Record keeping is the anti-money laundering duty to retain records of customer checks and transactions. Most regimes require these to be kept for at least five years, so activity can be traced by investigators and a firm can prove it met its obligations.
Key takeaways
- Record keeping is the AML duty to retain records of checks and transactions.
- It covers identity records, transactions, risk assessments, and reports.
- Most regimes require records to be kept for at least five years.
- The rule comes from the FATF standard and national law.
- Records give investigators an audit trail and prove compliance.
- Poor record keeping is a common and avoidable examination finding.
On this page
What it isWhy records matterWhat to keepHow longFormat and storageRecords and investigationsCommon failuresDoing it wellFAQsRead more
What is record keeping in AML?
Record keeping is the duty to hold on to evidence of the checks and transactions a firm handles. It means keeping who a customer is, what they did, and what the firm did about it, in a form that can be found later.
It is one of the quieter parts of an AML program, easy to overlook next to screening or monitoring, but it is where the whole system leaves a trail. Without records, there is no proof anything was checked.
The duty runs across every regulated firm. Read more: it is one of the obligations inside an AML compliance program.
Why records matter
Records matter for two reasons: they help catch criminals, and they protect the firm. Both come down to having evidence when it is needed.
For investigators, records are the trail that money leaves. When law enforcement follows a suspect, the account records, transaction histories, and identity checks held by firms are often what let them build a case. For the firm, records are the proof that it did its job, which is exactly what a regulator asks to see.
A firm with good records can answer questions. A firm without them cannot, whatever it actually did.
What records to keep
The rules cover a defined set of records, spanning the customer relationship from start to finish. Each supports a different part of the trail.
- Identity records. The evidence gathered during customer due diligence, such as documents and checks.
- Transaction records. Details of the transactions a customer made.
- Risk assessments. How the firm judged the risk of a customer or its business.
- Reports. Copies of any suspicious activity report filed and the reasoning behind it.
- Correspondence. Relevant communications about the account or activity.
Together these let someone reconstruct not just what a customer did, but what the firm knew and decided.
How long to keep records
Most regimes settle on a minimum of five years, and that figure is remarkably consistent worldwide. The clock usually starts when the relationship ends or the transaction takes place.
The global standard-setter, the FATF, calls for records to be kept for at least five years in its Recommendation 11, and national laws follow it. In the US, the Bank Secrecy Act requires a five-year retention period, and the EU applies a similar rule. Some records may need to be kept longer if an investigation is open.
Set out record keeping in your AML policy
Generate a tailored AML policy draft that records your controls, checks, and retention approach.
Format and storage
The rules care less about the exact format than about whether records can be found and read. Two qualities matter most.
- Retrievable. Records must be produced promptly when a regulator or investigator asks.
- Readable. They must be complete and legible, not fragments no one can interpret.
Records can be kept on paper or, far more often now, electronically. What matters is that a firm can retrieve a specific customer’s history quickly, rather than searching through disorganized files while an examiner waits.
Record keeping and investigations
Records come into their own when something goes wrong. An investigation, whether by the firm or by law enforcement, runs on the evidence that was kept.
When a suspicious pattern emerges, investigators look back through the records to understand it: who the customer is, where the money came from, and where it went. Good records make that possible; missing ones can stall a case entirely. This is why the duty exists in the first place, to keep the trail intact for the day it is needed.
Common record-keeping failures
Record-keeping failures tend to be mundane rather than dramatic, which is what makes them so common. A few recur.
- Gaps. Records missing for some customers or periods.
- Early destruction. Records deleted before the retention period ends.
- Poor retrieval. Records that exist but cannot be found quickly.
- Incomplete files. Records that capture part of the story but not the decision behind it.
None of these is hard to avoid, which is exactly why regulators take a dim view of them.
How firms do record keeping well
Doing record keeping well is a matter of discipline more than technology. A few habits keep a firm on solid ground.
- Define what to keep. Set a clear policy on records and retention periods.
- Store it well. Keep records secure, organized, and easy to retrieve.
- Hold for the full period. Do not destroy records early, and extend where needed.
- Test retrieval. Check that a specific record can actually be found on request.
Get an indicative AML risk rating
See where your money laundering risk is concentrated so your records focus on what matters most.
Keep records of your screening
Run one search across sanctions, PEP, and adverse media data and keep the result as part of your file.
Frequently asked questions
What is record keeping in AML?
Record keeping is the anti-money laundering duty to retain records of customer checks and transactions. It means keeping who a customer is, what they did, and what the firm did about it, in a form that can be found later. Most regimes require these records to be kept for at least five years, so activity can be traced and compliance proven.
How long must AML records be kept?
Most regimes require AML records to be kept for at least five years, usually starting when the customer relationship ends or the transaction takes place. The FATF sets this out in its Recommendation 11, and national laws such as the US Bank Secrecy Act follow it. Some records may need to be kept longer if an investigation is open.
What records must be kept for AML?
Firms must keep identity records from customer due diligence, transaction records, risk assessments, copies of any suspicious activity reports and the reasoning behind them, and relevant correspondence. Together these let someone reconstruct not just what a customer did, but what the firm knew and decided, which is what investigators and regulators need to see.
Why is record keeping important in AML?
Record keeping matters because records help catch criminals and protect the firm. For investigators, records are the trail money leaves, often what lets them build a case. For the firm, records are the proof it did its job, which is exactly what a regulator asks to see. Without records, there is no evidence that anything was checked.
What does the FATF say about record keeping?
The FATF, the global anti-money laundering standard-setter, addresses record keeping in its Recommendation 11. It calls for firms to keep records of transactions and customer due diligence for at least five years, and to be able to provide them promptly to competent authorities. National laws around the world follow this standard when setting their own record-keeping rules.
Can AML records be kept electronically?
Yes. Records can be kept on paper or, far more commonly now, electronically. The rules care less about the exact format than about whether records can be found and read. What matters is that a firm can retrieve a specific customer’s history quickly and that the records are complete and legible, rather than fragments no one can interpret.
What happens if a firm fails to keep proper records?
A firm that fails to keep proper records can face regulatory findings and penalties, even if it did its other AML work well. Without records, it cannot prove the work was done, which amounts to the same finding. Poor record keeping can also stall investigations, since the trail investigators rely on may be incomplete or missing.
When does the record-keeping period start?
The retention period usually starts when the customer relationship ends or when a transaction takes place, depending on the type of record. From that point, firms must keep the record for at least the minimum period, commonly five years. If an investigation is open, records connected to it may need to be kept for longer than the standard period.
What is the record-keeping rule under the Bank Secrecy Act?
Under the US Bank Secrecy Act, firms must keep certain records, including those relating to customer identity and transactions, for five years. The rule supports investigations and lets regulators confirm a firm met its obligations. It is one part of the broader Bank Secrecy Act framework that requires firms to help detect and report money laundering.
How should firms store AML records?
Firms should store AML records securely, keep them organized, and make sure they can be retrieved quickly on request. Records must be held for the full retention period, not destroyed early, and extended where an investigation requires. Testing that a specific record can actually be found, rather than assuming it can, is a mark of a well-run record-keeping process.
Are suspicious activity reports part of record keeping?
Yes. Copies of suspicious activity reports, along with the reasoning behind the decision to file, are part of a firm’s record-keeping duty. Keeping them shows that the firm identified and acted on suspicion, and it supports any later investigation. These records must be handled carefully, since tipping off a customer about a report is itself an offense.
Do small firms have to keep AML records?
Yes. Record keeping applies to regulated firms of all sizes, though the volume differs. A small firm keeps fewer records than a large bank, but the principle is the same: retain evidence of checks and transactions for the required period and be able to produce it. Simple, well-organized records are usually enough for a small firm to meet the duty.
Read more: our ultimate guides, whitepapers and templates
Related guides and resources to help you act on what you just read.
Last reviewed July 12, 2026 · 11 min read · Written for compliance and risk professionals · By the WhoWiki editorial team
Key takeaway: record keeping is the AML duty to retain records of customer checks and transactions, usually for at least five years, so activity can be traced and proven.