AML & Compliance

Records, retention and being ready for an inspection

Updated 14 Aug 2026

Summary

The records an inspector will ask for, and the clocks that decide how long each one must be kept.

About 3 minutes · 6 steps. Also called: record keeping, retention, audit readiness.

Learn the four families of records: member identification, the evidence behind it, transaction history, and the reasoning behind decisions. The third builds itself every time you sign in and post; the first two are yours to keep complete.
Keep the evidence with the record. A name and number typed into a field proves a paper existed. The copy of the document you saw, with the date you saw it, is the proof.
Treat transaction history as a record too. Your institution must be able to rebuild any single transaction later: amount, currency, date, channel, direction, and who was on the other side.

A transaction record rebuilt in full, with its flags and the checks that ran against it

Know the two clocks. Identification records count from the end of the relationship; transaction records from the date of the transaction. The periods come from your country's rules and are configured in the system.
Remember what a member leaving means: the identification clock starts then, so closing an account never clears the file.
Hold everything that is spoken for. A case under investigation, or a preservation request from an authority, keeps records past the normal period. Ask your compliance officer before anything is removed.

Note: The fourth family, the reasoning behind decisions, is the next lesson: writing notes that survive an inspection.

"The member closed the account, so we can clear the file." Not yet — the identification clock starts at the end of the relationship.
"How long do we keep records?" For the periods your country's rules set. Check the configured values with your compliance officer; do not guess.
"Can we delete once the period is over?" Only if nothing is holding the file — no open case, no preservation request.