Handling and security Current

Setting a record-retention schedule for compliance evidence

A practical approach to setting how long records are kept.

Keeping records forever isn't the answer, and neither is deleting them too soon. This guide sets out AUSTRAC's own retention guidance as a starting point for a firm's retention schedule. It is general information, not legal or compliance advice.

Action plan

1 Use AUSTRAC's stated retention period as the baseline AUSTRAC's own guidance states records are generally kept for seven years.

AUSTRAC's guidance on record keeping states that proper record keeping generally involves keeping records for a specific period, usually seven years. Use this as the baseline for AML/CTF-related compliance records, and confirm with your firm's own AML/CTF program which record types this applies to.

  • Treat seven years as the general AUSTRAC baseline for AML/CTF-related records
  • Confirm which record types your firm's AML/CTF program applies this to
  • Document the retention period applied to each record type

Done when: A retention period consistent with AUSTRAC's baseline has been set for AML/CTF-related records

AUSTRAC: record keeping overview
2 Check other record types have their own retention requirement AML/CTF records aren't the only records your firm keeps -- other obligations may set different periods.

AUSTRAC's retention guidance applies specifically to AML/CTF-related records. Other record types your firm holds, such as tax records or general client files, may be subject to different retention obligations under other laws, so don't assume one retention period applies to everything your firm keeps.

  • Identify record types outside AML/CTF scope (tax records, general client files, engagement records)
  • Check whether each has its own applicable retention requirement
  • Don't apply a single retention period to every record type by default

Done when: Retention periods have been checked and set separately for each material record type your firm holds

3 Set a process for what happens once the retention period ends A retention schedule needs a disposal step, not just a start date.

A retention schedule is only complete once it says what happens when the period ends: whether the record is securely destroyed, archived, or reviewed for a possible extension. Set this process now rather than leaving it to be decided record by record later.

  • Decide whether records are destroyed, archived, or reviewed once the retention period ends
  • Set a secure disposal method for records no longer needed
  • Record when each retention period ends and what action was taken

Done when: A disposal process exists for records once their retention period ends

See verifying a document meets your record-keeping requirements before filing it