What to keep
- Customer identification: the documents sighted or their details, who verified them and when, beneficial ownership findings, the risk rating and its reasons.
- Transaction records for designated services: what was done, for whom, amounts and dates.
- Reports: suspicious matter and threshold transaction reports, with your internal notes and the AUSTRAC receipt.
- The AML/CTF program: every version, with adoption and review dates, and independent evaluations.
- Training records and the compliance officer's appointment.
How long
Identification records: 7 years after the relationship ends. Transaction records: 7 years after the transaction. Program and training records: 7 years after they stop being current.
How to store
Any format is acceptable if it is secure, complete and can be produced on request. The practical test is simple: could you show AUSTRAC, tomorrow, who verified a given client three years ago and what document they saw? Never delete client files; archive them. A timestamped audit trail of changes is the easiest way to prove records were not altered.
Questions people ask
- Can I keep records in my practice management software?
- Yes, if it captures all the fields, keeps history and will not lose the record if the client is removed. Many systems delete or overwrite; check before relying on it.
This guide is general information for accountants, bookkeepers, BAS agents, not legal advice. Check AUSTRAC's current guidance for your situation.