AML Record Keeping

It covers the evidence a firm gathered on a client and the reasoning it applied. Article 77(1) of the Anti-Money Laundering Regulation (AMLR) lists four kinds of record, and Article 21(3) adds a fifth. The table shows each one with its retention period.

The records listed in Article 77 must not be redacted. The duty also reaches clients the firm never took on. The record of actions and decisions is kept where the firm refused a relationship, ended one or applied alternative measures.

The period is 5 years for the records listed in Article 77. Under Article 77(3) the period starts on one of three dates: the end of the business relationship, the date of an occasional transaction, or the date the firm refused to enter into a relationship or carry out a transaction. For a client of 20 years, the identification documents collected at the start are kept for the whole relationship and 5 years beyond it.

Article 21(3) sets no period of its own for the record of actions and decisions. A firm must be able to show its supervisor at all times that its measures are appropriate (Article 20(4)), so it makes sense to keep that record with the due diligence file for the same period.

A competent authority may require further retention case by case, where that is necessary for the prevention, detection, investigation or prosecution of money laundering or terrorist financing. The extension cannot exceed 5 more years.

A transitional rule covers pending cases. Where legal proceedings on suspected money laundering or terrorist financing are pending in a member state on 10 July 2027, a firm holding information that relates to them may retain it for 5 years from that date. Member states may allow or require a further 5 years where necessity and proportionality have been established (Article 77(4)).

Other laws can require longer. The 5-year rule is without prejudice to retention periods set by other EU acts or by national law that complies with the GDPR. Tax, accounting and professional rules set their own periods, which differ by country.

When the 5-year period expires. Article 77(3) requires the firm to delete the personal data in the records listed in Article 77, unless another EU act or national law sets a retention period for it, or a competent authority has required further retention. The period is a minimum for anti-money laundering purposes and a limit for privacy.

Personal data may be kept in a form that permits identification for no longer than is necessary for the purposes of the processing (Article 5(1)(e) of the GDPR). Once the anti-money laundering period and any other legal period have run, a firm that still holds passport copies has no purpose left to point to.

During the period, a client cannot have the file erased on request. The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation under EU or member state law (Article 17(3)(b) of the GDPR).

The clock starts when the relationship ends, so the firm has to record that date for each client.

The records may be used to prevent money laundering and terrorist financing, and for nothing incompatible with that. Article 76(4) of the AMLR also prohibits processing the data for commercial purposes.

A firm may process special categories of personal data and data on criminal convictions only to the extent strictly necessary (Article 76(1)). It must tell customers that such data may be processed. The data must come from reliable sources and be accurate and up to date. The firm must not take decisions that lead to biased and discriminatory outcomes. It must apply a high level of security, in particular for confidentiality (Article 76(2)).

Criminal data must relate to money laundering, its predicate offences or terrorist financing. The firm needs procedures that distinguish allegations, investigations, proceedings and convictions (Article 76(3)).

The AMLR does not prescribe a format. It sets conditions on completeness and speed.

A firm may keep a reference to information in place of a copy. It can do so only if it can provide the information to competent authorities immediately and the information cannot be modified or altered. Its internal procedures must name the categories concerned and the way the information is retrieved (Article 77(2)).

The records must be quick to search. Article 78 requires systems that let the firm respond fully and speedily to enquiries from its financial intelligence unit (FIU) or other competent authorities. The enquiry is whether the firm has, or had in the previous 5 years, a business relationship with specified persons, and what kind.

Requests from the FIU carry a deadline. A firm must reply within 5 working days, and the FIU may shorten that in justified and urgent cases, including to less than 24 hours (Article 69(1)).