A step-by-step guide to AML/CTF record-keeping requirements

Disclaimer: The content on this website is general and is not legal advice. Before you make a decision or take a particular action based on the content on this website, you should check its accuracy, completeness, currency and relevance for your purposes. You may wish to seek independent professional advice.

Why record-keeping matters

Accurate and complete record-keeping is essential to demonstrate compliance with your anti-money laundering and counter-terrorism financing (AML/CTF) obligations. It helps show that your business understands its risks, takes them seriously and has appropriate systems in place.

"I’d recommend you adopt the ABC of AML compliance:
Assume nothing.
Believe no one.
Confirm everything.

And I would also offer a D to that, which is:
Document everything."

Michelle Garlick, MLRO, Weightmans / Compli

Your records are often the first thing AUSTRAC or other regulators will look at during an inspection or audit. If you haven’t documented it, you haven’t done it.

How long to keep records

You must keep AML/CTF records for at least seven years. The timeframe for retention depends on the type of record:

• Customer due diligence records must be retained to the end of a seven year period from the date the business relationship ends or the occasional transaction is completed, as per section 111 of the AML/CTF Act.
• Records of procedures carried out by another person and provided to your business must be retained for seven years after the last time you provided a designated service to the customer (section 114).
• Assessments of reliance arrangements must be retained for seven years after the record was prepared (section 114A).

After seven years, records may be securely destroyed unless required for legal or regulatory purposes.

What records to keep

AML/CTF program records

Keep evidence of:

• your AML/CTF program
• updates and reviews of the program
• documented risk assessments and their rationale
• internal controls and procedures
• approvals by senior management

"Every 12 to 18 months, I go back to each business unit with their last risk assessment and ask: is this still accurate? Do we need to change or expand it? Then I record that process. It takes time, but it proves to any regulator that we’ve thought about it, assessed the risks and kept them up to date."

Gary Spalding, AMLCO, Dentons

💡Tip: Save each version of your AML/CTF program with clear version numbers and approval dates to show how your compliance framework has evolved.

Customer due diligence (CDD)

You must keep:

• identity documents or certified copies
• information collected for KYC and beneficial ownership
• records of ML/TF risk assessments
• enhanced due diligence (EDD) actions if applicable
• any reliance arrangements or outsourced KYC processes
• ongoing monitoring records and any red flag reviews

"Record keeping is like the bedrock of good customer due diligence. So save everything that you have used during the client due diligence process, which informs your decisions."

Oscar Fransman, Compliance Analyst, MinterEllisonRuddWatts

💡Tip: Use a standard CDD checklist per client file to ensure consistency and reduce gaps.

Transaction records

You must keep enough information to reconstruct each transaction. This includes:

• date, amount and method of the transaction
• customer-provided transaction documents (original or a copy)
• names of parties involved
• purpose of the transaction
• supporting documentation such as contracts or settlement statements
• internal communications or risk assessments if enhanced checks were triggered

💡Tip: For high-risk matters, consider a transaction register that tracks key steps and review points.

Staff training records

Maintain records that show:

• names of attendees
• dates of training sessions
• training materials used
• completion results or assessments if applicable

💡Tip: Keep a central training register updated quarterly. This is often one of the first things a regulator will ask for.

Audit and review records

You must retain:

• reports from any independent AML/CTF review
• internal audit findings
• action plans and evidence that improvements were implemented

💡Tip: Link any policy or procedure updates to specific review recommendations. This helps demonstrate a responsive and maturing compliance culture.

Secure storage of records

Your AML/CTF records must be stored securely and responsibly. This means:

• records should be protected from unauthorised access, loss or tampering
• only authorised staff should have access
• physical files must be kept in locked storage with restricted access
• digital files must be stored on secure systems with access controls, encryption where necessary and regular backups
• records must be easily retrievable for compliance reviews or audits

💡Tip: Treat your AML/CTF records with the same level of care as sensitive client information. Ensure your document retention policy covers both security and access controls.

Remember, under the Privacy Act 1988, you must also take reasonable steps to protect personal information held in your records.

Where to store records

Acceptable storage options include:

• cloud-based practice management systems
• secure shared drives with restricted access
• AML-specific software platforms

The key is ensuring:

• role-based access controls are in place
• audit trails or version histories are available
• regular backups are performed

Making it work in practice

To stay compliant:

• document your processes in your AML/CTF program
• create templates and checklists for consistency
• train staff regularly and log attendance
• assign someone to be responsible for oversight (e.g. your AMLCO)
• perform spot checks to ensure records are complete

"If you've looked at something online, I would suggest printing it to PDF. Websites change or move on. So if you've used something, save that with your CDD file so that you have a record of how you made your decisions on that client."

Oscar Fransman, Compliance Analyst, MinterEllisonRuddWatts

If you identify a gap or error, document the issue and how you are resolving it. Regulators are more understanding when they see proactive controls and a commitment to improvement.

If it’s a maybe, it’s a yes

If you’re not sure whether to keep a document, keep it. It’s always safer to over-document than to under-record. A strong AML/CTF record-keeping system protects your business and builds credibility with regulators.

Make sure your systems are secure, your staff are trained and your processes are documented. This will set your firm up for success under the AML/CTF regime.