AUSTRAC Record Keeping Requirements: What Must You Retain and For How Long?

Under the AML/CTF Act, reporting entities must retain certain records for 7 years. This requirement applies to customer identification records, transaction records, AML/CTF program documents, and reporting records. Here's exactly what must be kept and how.

Which records must be retained?

Customer identification records: All KYC documents, verification results, identity documents collected, beneficial ownership information, and any updates to customer records. Retained for 7 years from the end of the relationship.

Transaction records: Records of all transactions — including the amount, date, parties involved, and the method of payment. Retained for 7 years from the date of the transaction.

AML/CTF program records: Your written AML/CTF program (including all versions), risk assessments, and independent review reports. Retained for 7 years after the program ceases to have effect.

Reporting records: Copies of all SMRs and TTRs lodged with AUSTRAC. Retained for 7 years from the date of lodgement.

Format requirements

Records can be kept in electronic or paper format. AUSTRAC does not prescribe a specific format, but records must be legible and accessible. Cloud-based compliance software that automatically archives records in a searchable format satisfies AUSTRAC's requirements.

Producing records to AUSTRAC

AUSTRAC can request records at any time — during a compliance assessment, investigation, or audit. You must be able to produce records within the timeframe specified in the request, which may be as short as 24 hours in urgent cases.

Privacy Act considerations

The 7-year retention requirement for AML/CTF purposes overrides the Privacy Act's principle of not retaining personal information longer than needed. However, retained information can only be used for AML/CTF compliance purposes — not for marketing or other business purposes.

What happens if records are incomplete?

Failure to maintain adequate records is an AML/CTF breach in its own right — separate from any underlying compliance failure. AUSTRAC can take enforcement action for record-keeping failures even if the underlying transactions were legitimate.

How CompliDesk handles record keeping

CompliDesk automatically maintains a full audit trail for every client — every identity check, screening result, risk assessment, questionnaire answer and compliance decision. The evidence pack can be downloaded as a PDF for any client at any time, producing a complete 7-year-ready compliance record in minutes.

Related reading: What your AML/CTF Program must include · SMR and TTR reporting guide · Suspicious Matter Reports guide · Frequently asked questions