Country-specific guidance Current

Setting a record-retention schedule for CDD evidence

A minimum retention period, and a separate duty not to over-retain.

Hong Kong's AML/CTF framework sets a retention minimum, and separately, the Personal Data (Privacy) Ordinance says not to keep personal data longer than necessary. Both apply at once. This guide sets out how. It is general information, not legal or compliance advice.

Action plan

1 Retain CDD records for at least 5 years after the relationship ends The clock runs from when the relationship ends, not from when it started.

HKICPA's AML/CTF Guidelines reflect a 5-year record-keeping retention requirement running from the end of the business relationship with the customer, consistent with the AML/CTF record-keeping framework accounting professionals operate under. Track this per client relationship's end date, not from the date the file was opened.

  • Retain CDD records for at least 5 years from when the client relationship ends
  • Track the retention period from the end date, not the start date, of the relationship
  • Apply this minimum consistently across client files, not case by case

Done when: CDD records are retained for at least 5 years from the end of the relevant client relationship

HKICPA: AML/CTF Guidelines for Professional Accountants
2 Don't keep personal data indefinitely once the purpose has passed DPP2 cuts the other way from a "just in case" retention habit.

Data Protection Principle 2 of the Personal Data (Privacy) Ordinance requires taking all practicable steps to ensure personal data is not kept longer than necessary for the purpose it was collected for, and section 26 separately requires erasing personal data that's no longer required unless the law says otherwise or it's contrary to the public interest to do so. Once your AML/CTF retention minimum has genuinely passed and no other lawful purpose applies, don't keep the evidence indefinitely by default.

  • Apply the AML/CTF retention minimum as a floor, not a target to hold indefinitely
  • Review whether a genuine ongoing purpose exists before keeping data past that minimum
  • Erase or archive out records once no lawful purpose for keeping them remains

Done when: Retention past the AML/CTF minimum is only continued where a genuine, identified purpose still applies

PCPD: the Personal Data (Privacy) Ordinance at a glance
3 Track retention per client relationship, with a documented schedule A schedule you can point to beats a rule everyone is expected to remember.

Set out your firm's retention periods and their trigger dates in a documented schedule covering CDD evidence, rather than leaving staff to work it out case by case. This makes both the AML/CTF minimum and the PDPO retention-limitation duty something your firm can actually demonstrate it applies consistently.

  • Document the retention period and its trigger date for each category of record kept
  • Make the schedule available to staff responsible for client files, not just to compliance
  • Review the schedule when either the AML/CTF or PDPO framework changes

Done when: A documented retention schedule, covering both the AML/CTF minimum and PDPO's limitation duty, is in use

See storing client identity evidence securely