18.4 Record Retention Rules and Secure Data Storage
Key Takeaways
US BSA rules generally require records to be kept for five years; CIP identifying information is kept for five years after the account closes.
UK Money Laundering Regulations require CDD and transaction records to be kept for five years after the relationship ends, then personal data deleted unless another legal basis applies.
Records must be retrievable fast enough for authority requests, such as reporting 314(a) matches within 14 days.
Legal holds for litigation, investigations or law enforcement requests suspend routine deletion of the affected records.
CAFCA sub-topic 5.4 covers the methods and rules of record retention and data storage. Retention lets authorities follow money years later. Storage design decides whether a scaling FinTech can find, protect and produce those records.
Retention rules in key jurisdictions
| Record | United States (BSA) | UK (Money Laundering Regulations 2017) | EU |
|---|---|---|---|
| CDD and identity | CIP identifying information: 5 years after the account closes. Verification records: 5 years after they are made | CDD evidence: 5 years after the business relationship ends (or after an occasional transaction) | AML directives: 5 years after the relationship ends; national law may extend. The AML Regulation (from July 2027) keeps a five-year baseline |
| Transactions | Generally 5 years (31 CFR 1010.430), including funds transfer records of US$3,000 or more | 5 years from the transaction, kept within the relationship records | 5 years |
| SAR / STR | SAR and supporting documentation: 5 years from filing | Internal and external reports kept under firm policy and legal advice | As national law requires |
| Reports such as CTRs | 5 years | Not applicable | Not applicable |
The UK rules also say that after the retention period, personal data must be deleted unless the firm must keep it under another law or court order, or the person has consented. That puts the AML retention rule and data protection's storage limitation side by side.
Building a retention schedule
- Inventory the data: identity documents and images, biometric templates, device and IP logs, transactions, case files, SAR records, screening results, communications.
- Map each category to the rules that apply (AML, tax, consumer, privacy, contract) and choose the longest required period, without exceeding what is lawful.
- Define the start event: account closure, transaction date or filing date.
- Automate deletion or anonymisation after the period, with legal hold overrides.
- Cover vendors: identity verification and screening vendors may keep copies of images or results. Contracts should say how long, where, and how the data is returned or deleted.
- Test it: can you produce a five-year-old onboarding file, with its document image and verification result, today?
What a complete onboarding record contains
A retained onboarding file should let a reviewer rebuild the decision years later:
- The identifying information collected and the date it was collected.
- The documents inspected, or the results of non-documentary checks, including the source used, the date and the result.
- Biometric or liveness results and the vendor reference, where used.
- Screening results with the list version and the disposition of any match.
- The risk rating at onboarding and the factors that produced it.
- Any discrepancy and how it was resolved.
- Approvals for higher-risk customers.
If any element sits only in a vendor's system, the firm must be able to retrieve it for the full retention period.
Storage requirements
- Security: encryption, role-based access, logging, and segregation of SAR material (Chapter 5).
- Integrity: protection against alteration, using version control or write-once storage for key records, and audit trails for edits.
- Retrievability: indexed and searchable records, so that requests can be met on time. Examples include 314(a) match reports within 14 days and production orders with deadlines.
- Completeness: the record must include the context, such as which list version was screened and which rule version fired (Chapter 14).
- Location and localisation: some countries require certain data to stay in-country. India's central bank, for example, requires payment system data to be stored in India. Cross-border transfers need privacy safeguards.
- Resilience: backups and disaster recovery that cover compliance records, not only customer-facing systems.
- Cloud: a shared-responsibility model. The FinTech stays accountable for retention, access and deletion settings.
Legal holds
When litigation is expected, or a regulator or law enforcement request or investigation is under way, a legal hold must stop routine deletion of the relevant records. Holds need a clear trigger, scope, owner and release process. Deleting held records can amount to obstruction or spoliation.
Realistic exam scenario
To reduce privacy risk, a FinTech's engineers configure the identity verification vendor to delete document images and selfie results 90 days after onboarding. Two years later, law enforcement asks for the onboarding evidence for a mule account. The firm cannot produce the verification records it was required to keep. The firm must fix the retention settings to meet the five-year rules, and bring the vendor contract into line. It should assess whether other records were lost, consider regulatory disclosure, and document the remediation. Privacy goals are met by minimisation and security, not by deleting records the law requires.
Common exam traps
- Deleting early for privacy reasons, breaching AML retention rules.
- Keeping everything forever, breaching storage limitation.
- Forgetting vendor-held copies.
- Ignoring legal holds.
How long must a US bank keep CIP identifying information about a customer?
One year after account opening
Five years after the account is closed
Until the customer requests deletion
Ten years after the last transaction
After the UK five-year retention period ends, what do the Money Laundering Regulations require for personal data held only for AML purposes?
Publish it in anonymised form
Keep it indefinitely in case it becomes useful for a future case
Send it to the National Crime Agency for central storage
Delete it unless another law, a court order or consent requires keeping it
A regulator opens an investigation into a FinTech's onboarding practices. What should happen to the routine deletion schedule for affected records?
All records should be deleted immediately to reduce the firm's privacy risk
Only paper records need to be kept
A legal hold should suspend deletion of the relevant records until released
It should continue as normal
Sections you finish are checked off in the contents.