Five-year retention, seven-year group policy, and a law enforcement request
At a mid-sized bank in a jurisdiction whose AML law requires customer records to be kept for five years after the end of the business relationship, a branch destroyed paper onboarding files in 2021 for accounts closed in 2016. The group policy requires seven years, but the local compliance manual repeated the five-year rule. In 2024, law enforcement requests all KYC and transaction records for one of those customers, a former MP. The bank finds electronic transaction records and a scanned ID, but the beneficial-ownership certification and the source-of-funds evidence were only in paper and are gone. The archive index shows a note: "BOX 14 - destroyed per retention schedule." The compliance officer had flagged in 2022 that the third-party warehouse had no index and that branch staff were interpreting the schedule inconsistently. The bank's regulator has not yet been informed.
1. Was the destruction compliant with the jurisdiction's retention rule? Explain the distinction between minimum retention and group policy.
Read the worked answer
Under the local rule, the bank had to keep records for five years after the end of the relationship. The accounts closed in 2016, and the paper files were destroyed in 2021, so the local minimum was met. But the group policy required seven years, and the local compliance manual wrongly repeated the five-year rule instead of adopting the higher group standard. Destruction at five years therefore breached internal policy, even if it was lawful. The distinction matters because a regulator may examine whether the bank followed its own policies and group-wide standards. The missing beneficial-ownership certification and source-of-funds evidence are the most serious gaps: those are core CDD records, and the fact that they existed only in paper is a design weakness. The 2022 archive-index warning shows the bank knew about the risk before the request.
2. How should the bank respond to the law enforcement request, and what are its reporting and escalation obligations?
Read the worked answer
Respond to law enforcement promptly and in writing: confirm what was searched, what exists, and what was destroyed; provide the electronic records and scanned ID; explain the retention schedule and the 2021 destruction. Do not reconstruct or backdate records. Place a litigation hold on all remaining records for this customer and similarly situated accounts. Escalate to legal, compliance, and the MLRO. Consider whether the bank has a legal obligation to notify the regulator of the records gap; in many jurisdictions, a material control failure may require notification. Do not communicate with the former customer about the request unless legally required. Preserve the archive index note and the 2022 warning as evidence.
3. Recommend governance remediation and explain how you would prevent recurrence.
Read the worked answer
Remediation: harmonize the local manual with group policy, using seven years or longer if local law requires; replace manual destruction with an automated retention schedule; require an indexed archive with a certificate of destruction; add vendor oversight for the third-party warehouse; train branch staff; and conduct a lookback for other files destroyed under the same misinterpretation. Report to the board or audit committee with a corrective action plan and deadlines. The governance lesson is that "lawful minimum" is not the same as "policy compliance," and a records gap can undermine the bank's ability to respond to law enforcement and regulators.