The 7-Year Record: What to Keep, and What 'Keeping' Means

What records does an agency have to keep?

Four families. Customer due diligence records: the identification documents, verification results, and for entities the beneficial ownership analysis. Transaction records: what was brokered, for whom, for how much, and how money moved. Program records: your risk assessment, AML program, training logs and reviews. Decision records: screening outcomes, escalations, enhanced due diligence and the reasoning behind each call.

The fourth family is the one agencies miss. Documents prove what you collected. Decisions prove you ran a program. A regulator's real question is rarely "do you have the passport copy" — it is "show me why you cleared this".

"Kept" means retrievable, not merely stored

The practical test is brutal and simple: if AUSTRAC asked about a specific sale from four years ago, could you produce the complete file — CDD, screening, decisions, correspondence — in an afternoon? If the answer involves a departed employee's inbox, a shared drive with three naming conventions, and a folder called "AML stuff", you are storing, not keeping.

Seven years is longer than most agencies keep staff, software contracts or filing habits. A record system that depends on any of those surviving is a system with a built-in expiry date.

Why the shoebox model fails quietly

The typical agency runs 6–10 disconnected platforms — CRM here, forms tool there, ID checks in a vendor portal, email holding everything else. Each AML record gets created in whichever system was open at the time. Nothing lies, nothing is lost exactly, but no single place can tell the story of one transaction.

That is the quiet failure mode: not missing records, but scattered ones. Reassembling one file across five systems is an afternoon. Reassembling a year of files during a regulator's review is a month you do not have, at the worst possible time.

The audit trail is the record of the record

Beyond the documents themselves, you want to be able to show when each record was created, by whom, and that it has not been quietly edited since. A verification note that could have been written last Tuesday is worth less than one the system timestamped two years ago. This is what an audit trail actually is — not a feature checkbox, but the property that makes every other record believable.

This is also the honest case for purpose-built tooling over folders: on Indium, CDD results, screening decisions and escalations are written into the transaction's ledger-backed trail as they happen, so the file assembles itself and dates itself.

Design for the person who leaves

Your compliance officer will change jobs at least once in any seven-year window. So will the agents who ran the checks. The retention obligation does not care. Every record practice should pass the staffing test: could a competent stranger, joining after everyone involved has left, find and understand the file?

That means records live in the system, not in heads or inboxes; reasoning gets written down at the time, in one or two sentences; and nothing critical exists only as an email attachment. Institutional memory is not a records strategy.

What to do this quarter

Three moves. First, decide the single home for AML records per transaction and write it into your program — one file, one place, no exceptions. Second, run the retrieval test on a recent sale: time how long a complete file takes to assemble, and let that number set your urgency. Third, add the reasoning habit: every screening dismissal, every EDD decision gets its dated one-liner at the time.

Do those three and the seven-year obligation becomes what it should be — boring. The agencies that will suffer are not the ones with bad intentions, but the ones that mistook "we never delete anything" for a system.

While you are at it, name a records owner. Not the compliance officer by default — the person who actually administers the systems where files live, checks that the per-transaction file is complete at settlement, and runs the retrieval test twice a year. Ownership is what separates a policy from a practice.

And think about format longevity. Seven years outlives software subscriptions, so know how you would export a complete, readable file if you ever changed platforms. Any vendor who cannot answer "how do I get my records out" in one sentence is asking you to bet a legal obligation on their retention policy rather than your own.

The same question applies to your archives when an office closes or a rent roll sells: the seven-year obligation follows the records, so the file home and the export path need to survive the corporate event too.