Record-Keeping & Retention Requirements under AMLA

Section 17 of AMLA requires reporting institutions to keep records of transactions and customer information. The governing principle from the FATF standards and BNM's policy document is simple: records must be sufficient to permit the reconstruction of individual transactions so that they can be used as evidence in prosecuting criminal activity.

Records span both the customer relationship and the transactions within it:

• CDD records — identification and verification documents for customers and beneficial owners
• Account files and business correspondence
• Records of transactions, including amounts, currencies, dates and parties
• Results of any analysis undertaken (for example, assessing a complex or unusual transaction)
• Copies of reports made to the authorities and the supporting materials
• Records of the compliance officer's decisions, including reasoned decisions not to file an STR

Records must be retained for at least the period required by AMLA and the applicable policy documents — generally measured from the completion of the transaction or the end of the business relationship. Where records relate to an ongoing investigation or a reported matter, they should be retained until the authorities confirm the matter is closed.

Record-keeping is not administrative housekeeping — it is what makes an investigation possible. When law enforcement traces proceeds of unlawful activity, the institution's records are the evidential chain. Poor records mean an investigation stalls, and the institution itself may be found to have breached its statutory duty.

• A retention schedule mapped to each record type and the statutory minimum
• Secure storage with access controls and integrity protection
• The ability to link a customer to all their transactions and reports
• Retention holds for records connected to investigations or filed reports
• Periodic testing that archived records can actually be retrieved