Country-specific guidance Current

Setting a record retention schedule under the Money Laundering Regulations

Five years, but the clock doesn't start until the relationship actually ends.

Retention isn't a single date for a client's whole file, it runs from a specific trigger regulation 40 sets out. This guide sets out how to set that clock correctly. It is general information, not legal or compliance advice.

Action plan

1 Apply the five-year minimum retention period Five years is the default floor the Regulations set for due diligence and transaction records.

Regulation 40 sets the standard retention period at five years, beginning from when a relevant person knows or reasonably believes that a transaction is complete, for an isolated transaction, or that the business relationship has come to an end, for an ongoing relationship. Set your firm's retention schedule to this five-year minimum as the default, per client relationship or transaction.

  • Apply a five-year minimum retention period as the default
  • Start the clock from transaction completion for an isolated transaction
  • Start the clock from the end of the business relationship for an ongoing one

Done when: A five-year minimum retention period is applied, started from the correct trigger event

legislation.gov.uk: Money Laundering Regulations 2017, regulation 40
2 Work out when the business relationship actually ended, not just when work went quiet A client going quiet isn't the same as the relationship formally ending.

Because the five-year clock only starts once the business relationship has come to an end, treat this as something your firm actively determines, such as at formal disengagement or closure of the matter, rather than assuming the clock started the moment a client stopped responding. Document the date you've treated as the end of the relationship, since that date is what the retention period is measured from.

  • Record a clear, documented date for when each business relationship ended
  • Don't assume the retention clock started simply because contact went quiet
  • Review dormant client files periodically to confirm whether the relationship has genuinely ended

Done when: A documented end date exists for each business relationship, used as the start of the retention clock

See storing client identity evidence securely
3 Know the ten-year ceiling on transaction records within a relationship Retention isn't open-ended just because a relationship runs a long time.

Regulation 40 also sets an upper limit: records relating to a transaction carried out within a business relationship must not be retained for more than ten years. Build this ceiling into your schedule alongside the five-year minimum, so long-running client relationships don't end up with transaction records kept indefinitely by default.

  • Apply a ten-year ceiling on transaction records within a business relationship
  • Check your retention schedule doesn't default to indefinite storage for long-running clients
  • Delete records once the applicable retention period has genuinely ended, unless another legal reason to keep them applies

Done when: The ten-year ceiling on transaction records is reflected in the retention schedule, and records are deleted once no longer required

legislation.gov.uk: Money Laundering Regulations 2017, regulation 40