Recordkeeping requirements are the rules that oblige banks, money transmitters, broker-dealers, crypto businesses and other regulated firms to create and keep records of their customers and transactions for a set period, and to produce them when an authority asks. They exist so that supervisors, auditors and law enforcement can reconstruct who did what, when and with whose money, often years after the event.
They sit alongside, and feed, regulatory reporting: reports send selected data to the authorities, while records stay with the firm until requested. The most widely applied rules come from anti-money laundering law, but sanctions, securities, tax, consumer and data-protection laws add their own requirements and sometimes pull in opposite directions.
Recordkeeping requirements in plain terms
Many households keep a shoebox of receipts in case the tax office asks questions. Recordkeeping rules are a much stricter version of that shoebox: the law says which receipts must go in, how long they must stay, and that the owner must be able to find any one of them quickly.
For a bank or payment company, the receipts are the copies of customers' identity documents, the details of each payment, and the notes explaining decisions. If an investigator turns up five years later asking about a single transfer, the firm must be able to show who sent it, who received it and what checks were made.
What must be kept
- Customer identification. Documents and data gathered under know your customer (KYC) and customer due diligence (CDD), including beneficial ownership information for companies.
- Transaction records. Enough detail to reconstruct each transaction: amounts, dates, parties, accounts and instructions.
- Funds-transfer data. Originator and beneficiary information that travels with payments under the travel rule, including the FATF travel rule for virtual-asset transfers.
- Analysis and decisions. Alert reviews from transaction monitoring, sanctions-screening matches, copies of suspicious activity reports and their supporting documents, and the firm's AML risk assessment.
- Program evidence. Training logs, board minutes, policies in force at each date, results of compliance testing and audit reports.
Retention periods
FATF Recommendation 11 sets the global baseline: records of transactions and of customer due diligence should be kept for at least five years. National rules build on it:
| Rule | Typical period (as of 2026) |
|---|---|
| US Bank Secrecy Act records (31 CFR 1010.430) | Five years |
| US sanctions records kept for OFAC (31 CFR 501.601) | Ten years, extended from five in 2025 |
| UK Money Laundering Regulations 2017, regulation 40 | Five years after the transaction completes or the relationship ends; transaction records within a relationship need not be kept beyond ten years |
| EU Anti-Money Laundering Regulation (EU) 2024/1624, from 10 July 2027 | Five years, then deletion of personal data unless authorities require a further period of up to five years |
In the US, specific rules add detail. Banks and non-bank financial institutions must keep records of funds transfers of USD 3,000 or more, and sellers of money orders, cashier's checks and similar instruments must log cash purchases of USD 3,000 to USD 10,000. A money services business must keep these records ready for its state regulator and for an IRS Title 31 audit.
Form, retrieval and integrity
Most laws accept electronic records, but they must be complete, protected from alteration and retrievable within a reasonable time. In practice that means indexed storage, access controls, backups and an audit trail showing who changed what. Broker-dealers face particularly detailed electronic-storage rules from the US Securities and Exchange Commission. Records held by outsourced providers, cloud platforms or a sponsor bank's fintech partner remain the regulated firm's responsibility, so contracts must guarantee access, which ties recordkeeping to vendor risk management. Data security controls protect records from breach throughout the retention period.
Conflict with data-protection law
Retention duties clash with the principle that personal data should not be kept longer than needed, set out in the General Data Protection Regulation (GDPR). The EU resolves this inside its AML law by requiring deletion once the AML period ends. A firm subject to both US and EU rules can therefore face a ten-year US sanctions retention period and a five-year EU deletion duty for the same customer. Firms handle it with a records schedule that lists each record type, the laws that apply, the longest required period and the legal basis for keeping it, reviewed by both compliance and data privacy teams, and rated in the compliance risk assessment like any other obligation of the compliance management system. Gaps in records are a frequent AML audit finding because without them no other control can be proved.