AML record retention — what to keep, and how long
Retention looks like an IT setting until a supervisor asks for a file and finds it redacted, or gone. Article 77 of Regulation (EU) 2024/1624 names four classes of record, sets a five-year clock that starts at the end of the relationship rather than at creation, and adds a sentence that quietly rules out a common archiving practice: documents, information and records kept under the article must not be redacted. Article 78 then makes the archive searchable on demand, and Article 76 constrains what you may lawfully hold in it. This piece sets out all three, the dates they bite, and how to build a retention schedule that survives an inspection.
1. When this applies, and what governs until then
The Regulation applies from 10 July 2027 — except for the obliged entities referred to in Article 3, point (3)(n) and (o), for which it applies from 10 July 2029. Until the 2027 date, retention is governed by the national law transposing Directive (EU) 2015/849, which is where most of the divergence a group encounters today comes from.
Article 77(4) carries a transitional rule worth reading before you design a deletion job. Where, on 10 July 2027, legal proceedings concerned with the prevention, detection, investigation or prosecution of suspected money laundering or terrorist financing are pending in a member state, and the obliged entity holds information or documents relating to those pending proceedings, it may retain them for five years from 10 July 2027. Member states may allow or require a further five years where the necessity and proportionality of that further retention have been established.
The practical reading: there is a cohort of records whose clock is pinned to a fixed calendar date rather than to a relationship event, and they need to be identifiable in the archive before that date arrives — not reconstructed afterwards.
2. The four classes
| Limb | What must be retained |
|---|---|
| (a) | A copy of the documents and information obtained in performing customer due diligence under Chapter III, including information obtained through electronic identification means |
| (b) | A record of the Article 69(2) assessment — the information and circumstances considered and the results — whether or not it resulted in a suspicious transaction report, plus a copy of the report if any |
| (c) | Supporting evidence and records of transactions: original documents or copies admissible in judicial proceedings under the applicable national law, necessary to identify transactions |
| (d) | Where the firm participates in information-sharing partnerships under Chapter VI, copies of the documents and information obtained there and records of all instances of information sharing |
Limb (b) is the one most often missing. The record of an assessment that concluded no report is expressly retainable — so a system that only stores filed reports is not compliant, and the negative decisions are exactly what an inspection samples. Limb (a)’s reference to electronic identification means matters for remote-onboarding firms: the evidence produced by the identification flow, not merely its outcome flag, is the record.
3. The five-year clock, and where it starts
Retention runs for five years, and the start date is the point people get wrong. It commences on the date of:
- the termination of the business relationship; or
- the carrying out of the occasional transaction; or
- the refusal to enter into a business relationship or carry out an occasional transaction.
Personal data must then be deleted on expiry of the five-year period, without prejudice to retention periods for data collected for the purposes of other Union legal acts or national law complying with Regulation (EU) 2016/679. Deletion is an obligation, not an option — over-retention is a finding in its own right.
Competent authorities may require further retention on a case-by-case basis where necessary for preventing, detecting, investigating or prosecuting money laundering or terrorist financing, and that further period shall not exceed five years. A case-by-case extension is therefore an instruction about identified records, not a licence to keep everything longer.
Worked example — the applicant you turned away. A payments firm declines an onboarding application after adverse findings, and its archiving rules key retention to account opening. No account was opened, so nothing is scheduled. Rule: the clock commences on the date of refusal to enter into the business relationship, and the CDD evidence obtained during the attempt falls in limb (a). What the team does: adds “refused” and “abandoned after CDD started” as retention-triggering events in the record schedule, keeps the identification evidence and the reasoning unredacted, and sets deletion at refusal date plus five years. Outcome: the population a supervisor most often asks about — who you rejected and why — exists. A firm that only retains accepted customers has destroyed the evidence of its own controls working.
4. References instead of copies — on three conditions
Article 77(2) offers a genuine relief, and it is conditional in ways that are easy to miss. A firm may replace the retention of copies with the retention of references to the information, provided the nature and method of retention ensure that the firm can provide the information to competent authorities immediately and that the information cannot be modified or altered.
A second obligation attaches to using the derogation: the firm must define, in the internal procedures drawn up under Article 9, the categories of information for which it retains a reference rather than a copy or original, and the procedures for retrieving that information so it can be provided on request. Using the relief without documenting it in the Article 9 procedures is itself a gap.
Worked example — the identity documents you never stored. An e-money institution onboards through an external identification flow and keeps only a reference to the verification record held upstream. Rule: references are permitted where retrieval is immediate, the information is immutable, and the arrangement is named in the Article 9 procedures. What the compliance officer does: tests retrieval end to end against a stopwatch rather than assuming the integration works; confirms contractually and technically that the upstream record cannot be altered or purged inside the five-year window; and writes the categories covered and the retrieval steps into the internal procedures. Outcome: either a documented, defensible reference arrangement, or the discovery that retrieval takes days and the firm needs copies after all — which is much cheaper to learn in a test than in an inspection.
5. Retention is not the whole duty
Article 78 adds the retrieval side. Firms must have systems in place enabling them to respond fully and speedily to enquiries from their FIU or other competent authorities, in accordance with national law, as to whether they are maintaining or have maintained — during a five-year period prior to the enquiry — a business relationship with specified persons, and on the nature of that relationship. The response must travel through secure channels and in a manner that ensures full confidentiality of the enquiries.
That is a searchability requirement, not a storage one, and it carries two design consequences. Cold archive that satisfies Article 77 but cannot answer an Article 78 enquiry within a workable time leaves the firm compliant on paper and exposed in practice. And the confidentiality of the enquiry itself constrains the workflow: a request routed through a general ticketing queue, or answered by asking the relationship owner to check, leaks the fact of the enquiry to exactly the people who must not see it.
Worked example — the FIU list arriving on a Friday. An FIU asks whether the firm has held a relationship with eleven named individuals at any point in the last five years, and what the nature of each relationship was. Rule: Article 78 requires a full and speedy answer over secure channels with full confidentiality of the enquiry. What the firm does: runs the search against a single index that spans live and closed customers, including refused applicants, rather than querying the production database and hoping the closed population is still there; routes the whole matter through a restricted-access case type visible only to the AML function; and answers on the nature of the relationship, not merely yes or no. Outcome: a complete answer in days, from one index, without the enquiry becoming visible to commercial teams — which is the part firms most often get wrong even when the data is there.
6. What you may lawfully hold: Article 76
Retention sits inside the data-protection frame set by Article 76, and a retention schedule that ignores it will preserve records the firm was not entitled to process in the first place.
- Special categories and criminal-offence data. These may be processed only so far as strictly necessary for preventing money laundering and terrorist financing, and subject to conditions: customers must be informed that such categories may be processed for compliance purposes; the data must come from reliable sources and be accurate and up to date; decisions leading to biased or discriminatory outcomes must not be taken on the basis of that data; and high-level security measures under Article 32 of Regulation (EU) 2016/679 must be adopted, in particular as to confidentiality.
- Criminal convictions and offences. Beyond those conditions, the data must relate to money laundering, its predicate offences or terrorist financing, and the firm must have procedures distinguishing allegations, investigations, proceedings and convictions — respecting the right to a fair trial, the right of defence and the presumption of innocence.
- Purpose limitation. Personal data processed on the basis of the Regulation may be used only for AML/CFT purposes and not further processed incompatibly. Processing it for commercial purposes is prohibited.
- Automated decisions. Decisions from automated processes, profiling or AI systems are permitted only where the data processed is limited to data obtained under Chapter III; where any decision to enter, refuse or maintain a relationship, to carry out or refuse an occasional transaction, or to increase or decrease the extent of due diligence, is subject to meaningful human intervention; and where the customer can obtain an explanation of the decision and challenge it — except in relation to a report under Article 69.
Read together with Article 77, this produces a rule of thumb: everything you retain must be something you were entitled to collect, held for the AML purpose only, and never recycled into pricing, marketing or product analytics. A data lake that mixes CDD evidence with commercial attributes fails on purpose limitation long before anyone examines the retention period.
7. Building the schedule
The gap between the articles and a working control is a mapping document. Four columns are enough, and the exercise usually surfaces at least one record class nobody owns.
| Record class | Where it actually lives | Clock trigger | Deletion owner |
|---|---|---|---|
| CDD evidence, including electronic identification output | Onboarding store, document store, upstream identification provider | Relationship termination / occasional transaction / refusal | Named function, with a scheduled job |
| Article 69(2) assessments — reported and not reported | Case management | Same triggers as the underlying relationship | AML function |
| Transaction supporting evidence | Ledger, payment message archive | Transaction date for occasional transactions | Finance or operations, with AML sign-off |
| Information-sharing records | Partnership log | Per underlying relationship; every instance logged | AML function |
| Records under a case-by-case extension or the Article 77(4) transitional | Legal hold | Authority instruction, or 10 July 2027 | Legal, with an explicit release date |
Two controls make the schedule real rather than declaratory: a periodic test that picks records at random and checks they are retrievable and unredacted, and an exception report for records past their deletion date that a legal hold does not explain.
8. FAQ
Does the five years run from onboarding?
No — from the termination of the business relationship, the carrying out of the occasional transaction, or the refusal. An archive keyed to the creation date will delete records that are still required.
Do we keep the assessments that did not result in a report?
Yes. Article 77(1)(b) covers the Article 69(2) assessment whether or not it resulted in a suspicious transaction report, including the information and circumstances considered and the results.
Can an authority extend the period?
Yes, case by case, where necessary for the prevention, detection, investigation or prosecution of money laundering or terrorist financing — and the further period may not exceed five years.
May we keep a pointer instead of the document?
Yes, under Article 77(2), provided you can provide the information to competent authorities immediately, it cannot be modified or altered, and your Article 9 internal procedures define the categories concerned and the retrieval procedures.
When does the Regulation start to apply?
From 10 July 2027, except for the obliged entities in Article 3, point (3)(n) and (o), from 10 July 2029. National law transposing Directive (EU) 2015/849 governs until then.
Is five years also the maximum?
Not across the firm. The AMLR deletion duty operates without prejudice to retention periods for data collected under other Union legal acts or national law complying with the GDPR — so document which longer period applies to which records, and why.
9. What to do, today
- Add refusal and abandonment as retention-triggering events, not just relationship closure.
- Check that unreported assessments are stored with the circumstances considered, and sample a few for completeness.
- Search your pipelines for masking applied at archive time, and remove it from the AML record path.
- Test an Article 78 enquiry end to end against a named list, across live, closed and refused populations, and time it.
- Route enquiries through a restricted case type so the confidentiality duty is enforced by access control rather than by discretion.
- Write the reference-instead-of-copy categories into the Article 9 procedures if you rely on that derogation.
- Identify records tied to pending proceedings now, so the Article 77(4) cohort is flagged before 10 July 2027 rather than reconstructed after it.
Related: Tipping-off · Ongoing monitoring · AMLR governance · The EU AML package timeline
