AML record keeping in the UK means keeping customer due diligence evidence and records of monitored transactions for at least five years after the business relationship ends, or after a one-off transaction completes. The personal data must then normally be deleted. Practices also need written records of their risk assessment, policies and staff training.
The five-year AML record keeping rule and the deletion duty both sit in regulation 40 of the Money Laundering Regulations 2017. That pairing is what practices most often get wrong: files are thrown away too early or kept forever. Below: when the clock starts, what to keep, when to delete, and a folder structure for client files.
Key points
- The core AML record keeping rule: keep CDD records and supporting transaction records for at least five years from the end of the business relationship (MLR 2017, regulation 40).
- Transaction records within a relationship need not be kept for more than ten years.
- When the period ends, delete personal data obtained under the regulations unless an exception applies.
- Personal data obtained for AML purposes may only be used for those purposes unless another law permits or the client consents (regulation 41).
- Firm-level records are needed too: the risk assessment, policies and training.
The five-year rule and when the clock starts
Regulation 40(3) sets the minimum period as five years beginning on the date the firm knows, or has reasonable grounds to believe, that the relevant event has happened.
| Record type | Clock starts | Minimum period | Upper limit |
|---|---|---|---|
| CDD records for an ongoing client | When the business relationship ends | 5 years | Delete after, unless an exception applies |
| Records of transactions within a relationship | When the business relationship ends | 5 years | Not required beyond 10 years (regulation 40(4)) |
| Records for an occasional transaction | When the transaction is complete | 5 years | Delete after, unless an exception applies |
For most practices, the key date is disengagement. A client who has been with you for twenty years has CDD records that must be kept for five years after they leave, not five years after you first verified them. Record the disengagement date in the AML record keeping tracker on the day the relationship ends, because that date drives everything that follows.
Ten-year cap on transaction records
The ten-year cap in regulation 40(4) applies only to records of transactions that form part of a business relationship. For a long-standing client, the oldest transaction records may already be more than ten years old when the relationship ends; those need not be kept beyond ten years.
What AML record keeping covers: CDD, risk, transactions, training
There are two levels to keep: the client file and the firm’s own records.
Client-level records
- Copies of documents and information obtained to meet the CDD requirements, including enhanced due diligence and PEP measures (regulation 40(2)(a)).
- Supporting records for transactions subject to CDD or ongoing monitoring, sufficient to reconstruct the transaction (regulation 40(2)(b)).
- Where the beneficial owner of a company cannot be identified, written records of the steps taken and difficulties met (regulation 28(8)).
- Your client risk assessment and the reasons for the risk band.
- Ongoing monitoring reviews and their outcomes.
A “copy” for this purpose means one that would be admissible in court as evidence of the original (regulation 40(9)(b)). Clear, complete scans with the date of verification and the name of the person who checked them meet that need far better than phone photos of half a passport.
Firm-level records
| Record | Requirement |
|---|---|
| Firm-wide risk assessment | Up-to-date written record of the steps taken, available to the supervisor on request (regulation 18(4) and (6)) |
| Policies, controls and procedures | Written record of the policies, changes after review and steps taken to communicate them (regulation 19) |
| Training | Written record of measures taken and training given to relevant employees and agents (regulation 24) |
For AML record keeping purposes, internal suspicion reports and the MLRO’s decisions are sensitive. Keep them outside the client file, with restricted access, so ordinary staff cannot see them and no tipping off risk arises. Your supervisor’s guidance will set expectations for how long those records are kept.
Deleting records once the period ends
Regulation 40(5) requires firms to delete personal data obtained for the purposes of the regulations once the retention period expires, unless:
- another law requires the firm to keep records containing it, or it is needed for court proceedings;
- the person has consented to its retention; or
- the firm has reasonable grounds to believe it needs to be kept for legal proceedings.
This sits alongside the UK GDPR storage limitation principle, which says personal data must not be kept longer than needed (ICO: storage limitation). In practice, AML record keeping and tax record keeping run on different clocks. Tax working papers may need keeping for other reasons, so separate AML documents from tax files and apply each retention rule to its own folder.
A deletion routine
- Each quarter, list clients whose disengagement date is more than five years ago.
- Check for any exception: litigation, an open enquiry, an internal report, consent.
- Have the MLRO or responsible partner approve the deletion list.
- Delete the AML folder from every location: document store, AML software, email attachments and backups as they cycle.
- Keep a deletion log showing the client reference, date and approver, without the personal data itself.
An AML record keeping folder structure for every client
A consistent structure makes AML record keeping easy to check and easy to delete, whoever does the filing. Use the same folders for every client, in your document store or AML tool.
| Folder | Contents |
|---|---|
| 01 Identity | ID and address evidence for each individual, electronic verification reports, date and checker |
| 02 Entity and ownership | Company or trust details, ownership chart, beneficial owner verification, regulation 28(8) notes if relevant |
| 03 Risk assessment | Client risk assessment, risk band, reasons, approvals |
| 04 Enhanced due diligence | Source of funds and wealth evidence, PEP approvals, where applicable |
| 05 Ongoing monitoring | Review records, screening results, trigger events and outcomes |
| 06 Transactions | Supporting records for transactions subject to CDD or monitoring |
| 07 Correspondence | AML-related requests and replies |
| 00 Index | Client reference, engagement date, disengagement date, deletion due date |
Keep internal suspicion reports out of this structure, in the MLRO’s restricted area. Our client onboarding checklist shows where each document is collected.
Storage, access and audit trails
Good AML record keeping needs records that are secure, retrievable and used only for AML purposes. Regulation 41 limits use of personal data obtained under the regulations to preventing money laundering, terrorist financing and proliferation financing, unless another law permits other use or the client consents. Before the relationship starts, firms must give new clients a statement saying so.
- Restrict AML folders to staff who need them.
- Use individual logins so every access and change is recorded.
- Store evidence in your document system or AML tool, not in personal email or downloads folders.
- If an outsourced team handles AML documents, put Article 28 processor terms in place and, for overseas teams, a transfer mechanism; see our guide to outsourcing and GDPR.
- Check that your AML software lets you export complete files, in case you change provider before the retention period ends.
What reviewers look for first
When a supervisor or internal reviewer tests your AML record keeping, these are the checks that come first. Use them as a monthly self-test on a sample of files.
- Is there evidence of identity verification for every relevant individual, dated before work began?
- Is there a client risk assessment with a reason for the band?
- Is beneficial ownership verified independently of the Companies House register?
- Are ongoing monitoring reviews recorded on time?
- Can the firm produce its risk assessment, policies and training records on request?
- For former clients, is there a disengagement date and is deletion on schedule?
Our AML requirements checklist covers the CDD steps behind these records, and our comparison of in-house and outsourced AML checks looks at who does the work.
FAQs
How long should AML records be kept in the UK?
At least five years from the end of the business relationship, or from completion of an occasional transaction, under regulation 40 of the Money Laundering Regulations 2017. Transaction records within a relationship need not be kept for more than ten years. After the period, personal data must normally be deleted unless an exception applies.
When does the AML record retention period start?
For ongoing clients, on the date the firm knows or has reasonable grounds to believe the business relationship has ended. For a one-off transaction, on the date it is complete. Record disengagement dates promptly, because they set the deletion date in your AML record keeping tracker.
Do AML records have to be deleted after five years?
Yes, personal data obtained under the regulations must be deleted once the period ends, unless another law requires it to be kept, it is needed for court or legal proceedings, or the person has consented. Keep a deletion log so you can show the routine works.
What AML records does a firm need besides client files?
A written record of the firm-wide risk assessment, a written record of policies, controls and procedures and any changes, and a written record of AML training given to staff and agents. Supervisors can ask to see the risk assessment and supporting records at any time.
Can AML record keeping be outsourced?
The administration can be: filing evidence, maintaining the tracker and running the deletion list. The firm remains responsible for its AML record keeping, and any outsourced team handling personal data needs processor terms and, if overseas, a lawful transfer mechanism. Deletion approvals should stay with the MLRO.
Keep every AML file complete and on schedule
Our team files AML evidence in a consistent structure, maintains your tracker and prepares deletion lists for MLRO approval. See our AML checks service or book a consultation.
