How Long Can You Keep a Copy of a Client's ID? AML/CTF and Privacy Act Rules

If your firm runs identity checks for AML/CTF, you have probably wondered how long to keep a copy of ID once the check is done. The August 2026 guidance from the Office of the Australian Information Commissioner (OAIC) gives a simpler answer than most firms expect: the law asks you to keep a record of the check, not a copy of the document. A copy you genuinely needed can be held while you verify the client and write down the details. Then it should go.

Here is the difference between the record and the copy, the exceptions, and a practical way to clean up the copies you already hold. It is general information, not legal advice.

The record and the copy are two different things

Section 111 of the AML/CTF Act requires you to keep information that is reasonably necessary to show you met your customer due diligence obligations. The OAIC says that includes records of the type and contents of the information you collected, and of your assessment of money laundering and terrorism financing (ML/TF) risk.

It does not include a picture of the document. In the OAIC's words, the Act "does not require you to keep scanned copies or photocopies of identity documents themselves for record keeping purposes". That applies from 31 March 2026 for existing (Tranche 1) reporting entities, and from 1 July 2026 for Tranche 2 firms such as accountants, lawyers, conveyancers and real estate agents.

The OAIC describes a good record of an identity check as:

• the details your record keeping needs from the document, for example name, date of birth, residential address, expiry date and passport or licence number;
• the type of document;
• what you did to identify the customer; and
• the outcome of your verification, and your assessment of ML/TF risk.

That record is kept for the AML/CTF period, generally seven years after the business relationship ends. Our guide to AML record keeping requirements covers the rest.

Can I keep a copy of a client's passport?

Only if you genuinely need one, and only for as long as you need it. APP 3, the rule about what you may collect, limits you to what is reasonably necessary. The OAIC's fact sheet on the lifecycle of an ID document is direct: "If you decide to collect a copy of a full ID document because it is merely helpful, convenient or desirable, you will not be able to establish reasonable necessity."

It suggests asking whether you could meet your customer due diligence obligations by collecting less, for example by:

• sighting the document instead of copying it;
• recording only the relevant fields from the primary ID document; or
• using digital verification technology that returns a token or a yes/no result.

The OAIC calls the cases where a full copy is reasonably necessary "narrow": it must be genuinely needed in the circumstances, for example because of the ML/TF risk and because other verification methods are unsuitable. Your firm must be able to justify the collection.

How long can you keep a copy of ID?

Where a full copy was reasonably necessary, you can hold it only until that purpose is done. The OAIC's example is initial customer due diligence: a firm that reasonably needed a full ID document "may be permitted to hold it while verifying identity and recording required details from the ID".

After that, section 111 is not a reason to keep it. A firm "should not rely on s 111 alone (of the AML/CTF Act) to continue to retain a copy of an ID document on a long-term basis, as the AML/CTF Act no longer requires this." The OAIC also suggests setting a time limit for each purpose that involves handling ID documents, so you can tell when a copy is no longer needed.

ID document retention under the Privacy Act: APP 11.2

APP 11.2 is the Privacy Act rule about getting rid of personal information. When you no longer need it for any purpose you are allowed to hold it for, you must take reasonable steps to destroy it or de-identify it (remove what identifies the person). That does not apply where an Australian law or a court or tribunal order requires you to keep it.

Reasonable steps depend on your circumstances, including the sensitivity of the information, your firm's size and resources, and the possible harm to the person if it is kept. But a firm is not excused "by reason only that it would be inconvenient, time-consuming or impose some cost" to do it.

If something genuinely cannot be destroyed yet, for example for technical reasons, it can be put "beyond use": you will not use or disclose it, nobody else can be given access to it, it is properly secured, and you commit to destroying it when you can. The OAIC expects that only in very limited circumstances.

The exception: copies made before 31 March 2026

Before 31 March 2026, the AML/CTF Act authorised copies of identification documents to be made and kept. The OAIC says copies made before that date "are records for the purposes of AML/CTF Act" that must be kept for 7 years following the end of the business relationship, or 7 years after the date of the last occasional transaction. Once that obligation is discharged, take reasonable steps to destroy or de-identify them.

The guidance discusses this exception for firms that already had AML/CTF obligations before that date (Tranche 1 reporting entities). If your firm only became a reporting entity on 1 July 2026, ask your adviser whether any older copies you hold fall within it before you rely on it.

For firms still changing long-standing systems, the OAIC expects a commitment to destroy or de-identify copies as soon as practicable, a documented plan with a timeframe, and senior management oversight.

When another law says to keep a copy: e-conveyancing

The OAIC's example of a law that may require you to keep ID copies is state and territory electronic conveyancing participation rules, which "may require the retention of copies of ID documents (time limits may apply)". Conveyancers, lawyers and agents who work on settlements should check which rules apply to them, and keep copies only as long as those rules need. The OAIC suggests independent legal advice on whether another law requires you to keep ID documents.

How to clean up the ID copies you already hold

1. Find them. ID copies collect in inboxes, sent items, shared drives, desktops, downloads folders, phones, paper files and outside systems.
2. Sort them into three groups: copies made before 31 March 2026 that are AML/CTF records, copies another law requires you to keep, and everything else.
3. Check the record first. Before a copy goes, make sure the client file holds the record of the check: the details, the document type, what you did and the outcome.
4. Destroy or de-identify the rest, including duplicates. Where something cannot be deleted yet, put it beyond use and note when it will go.
5. Stop new copies arriving. Do not ask clients to email a passport or licence. Sight the document, record the fields, or use an electronic check.
6. Give someone the job. The OAIC suggests a person or team responsible for regular destruction, a schedule of when information is to be destroyed, staff training, and records of what each outside provider holds for you.

Our Privacy Act guide for AML/CTF reporting entities walks through the other obligations, and the OAIC's own material is at oaic.gov.au/amlctf.

How CompliDesk handles ID photos

CompliDesk keeps the record of each identity check on the client's file: its result, its date and the details read from the ID. From 15 December 2026, it deletes the ID document photos and selfies 30 days after each identity check is finished. A copy someone uploads to a client file by hand is not part of that clean-up, so upload one only when it is needed.

The CompliDesk Privacy Hub builds the list of client information your firm holds from your CompliDesk records, and CompliDesk's staff training includes a 15-minute privacy lesson on keeping the record rather than the copy. The Privacy Hub is included in every CompliDesk monthly plan at no extra cost. See pricing, book a demo, or read the full Privacy Act compliance guide.

Frequently Asked Questions

This article is general information, not legal advice. Related reading: Privacy Act compliance for AML reporting entities · AML record keeping requirements · KYC requirements in Australia (2026) · Collection notices for KYC clients · Data breach response plan template