Reporting and Recordkeeping
What must be recorded, and for how long
Recordkeeping underpins every other control: without records, supervisors cannot verify CDD, and investigators cannot reconstruct flows. Candidates should know the categories: CDD records (identification evidence, beneficial ownership, risk rating rationale), transaction records (sufficient to reconstruct individual transactions), correspondence relating to the relationship, training records, and reports made (internal and external).
Concepts to master
- Retention periods: commonly five years after the end of the relationship or after the transaction, extendable on request by a competent authority. Verify the exact period against the applicable regime.
- Format: records must be retrievable promptly; "we have it somewhere in archives" is not compliance.
- Internal reporting records: the nominated officer should log decisions, including decisions not to report, with reasons.
- Management information: regular reporting to the board on alerts, reports, and training completion.
- Data protection interaction: retention duties and privacy rights must be reconciled; AML retention usually prevails for the statutory period.
Traps
Assuming records may be deleted once the relationship closes. Assuming an external report is the only record needed - the internal decision trail matters too. Confusing the retention clock start (end of relationship versus date of transaction).
Worked example
A customer closes an account in March. The firm must keep the CDD and transaction records for the statutory period measured from closure, not from onboarding, and must be able to produce them promptly if the financial intelligence unit asks two years later.
Rule of thumb
Record as if a supervisor will read the file in five years with no access to the staff who wrote it.