AML record keeping resources for UK firms
Practical guidance on what to keep, how long to keep it, and how to make AML files inspection-ready.
What AML record keeping requires
Regulation 40 of MLR 2017 requires customer due diligence records and supporting documents to be kept for five years, running from the end of the business relationship or the completion of an occasional transaction. The obligation covers the evidence a firm relied on and the decisions it reached, not simply the copies of documents it collected.
Why records decide inspection outcomes
A control that happened but was not recorded is, for supervisory purposes, difficult to distinguish from one that did not happen. Most adverse findings concern firms that were doing reasonable work without leaving a trail another reviewer could follow.
Where to start
The record-keeping requirements material sets out what to keep and for how long. Where a firm also acts as an Authorised Corporate Service Provider, note that Companies House identity checks carry a seven-year retention period rather than five.