AML Record Keeping Compared: UK, Ireland, EU and US

Almost every anti-money laundering regime asks firms to keep client and transaction records for five years, but the details differ: when the clock starts, whether it can be extended, and what has to happen to personal data afterwards. This guide compares the rules in the United Kingdom, Ireland, the European Union and the United States, using the legislation itself. If you only practise in one country, our separate guides cover the UK rule under regulation 40 and Irish record keeping under the Criminal Justice Act in more depth.

Please read "What we could not confirm" at the end. We compared the legal texts, not supervisory guidance, and the US rule is written for financial institutions, so we do not say how it applies to accounting firms.

The comparison at a glance

United Kingdom: regulation 40

Regulation 40 requires relevant persons to keep copies of the documents and information obtained to meet customer due diligence requirements, and sufficient supporting records for transactions so that they can be reconstructed. The period is five years. For an occasional transaction, it starts when the person knows or has reasonable grounds to believe the transaction is complete, and for a business relationship, it starts when the relationship ends. Transaction records within a business relationship need not be kept for more than 10 years (regulation 40(4)). When the period ends, personal data obtained for the Regulations must be deleted unless the law requires retention, retention is needed for court proceedings, the data subject consents, or there are reasonable grounds to expect legal proceedings (regulation 40(5)). The legislation site notes later amendments, including crypto-asset provisions inserted on 1 September 2023.

Ireland: section 55

Section 55 requires a designated person to keep records of the procedures applied and information obtained for each customer, originals or copies of the documents used, and the history of services and transactions. The retention period is at least five years, and the start depends on the record: for customer records it is the later of the end of services to the customer or the date of the last transaction, and for a single transaction it is the date it is completed or discontinued. A member of the Garda Síochána of at least Sergeant rank may, after assessing necessity and proportionality, direct in writing that records be kept for up to a further five years. When the periods expire, personal data in records kept solely for this section must be deleted. Failure to comply is an offence, with a fine of up to €5,000 or 12 months' imprisonment on summary conviction, or up to five years' imprisonment on indictment.

European Union: Article 40 and Article 77

Article 40 of Directive (EU) 2015/849 requires obliged entities to retain copies of the documents needed for customer due diligence and the supporting records needed to identify transactions, for five years from the end of the business relationship or the date of an occasional transaction. Member States may allow or require further retention, up to a further five years, after a documented necessity and proportionality assessment. Article 77 of Regulation (EU) 2024/1624 keeps the five-year period but starts it from the end of the business relationship, the occasional transaction, or the refusal to enter into either, and lets competent authorities require further retention for up to five years on a case-by-case basis. Personal data must be deleted when the period expires, subject to retention periods under other EU law or national law that complies with data protection rules.

United States: 31 CFR 1010.430

The Bank Secrecy Act recordkeeping rule says all records required to be retained by the chapter must be retained for five years, and must be filed or stored so that they can be retrieved within a reasonable period of time. The page we read refers to "financial institutions" and does not mention accounting firms, so we cannot say whether an accounting firm is caught by this particular section.

What the comparison tells a practice

Our own observations, not legal advice: the headline period is the same everywhere, so most differences are in the detail. The UK and EU both start the clock at the end of the relationship, Ireland uses record-type triggers, and the UK is the only one of the four where we found a stated ten-year ceiling. A firm with clients in more than one country should keep one retention schedule that uses the longest applicable trigger, and should also build in a deletion step, because the UK, Irish and EU texts all require personal data to be deleted at the end. For the due diligence records themselves, see our KYC and customer due diligence guide, and for structured study see our CPD courses.

Frequently asked questions

Is five years always enough?

Not necessarily. Ireland and the EU allow authorities to require up to five more years, and other laws may require longer retention.

Do records have to be deleted after the period?

The UK, Irish and EU texts we read all require personal data to be deleted when the period ends, subject to exceptions.

Does the US rule apply to accountants?

We could not confirm that from the section we read, which refers to financial institutions.

What we could not confirm

We read the original text of regulation 40 and a point-in-time version dated 1 September 2023, not the latest revised version, so later changes may exist. We read section 55 on the Irish revised acts site, whose consolidation date is not stated. We did not confirm the date from which Regulation (EU) 2024/1624 applies, how the Irish and UK rules will interact with it, or how the US section applies to accounting firms. We did not read supervisory guidance on record keeping. Always check the current text before relying on this comparison.