AML/CTF record keeping and Australia's seven-year rules

Classify the record before calculating time

AUSTRAC's overview distinguishes customer due diligence records, transaction records, customer-provided transaction documents and AML/CTF program records. CDD evidence includes information used to identify and verify customers, representatives, beneficial owners and relevant risk or ongoing-review decisions. Transaction records capture the nature and parties sufficiently to reconstruct the activity. Program records include risk assessments, policies, versions, approvals, reviews and evidence showing compliance with Part 1A.

Do not classify only by storage location. A document in a customer folder may evidence both CDD and a transaction, while a screening result can support identification, ongoing CDD and an escalation decision. Build a data inventory that names the business owner, system, record class, trigger event, minimum period, access restrictions and disposal authority. Preserve links between records so an investigator can understand the decision without reconstructing it from unrelated systems.

Use the correct seven-year trigger

AUSTRAC states that CDD records are generally kept for seven years after an occasional transaction is completed or after the business relationship ends. General transaction records are kept for seven years from the day they are created, and transaction documents supplied by a customer are kept for seven years from the day they are provided. Those different clocks matter in a relationship lasting many years: onboarding evidence cannot simply be deleted seven years after collection while it remains part of the current relationship record.

Program records are retained from creation until seven years after the record ceases to be relevant for demonstrating compliance with the AML/CTF program requirement. Superseding a policy does not necessarily make it irrelevant immediately; the old version may explain the controls that applied to a historic customer or report. Record an end-of-relevance decision with reasons, then calculate disposal. Confirm any additional categories and detailed timing against the current Act and Rules rather than treating this summary as exhaustive.

Preserve quality, accessibility and confidentiality

Records must be sufficient to demonstrate what occurred and what the business decided. Capture source, date, version, reviewer, result and any exception. A screenshot without a timestamp or search parameters may be weak evidence; a risk rating without the factors and approval cannot explain the judgement. Where a provider or registry supplies data, preserve enough information to reproduce or understand the result within legal and licensing constraints.

Store records so authorised people can locate them promptly and produce them in English or in a readily accessible and translatable form. Apply least-privilege access, encryption where appropriate, audit logs, resilient backups and controls against alteration. SMR-related material and information that could reveal a report require particularly careful segregation because tipping-off restrictions may apply. Outsourced storage does not transfer the reporting entity's obligation to retain and retrieve evidence.

Coordinate deletion, holds and system change

At the end of the minimum AML period, check for other retention duties, litigation or regulatory holds, active investigations, complaints, insurance needs and professional standards. A seven-year minimum is not an instruction to delete where another lawful reason requires preservation. Conversely, indefinite retention increases privacy, security and discovery risk. Document the lawful basis, review extended holds and dispose securely when all needs have ended.

System migrations are a common failure point. Before decommissioning a CRM, practice platform or screening service, reconcile record counts, metadata, attachments, audit history and relationship end dates. Test retrieval from the archive and preserve vendor certificates or migration logs. Contract terms should address export formats, deletion, subcontractors, data location, breach notification and access after termination. Sampling should include closed customers and superseded program versions, not only current files.

Build an event-based retention schedule

Governance reporting should show records without a valid trigger date, overdue archive actions, failed retrieval tests, unauthorised access and vendor issues. A retention schedule becomes effective only when systems can execute it. If automation is not yet reliable, apply a controlled manual process and prevent premature deletion until the gap is remediated.

• Inventory CDD, transaction, customer-supplied, program, governance, training, screening and reporting records across every system.
• Map each class to the current statutory rule, trigger event, minimum period and any other applicable retention duty.
• Capture relationship end and occasional-transaction completion dates as controlled data rather than free-text notes.
• Apply security, audit, language and retrieval standards according to sensitivity, including strict protection for SMR information.
• Create legal-hold and regulator-request processes that suspend disposal without silently extending every record forever.
• Approve and evidence disposal, then test that linked records and backups follow the authorised outcome.