Record Keeping: What to Store and For How Long
Under the AML/CTF Act (see Sections 104, 111 and 116), you must keep AML/CTF records for 7 years. This is not optional. Poor record keeping can result in penalties and inability to demonstrate compliance during an AUSTRAC audit.
The 7-year rule
All AML/CTF records must be retained for a minimum of 7 years from the date:
- The record was made (for transaction records)
- The business relationship ended (for CDD records)
- The document was created (for program documents)
When the 7 years starts
For ongoing client relationships, the 7-year period starts when the relationship ends. If a client engaged you in 2026 and you complete work in 2030, you must keep their records until at least 2037.
What records to keep
Customer identification records
- ID documents collected (passport, licence copies)
- Verification records (how you verified identity)
- Beneficial ownership information and documentation
- PEP screening results
- Risk assessments for each client
Transaction records
- Details of designated services provided
- Transaction amounts, dates and parties
- Source of funds documentation
- Any cash transactions
Program and compliance records
- Your AML/CTF program (all versions)
- Risk assessments (business-wide and client-specific)
- Staff training records and attendance
- Independent review reports
- SMR and TTR filing confirmations
Acceptable formats
Records can be kept in:
- Physical format: Original documents, photocopies in secure storage
- Electronic format: Scanned copies, digital records in secure systems
- Combination: Mix of physical and electronic as appropriate
Format requirements
Records must be readily accessible and able to be provided to AUSTRAC within a reasonable time if requested. "Readily accessible" means you can locate and produce them - not buried in unmarked boxes.
Destruction of records
After the 7-year retention period, you may destroy records. Consider:
- Secure destruction: Shred physical documents, securely delete electronic files
- Document the destruction: Keep a log of what was destroyed and when
- Check other obligations: Other laws may require longer retention (e.g. tax records)
Warning: Do not destroy early
Destroying records before the 7-year period expires is an offence. If AUSTRAC requests records and you have destroyed them early, you face civil penalties.
Key Takeaway
Keep all AML/CTF records for at least 7 years from when the relationship ended or the record was made. Include CDD documents, transaction records and program documents. Store in accessible format and destroy securely after the retention period.
Read our complete Tranche 2 Guide
Key dates, affected sectors, obligations and how to prepare
Disclaimer: This article is general information only. It is not legal, financial or compliance advice. HeadStart Docs™ provides free compliance documents, not legal services.
We do not guarantee the accuracy of information provided. Obligations may apply depending on your designated services. Always confirm your specific requirements with a qualified adviser.
Need a lawyer to review your AML/CTF program? HeadStart Counsel offers fixed-fee tailoring from $1,800+GST. Separate entity and engagement.