Recordkeeping, Reporting, and Governance
Domain 6 tests the records, reports, and governance that make a KYC programme auditable and enforceable. Expect questions on retention periods, STR confidentiality, and the roles of the board, MLRO, and internal audit.
Recordkeeping
FATF Recommendation 11 requires records of transactions and CDD for at least five years after the transaction or the end of the relationship, and longer if required locally. Records should include identification documents, verification results, risk assessments, beneficial ownership analysis, monitoring alerts and their disposition, and approvals. Records must be retrievable promptly for supervisors and law enforcement, and retained securely with access controls and data protection compliance.
Reporting
Suspicious transaction reports go to the financial intelligence unit. The narrative must explain who, what, when, where, why, and how - not just that activity is unusual. Confidentiality is strict: tipping off the customer is a criminal offence in most regimes. Sanctions hits are reported separately to the relevant authority, and threshold-based cash transaction reports may also apply.
Governance
Three lines of defence: the business owns the risk, compliance sets the framework, and internal audit provides independent assurance. The board approves the AML policy and appetite; the MLRO or compliance officer has authority to escalate; training is role-specific; and independent testing covers both design and effectiveness. Metrics and management information should show alert volumes, backlogs, STR counts, and overdue reviews.
Worked example
A relationship ends in March. An STR was filed the previous November, and a monitoring alert was closed in January. Correct reasoning: CDD records must be kept for at least five years from the end of the relationship, and transaction records for five years from the transaction date. The STR and the alert file are separate records with their own retention rules and confidentiality protections. Deleting the file in the year after closure would breach retention requirements. The officer should also check whether local law requires a longer period or a litigation hold.
Traps that cost marks
Destroying records at account closure; writing vague STR narratives; treating governance as paperwork; and failing to document the rationale for risk-rating decisions.