Anti-money-laundering compliance is not only about doing the right checks; it is about being able to prove you did them. Record-keeping is what turns a compliance programme from a claim into something demonstrable, and it is a specific obligation in its own right. A business that performed good due diligence but cannot produce the evidence is, from a supervisor's point of view, in much the same position as one that did nothing. Here is what AML record-keeping requires and why it carries more weight than it seems.
Why records are the proof
When a supervisor examines a business, or an investigation touches it, the question is not what the business believes it did but what it can show. Records of customer due diligence, of the reasoning behind risk decisions, and of transactions are the evidence that the programme was real. Good work with no records is invisible; it cannot be relied on to defend the business. This is why record-keeping is treated as a duty rather than mere good practice.
What to keep
The record set spans the whole customer relationship and the decisions taken along it.
| Record | What it evidences |
|---|---|
| Customer identification and verification | Who the customer is and how you confirmed it |
| Beneficial ownership information | Who ultimately owns and controls the customer |
| Risk assessments and decisions | Why you treated a customer as you did |
| Transaction records | The dealings you monitored |
| Internal and external reports | Suspicions escalated and reported |
Retention is part of the obligation
Records must be kept for a defined period, commonly several years, after the transaction or the end of the relationship. The retention exists because investigations and reviews often look back, and the value of a record is precisely that it survives to be examined later. Destroying or losing due-diligence records within the retention period undermines the whole programme, however diligent the original work was. Storage, physical or digital, should be organised so any customer or period can be produced on request.
Good due diligence you cannot evidence counts for little. To a supervisor, undocumented compliance and no compliance look much the same. The record is what makes the work real.
Capture the reasoning, not just the documents
A subtle but important point is that records should include the reasoning behind decisions, not only the collected documents. Why a customer was assessed as low or high risk, why a matter was or was not reported, and what enhanced checks were done and why: these judgements are exactly what a reviewer will want to understand. Keeping the thinking, not just the paperwork, is what lets a business explain and defend its decisions rather than merely show it held some files.
What to do about it
Keep complete records of identification, beneficial ownership, risk decisions, transactions, and reports, and retain them for the required period in a way that lets you retrieve any relationship quickly. Record the reasoning behind your risk and reporting decisions, not just the documents. Treat record-keeping as the evidence layer that makes the rest of your AML programme defensible. When a supervisor comes, the business that can show its work is in a wholly different position from the one that can only assert it, even if both did the same checks.
This article is general information and is not legal advice. Record and retention requirements are set by law and your supervisor. We would be glad to help you set up compliant record-keeping.