AML/CTF record-keeping: what to keep, and for how long

The short version

Four sections of the AML/CTF Act set the main record-keeping duties for these sectors. Each has its own 7-year period, and they start at different times.¹ The transaction-record and program-record periods keep running after you stop being a reporting entity: those sections apply to a person who "is or was" one.²

CDD records and program records must be in English, or in a form that is readily accessible and readily convertible into writing in English.³ Each duty is a civil penalty provision.¹

Transaction records (s 107)

When you start or provide a designated service, keep enough to reconstruct each individual transaction in that service for the client.⁴ What that means depends on your service. For a conveyancer holding money for a settlement it might be the trust ledger entries, the payment instructions and the settlement statement; for an accountant setting up a company, the engagement, the registration and who paid what. Those examples are ours, not the Act's. Keep each record for 7 years from the day it is made.

Documents the client gives you (s 108)

If a client, or someone on their behalf, gives you a document relating to a designated service you have started to provide, keep the document or a copy for 7 years after it was given.⁵

Customer due diligence records (s 111)

Keep records reasonably necessary to show you complied with your customer due diligence obligations. They must include:⁶

• records showing the type and content of the data you collected about the client for initial or ongoing CDD;
• records of any analysis, identification or assessment of the client's ML/TF risk, and any decision you made.

That includes the notes the Rules require in particular cases: the steps taken when you could not identify the beneficial owners of a company, partnership or association, the steps taken and your consideration of a suspicious matter report when a party to a sale would not cooperate, and your documented reasons for relying on another entity's checks.⁷

The period runs until 7 years after the business relationship ends, or after you complete a one-off transaction.⁶ For a long-standing client that can be many years after you collected the information, so date every record and mark when the relationship ended.

If you rely on another entity's customer due diligence, the Act has two further retention rules: keep the copy of the other party's record that they give you until a 7-year period passes in which you provide no designated service to that client, and keep each written assessment of a reliance arrangement for 7 years after you prepare it.⁸ See our customer due diligence guide.

Program records (s 116)

Keep records reasonably necessary to show you complied with Part 1A, which is your ML/TF risk assessment, your AML/CTF policies and the duties that go with them.⁹ In a small practice that typically means:

• each version of the risk assessment and the policies, with the senior manager's approval of each, and the date it was superseded;
• the compliance officer's designation, the fit and proper checks, and the notice to AUSTRAC;
• personnel due diligence and training records;
• reports to the governing body;
• independent evaluation reports and your response to them.

The list is our summary of what Part 1A asks you to do, not a list in the Act. Keep each record until 7 years after it stops being relevant to your Part 1A compliance.⁹ A superseded risk assessment may stay relevant for as long as decisions made under it could be questioned, so the simplest approach is to keep every version with its dates.

Your program itself must be documented before you first provide a designated service, and each update documented within 14 days after it occurs.¹⁰

Copies of ID documents and the Privacy Act

A small business that is a reporting entity is treated as an organisation under the Privacy Act 1988 for its AML/CTF activities, with any modifications the regulations prescribe, so the Privacy Act applies to that part of the business even if it would otherwise be exempt.¹¹ The OAIC's guidance says:¹²

• the AML/CTF Act does not require you to keep scanned copies or photocopies of identity documents;
• you should take reasonable steps to destroy or de-identify copies of full identity documents once you no longer need them;
• instead, keep the particulars you need (such as name, date of birth, residential address, document number and expiry), the type of document, what you did to verify the client and the outcome;
• you must have a privacy policy and collection notices that explain how you handle personal information for AML/CTF purposes, but you need not give information in a collection notice where that would be inconsistent with the tipping-off offence.

The OAIC publishes a template collection notice for reporting entities and an August 2026 guide to privacy for reporting entities. Both are on its guidance page. Our Privacy Act and AML guide covers this in more detail.

When AUSTRAC asks

AUSTRAC said on 28 August 2026 that it had begun issuing section 167 notices to businesses that appear to provide designated services without having enrolled.¹³ Section 168 is not an enforcement power: it entitles you to reasonable compensation for making copies of documents under a section 167 notice.¹⁴

Build an index an evaluator can follow

Your independent evaluation must test your program and report in writing.¹⁵ An evaluator, like AUSTRAC, will ask to see records. Our suggestions for a small practice:

1. One index

   A single register listing each kind of record, the section it serves, where it is kept, who is responsible, the event that starts its 7-year clock, and the earliest date it may be destroyed.

2. One client file structure

   The same folders in every client file: CDD and verification, risk rating and decisions, client documents, transactions, and ongoing reviews.

3. Dates on everything

   The date a record was made, a document was received, a relationship ended, or a version was superseded. Every clock depends on one of these.

4. A destruction check

   Before destroying anything, check the index: the AML/CTF clock, any other law that requires you to keep it, and the Privacy Act duty not to keep it longer than needed.

Where we fit

We do not keep your records or act as your compliance officer. AUSTRAC's free program starter kits and its record keeping overview are the place to start. AUSTRAC links open in a new window; AUSTRAC has not reviewed or endorsed this guide. Our kit builds on the starter kits, and every edition includes a record keeping index and a privacy collection notice for CDD. Our set-up service tailors them to your practice.

• Your sector: accounting practices, real estate agencies, conveyancers and legal practices.
• More guides: the guides page and every source on our sources page.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.