KYC Record Keeping Requirements: What To Keep and How Long

KYC record keeping requirements oblige a regulated firm to keep customer identity evidence, verification results, screening decisions and transaction records for a set minimum period after the relationship ends, usually five years. The records must be retrievable, readable and complete enough that a supervisor can reconstruct who the customer was and why you accepted them.

That last part is where most firms slip. They keep the passport scan. They lose the note explaining why a screening hit was cleared.

Record keeping is tested first in any examination, because it is the easiest thing for a reviewer to sample. A gap in your files is visible in minutes.

What counts as a KYC record

A KYC record is any document or data point you relied on to identify a customer, assess their risk, or justify a decision about them. It is wider than the identity documents. Think of it as the evidence trail behind a yes or a no.

Identity and verification evidence

For a natural person this is the name, date of birth, residential address and an identification number, plus the document you checked them against. A passport, a national identity card or a driving licence. Keep the copy or the image, the data extracted from it, and the result of the check. If you used an electronic verification service instead of a document, keep the reference number and the outcome the provider returned.

For a company, keep the certificate of incorporation, the registered address, the company number, and the register extract with the date you pulled it. An undated extract is close to worthless in a review.

Beneficial ownership and control

Keep the ownership structure you built, not only the final list of names. A reviewer wants to see the chain. Who owns the intermediate holding company, what percentage, and what source told you so. Where control is exercised through something other than shares, a shareholder agreement or a right to appoint directors, record that too. Sanctions rules that aggregate ownership across several holders depend on you having the percentages written down, which is one reason the fifty percent aggregation rule is hard to apply on files that list only a single beneficial owner.

Screening and risk decisions

Every sanctions, watchlist and politically exposed person check produces a record, including the clean ones. A no-hit result is evidence that you looked. Keep the name string you searched, the lists covered, the date, the match threshold or fuzziness setting, and the outcome.

Also keep the customer risk rating, the factors that drove it, and who approved any override. If a relationship was escalated for enhanced due diligence, keep the source of funds or source of wealth material you collected and the sign-off.

Activity and programme documents

Transaction records sit alongside the customer file. So do the programme level documents that a supervisor will ask for separately: the business risk assessment, the policy and procedure set with version history, board or senior management approvals, training logs, and internal audit or independent testing reports. Suspicious activity reports and their working papers are a distinct category, and usually carry confidentiality rules limiting who may see them.

How long KYC records must be kept

The international baseline comes from the FATF Recommendations, which set five years as the minimum for customer due diligence files and transaction records. National law implements that, and national law is what binds you.

In the United States the Bank Secrecy Act framework uses five years. The European Union’s anti money laundering directives set a five year minimum and allow member states to extend it, which several have, so a group operating across Europe will often find its longest national requirement becoming the group standard. The EU is moving from directives to a directly applicable regulation, which will narrow the variation between member states over time.

Two things push the period longer. First, sectoral licences. Some regulators set six or eight years for particular licence categories, and virtual asset firms are often given a longer period than banks in the same jurisdiction. Second, sanctions. OFAC extended its own recordkeeping requirement beyond the traditional five years to match a longer limitation period for sanctions violations, so records that touch blocked or rejected transactions need to survive longer than the rest of the file.

Tax law, company law and contract limitation periods impose their own periods on overlapping documents. Set your schedule to the longest applicable requirement for each record class.

When the retention clock starts

This is the detail most guidance skips, and it is where firms delete too early. The clock does not start when you collected the document. It starts at a trigger event that differs by record class.

Record class	When the clock usually starts	What the file must contain
Customer identity and verification	End of the business relationship, not account opening	Document image, extracted data, verification result, date, who performed it
Beneficial ownership	End of the business relationship	Ownership chain, percentages, control rights, source and date of each
Occasional transaction, no ongoing relationship	Date of the transaction	Amount, currency, counterparty, instruction, identity evidence taken
Screening results	Date of the screening run, or end of relationship where tied to a customer	Name searched, lists and list versions, threshold, hits, disposition, reviewer
Blocked or rejected sanctions transaction	Often when the property is released, not when it was blocked	Full payment detail, the list entry matched, the report filed, release authority
Suspicious activity report	Date of filing	The report, the underlying alert, the analysis, the decision maker
Policies, risk assessment, training	Date the version was superseded	Version number, effective dates, approver, attendance and test results

Note the asymmetry in the middle rows. A one off transaction for a walk in customer ages out from the transaction date. A customer you onboarded ten years ago and still serve has identity records that have not started their clock at all. Systems that apply a single retention rule by creation date get both of those wrong.

Format, integrity and retrieval

Most regimes accept electronic records. What they will not accept is a record you cannot produce on request, cannot read, or cannot prove was unaltered.

Three practical standards to hold yourself to:

1. Retrievability. You can produce a named customer’s full file, including screening history, within the time a supervisor allows. Set a target measured in hours and test it.
2. Legibility. A scan that is unreadable at normal magnification is not a record. Check a sample each year.
3. Integrity. You can show who created or changed a record and when. That is the job of an audit trail, and it is what turns a stored file into evidence.

Format obsolescence is a real risk over a ten year horizon. Proprietary files from a vendor you no longer use are the usual casualty. Export to an open format when you change vendors.

The practical test regulators apply is reconstruction. Take one payment from four years ago and show the originator, the beneficiary, the amount, the currency, the date, the instruction as received, and the screening that ran against it. Run that drill twice a year on a random sample. The common failure is that the payment sits in a core banking system, the screening result sits in a separate tool, and nothing joins them except a timestamp both systems record differently.

Screening evidence is its own record class

A screening record has to answer four questions years after the fact: what did you search, what did you search against, what came back, and what did you do about it. Storing only “cleared” fails all four.

List versions matter here. Sanctions lists change frequently, so the fact that a name was clear on a given date means nothing unless you can show which version of which list was loaded. Good tooling stamps the list version onto the result. If you are building the discipline from scratch, the practices in record keeping for denied party screening transfer directly to KYC files, and you can test your own name matching against a free denied party screening tool before committing to a process.

False positives need the most careful documentation, because clearing a hit is a decision to proceed. Record the discriminating data point. The date of birth that differed, or the country that did not match, rather than the bare conclusion. The method in this guide to resolving a false positive in denied party screening produces exactly the kind of note that survives a review.

Records held by third parties

Outsourcing the work does not outsource the obligation. If an introducer or a verification vendor performs due diligence for you, most regimes require you to obtain the underlying records without delay, and many supervisors expect copies rather than a contractual promise.

Write the exit into the contract. Three clauses do most of the work: the vendor provides a full export in an open format on termination, the vendor keeps nothing after a stated wind down period, and the vendor notifies you before deleting anything. Vendor insolvency is the scenario people forget. A liquidator has no interest in your retention schedule.

Legal holds and when deleting becomes a problem

A retention schedule is a floor, not an instruction to delete. The moment you become aware of an investigation, a production order, a regulatory review, litigation, or a request from a financial intelligence unit, the automatic deletion for the affected records has to stop.

Build a hold mechanism before you need one. It should let a named person suspend deletion for a defined set of customers or date ranges, record why, and release the hold later with a second sign off. Deleting on schedule while under scrutiny looks bad even when it is innocent, and in some jurisdictions it is a separate offence.

Deleting records once the period ends

Data protection law pulls the other way from AML law. Personal data collected for a legal obligation should not be kept indefinitely once that obligation expires. Several European supervisors have been explicit that keeping KYC files forever is not a safe default.

A workable approach has four parts:

• Write the retention period for each record class into a schedule, with the trigger event and the legal basis beside it.
• Run deletion as a scheduled process with a report, so you can show what was deleted and when.
• Delete from backups and secondary copies on a defined cycle, and document that cycle. Backup tapes are where deleted records quietly survive.
• Keep a minimal deletion log after the file is gone. The log proves you complied with both sets of rules.

What reviewers actually look for

Examiners sample. They pull a few files across risk tiers and test them against your own written procedure. The first finding is always the gap between what you said you would do and what the file shows.

Typical findings: missing evidence for the beneficial owner of a layered structure, screening results with no reviewer name, risk ratings with no supporting factors, enhanced due diligence files with no source of wealth material, and periodic reviews recorded as complete with nothing attached. Onboarding controls and record quality are linked, which is why sanctions screening in customer onboarding and file quality tend to fail together or pass together. If your firm also moves goods, the parallel obligations in customs record retention often run on a different clock, and running two schedules from one policy is a common source of error.

Key takeaways

• Five years after the end of the business relationship is the common minimum for KYC files, drawn from the FATF Recommendations and implemented in national law.
• The retention clock starts at a trigger event that differs by record class, which is why a single creation date rule deletes some records too early.
• Screening evidence must record the name searched, the lists and list versions, the threshold, the hits and the disposition, including clean results.
• Records that touch blocked or rejected sanctions transactions generally need to be kept longer than the rest of the customer file.
• Outsourced due diligence stays your obligation, so contract for a full export on termination and for notice before any deletion.
• Deletion must stop the moment an investigation, production order or review begins, and a hold mechanism should exist before that day.
• Data protection law expects deletion once the AML period expires, so indefinite retention is not a safe default.

Frequently asked questions

How long should KYC documents be kept after an account closes?

Five years after closure is the usual minimum, measured from the end of the business relationship rather than from the date you collected the document. Check your own national rule, because several jurisdictions set longer periods and some sectoral licences run to six or eight years. Where more than one law applies to the same record, keep it for the longest period.

Do electronic copies satisfy KYC record keeping requirements?

In most regimes, yes. The conditions are that the copy is legible, complete, retrievable within a reasonable time, and supported by controls showing it has not been altered. Keep the audit trail alongside the image. A scanned document with no record of who scanned it, when, or from what original is weaker evidence than firms assume.

Does GDPR conflict with KYC retention?

The two fit together if you are precise. Retention during the AML period rests on a legal obligation, which overrides a deletion request. Once the period ends, that basis falls away and the data should be deleted unless another law requires it. Document the period, the trigger and the basis for each record class, and the tension mostly disappears.

Do I need to keep screening results that found nothing?

Yes. A clean result is the only proof that the check happened. Without it you cannot show a supervisor that a customer was screened at onboarding or rescreened after a list update. Store the search terms, the lists covered, the date and the outcome. Aggregate counts alone will not support a file level review.

What happens to KYC records when a business is sold or wound up?

The obligation follows the records. An acquirer normally takes on retention for the customers it buys, and the seller needs a defensible position on what it keeps and why. On a wind up, the firm still has to arrange for records to be retained and retrievable for the remaining period. Address this in the sale agreement or the wind down plan, not afterwards.

How quickly must records be produced to a regulator?

The standard is usually expressed as without undue delay rather than as a fixed number of days, and the deadline is set in the request itself. Treat same day retrieval for any single customer file as the internal target. Test it with a live drill, because the gap between a stated capability and an actual one is exactly what an examination exposes.

If you want to pressure test your own files, start with the screening evidence, since it is the class most often thin. You can run a denied party screening check against a live name and compare the output with what your current process stores. More background on screening and trade compliance sits on Globalior’s free screening tool site, and if you would like to talk through a retention schedule for your own business, get in touch with the team.