AML Record Keeping for Accountants: What to Keep and When to Delete

Every AML control you run leaves a trail: identity documents, risk ratings, notes of conversations, monitoring reviews, internal reports. The Money Laundering Regulations 2017 say what you must keep, for how long, and, just as important, when you must delete it. Getting the dates wrong cuts both ways. Delete too early and you cannot prove what you did. Keep personal data too long and you are breaking the regulations as well as data protection expectations. This guide sets out the rules for UK accountancy firms. It builds on our guide to AML policies, controls and procedures.

What you must keep

Regulation 40 and HMRC's guidance for supervised businesses require two core sets of records. First, copies of the documents and information you obtained to meet customer due diligence requirements, including simplified and enhanced due diligence. Second, enough supporting records, originals or copies, for transactions that were subject to due diligence or ongoing monitoring, so that each transaction can be reconstructed.

HMRC's guidance adds other records that evidence compliance with the Regulations:

• Your risk assessment, and your policies, controls and procedures, together with any changes to them.
• Records of actions taken under internal and external reporting, including copies of suspicious activity reports.
• Records of the material your nominated officer considered where no report was made to the NCA.
• Training records.
• Compliance monitoring records, such as reports to senior management and the action taken.

A "copy" for these purposes must be admissible as evidence of the original in court, so a poor-quality scan or a screenshot that cannot be authenticated may not be good enough.

How long to keep it

The general rule is five years. The clock starts at different points depending on the situation:

• Business relationships: five years from the date the relationship ends, for due diligence information and the related transaction records.
• Occasional transactions: five years from when you know, or have reasonable grounds to believe, the transaction is complete.
• Reports: HMRC says records of all internal and external reports should be kept for at least five years from the date of the report.

Regulation 40 also provides that records of individual transactions within a business relationship need not be kept for more than ten years. Note that this applies to transaction records, not to your due diligence file.

When you must delete it

Once the retention period has expired, regulation 40 requires you to delete the personal data you obtained for the purposes of the Regulations. There are three exceptions: you are required to keep it under another enactment or for court proceedings; you have reasonable grounds to believe it needs to be kept for legal proceedings; or the data subject has consented to you keeping it.

That makes a retention schedule more than good housekeeping. It is how you show that you delete data when you should. HMRC's page on record keeping does not explain how these rules interact with the UK GDPR or the Data Protection Act 2018, so check the Information Commissioner's guidance if you hold data for other purposes, such as tax or audit work, which may carry its own retention periods.

Who is responsible when someone else holds the records

If you delegate record keeping to a third party, such as a cloud archive or an outsourced compliance provider, you remain responsible for making sure the third party complies. Records held outside the UK must still meet UK requirements and be available when HMRC asks for them. Within a group, identity documents need not be duplicated, but they must be accessible to the nominated officer, the compliance officer and HMRC when required.

Reliance has its own rules. A firm that is relied on by another must keep the same records for the same periods, and must promptly provide the customer information and copies of identity and verification materials if the relying firm asks within the retention period. This does not apply where due diligence was carried out through an agent or an outsourcing provider. Our guide to relying on third parties for customer due diligence explains the arrangement in more detail.

Building a simple retention process

• Record the trigger date. When a client leaves, note the date the relationship ended on the file. That starts the five-year clock.
• Diarise a review. Set a reminder for the first working day after the five years expire, so deletion is routine.
• Check for exceptions before deleting. Look for live disputes, regulatory enquiries or other legal reasons to keep the file, and record the decision.
• Separate AML records. Keep due diligence evidence in a place you can delete from without losing other required records.
• Test retrieval. Ask someone to find a closed file and reconstruct a transaction. If they cannot, your records will not satisfy a supervisor either. Our guide to ongoing monitoring and periodic CDD review shows what a complete file looks like.

Frequently asked questions

Can I keep client ID documents indefinitely?

Not under the AML regulations. After the retention period you must delete the personal data you obtained for AML purposes, unless one of the three exceptions applies.

Does the five years start when I file the last return?

No. For a business relationship it starts when the relationship ends, which should be recorded when you stop acting.

Where can I get training on record keeping and AML?

See Learnsignal's CPD courses for finance professionals.