstruct each transaction
• Monitoring alerts, investigations and their outcomes, including alerts closed as false positives and the rationale

Reporting records

• Internal suspicious activity reports raised by staff
• The compliance officer's analysis and decision on each one — including decisions not to report externally
• External reports made to the financial intelligence unit, and any correspondence

These records are highly sensitive. Restrict access to them and keep them separate from customer files to reduce the risk of tipping off.

Program records

• Each version of the business-wide risk assessment and its approval
• Each version of your policies and procedures, with approval records
• Training materials, attendance and assessment results per employee
• MLRO annual reports and board minutes showing they were discussed
• Independent audit reports and remediation tracking
• Correspondence with supervisors

How long to keep it

Record type	International minimum (FATF)	When the period starts
Customer due diligence	5 years	End of the business relationship, or the date of the occasional transaction
Transactions	5 years	Completion of the transaction

Some points to check in your own regime:

• Longer periods. Some countries set longer periods, allow authorities to require longer retention in specific cases (for example, ongoing investigations), or apply longer periods under other laws such as tax or company law. Where several rules apply, the longest usually wins.
• Program records. Most laws don't set a specific period for policies or risk assessments, but you will need older versions to show what your controls were at the time of a past transaction. Keeping them for at least as long as the related customer records is sensible.
• Group firms. If you operate in several countries, map the requirement in each and decide whether to apply a single group-wide standard.

Retention and data protection

AML records contain a large amount of personal data, and keeping them longer than necessary has its own legal risk. In the EU and UK, for example, AML laws require personal data to be deleted at the end of the retention period unless another legal basis applies, and data protection law requires that it's used only for AML purposes.

A practical approach:

1. Document a retention schedule that maps each record type to its retention period and legal basis.
2. Track the trigger date — usually the end of the relationship — for each customer, so you know when the clock started.
3. Run periodic disposal reviews to identify records past their retention date, check for any legal hold, and delete or anonymise them.
4. Record the disposal, so you can show records were deleted in line with your policy.

Making records audit-ready

A record that exists but can't be found, trusted or understood isn't much better than no record at all.

• Centralise. Keep customer and program records in defined systems, not scattered across email and shared drives.
• Make them retrievable. Be able to produce a full customer file, or every record for a given transaction, quickly.
• Make them tamper-evident. Use systems that log who created or changed a record and when. Supervisors give more weight to records with an audit trail.
• Record decisions, not just documents. The rationale for closing an alert, rating a customer or not filing a report is often what the supervisor wants to see.
• Tie evidence to deadlines. Recurring obligations — annual reviews, training rounds, audits — should have evidence attached to each occurrence, so you can show not just that something was done, but when. Regmindr's AML compliance checklist is one example of how to attach proof to each recurring AML task.

Key takeaways

• FATF sets a minimum of five years for CDD records (after the relationship ends) and transaction records (after completion).
• Keep records of every part of the program, including decisions and their rationale.
• Check national rules for longer periods, and keep a documented retention schedule.
• Delete personal data at the end of the retention period where the law requires it, and record the disposal.
• Records should be centralised, retrievable, tamper-evident and tied to the obligations they evidence.

Good record keeping is easier when your program lives in one place. Regpin helps compliance teams keep risk assessments, customer risk ratings and program records together, with a clear history of what changed and when. Book a demo to learn more.

---

This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.