What AML records should UK firms keep?
Use these guides to turn AML work into clear records that another reviewer can understand.
What to keep, and for how long
Keep the evidence relied on and the decisions reached: identity evidence, the risk assessment and its reasoning, screening results including dismissed matches, source-of-funds evidence where obtained, and the decision to accept or decline. Regulation 40 sets five years from the end of the relationship or completion of the transaction.
Retention is not one number
A firm acting as an Authorised Corporate Service Provider keeps Companies House identity checks for seven years, not five. Where a firm does both, the retention period depends on why the check was carried out, so it is worth recording the purpose alongside the evidence.