Records and regulatory operations

Understand enrolment, registration, records and regulatory contact.

Records are how a business shows what it decided and why. This topic explains which records the AML/CTF regime expects, when the retention period starts, and what it means to be able to reconstruct a transaction or explain a decision years later.

The later guides cover the tension between access and security, how privacy obligations sit alongside AML information, how to respond to an information request from AUSTRAC, and where legal professional privilege differs from ordinary confidentiality.

• When does the seven-year AML record period start?

  Different AML record types start their seven-year retention period from different events, so identify the right one first.

• Do AML records have to include copies of identity documents?

  Record the information, verification and decision; a document image is not the whole CDD record.

• What does it mean to reconstruct a transaction from records?

  A reviewer should be able to follow what happened using linked evidence.

• What should an AML decision record explain?

  Connect the facts, review steps, outcome and reason so a later reader can follow the decision.

• How can AML records be both accessible and secure?

  Give authorised staff a reliable way to retrieve evidence without exposing it unnecessarily.

• Why keep earlier AML program versions and approval records?

  Preserve the instructions and decisions that applied when work was performed.

• Privacy and AML information

  Privacy duties apply to personal information used for AML obligations, even in small entities. Collection, use, security and retention need separate decisions.

• Responding to an AUSTRAC information request

  Read the legal power, scope, recipient and deadline in the notice. AUSTRAC information powers have different conditions and privilege procedures.

• Legal professional privilege and confidentiality

  Privilege protects qualifying legal communications. Ordinary confidentiality is wider and does not establish privilege. AML reporting has specific conditions.