AML Documentation in the UK: Records, Retention and Review Decisions

UK AML documentation includes business-wide risk assessments, policies, training records, customer due diligence files, transaction records and evidence of screening and reporting decisions. It should explain what the firm knew, which controls applied and why someone approved, escalated or stopped an activity. Identity documents alone cannot answer those questions; a case marked “reviewed” still needs retrievable evidence.

This guide covers UK AML record categories, their connection to decisions and the different retention rules. It complements the general AML compliance guide, which explains how to organise the wider programme.

Establish which requirements apply

The Money Laundering Regulations 2017 (MLR) impose obligations on businesses within their scope, described as relevant persons. Sector, activity and supervisory rules matter. A business outside the MLR scope should not assume that every requirement below applies to it. UK sanctions obligations require a separate assessment and are not confined to MLR-regulated businesses.¹²

Distinguish statutory obligations, supervisory guidance and the operational practices recommended here. Suggested record fields are not automatically legal requirements. Sector-specific rules may add to this overview.

Map each record to the control it explains

Assign each record category an owner who can explain its purpose and retention basis.

Regulations 18, 19, 21 and 24 address different aspects of governance. In particular, Regulation 21's internal-control and independent-audit requirements depend on what is appropriate to the business's size and nature. The appropriate audit arrangements therefore vary between firms.³⁴⁵⁶

Connect policy versions to customer decisions

Preserve dated policy versions and their approval history. Link a material customer decision to the procedure and configuration used at the time, rather than replacing its context whenever the current policy changes.

For customer due diligence (CDD), retain the documents and information obtained to meet the applicable requirements, alongside sufficient supporting transaction records. Record provenance and dates so a later reviewer can distinguish customer-supplied information from independent checks and subsequent corrections.⁷⁸

A practical customer-risk record connects the relevant facts to the assessment method, final category, any override and the responsible reviewer. See the customer-risk assessment methodology for the assessment itself. The documentation question is whether another reviewer can follow the reasoning without relying on the original analyst's memory.

Link customer, case and transaction records with stable references. Avoid unnecessary personal-data copies scattered across email and local drives.

Keep PEP and sanctions reasoning distinct

For a possible politically exposed person (PEP), record identity resolution, qualifying role or relationship and dates, then the risk assessment, measures and approvals.

Regulation 35 requires a risk assessment and proportionate enhanced measures. For domestic PEPs and their relevant family members or known close associates, the statutory starting point is lower risk than for non-domestic PEPs; absent enhanced risk factors, the extent of enhanced due diligence is lower. This does not remove the applicable measures or make every PEP an identical high-risk case.⁹ The PEP screening guide explains the review process in more detail.

For sanctions, retain the supplied party details, candidate entry, applicable authority, source context and the evidence supporting or contradicting identity. Record ownership or control questions separately from the direct name match. Then explain the relevant restriction and action. A candidate is not a confirmed target match, and an internal operational pause is not the same as a statutory asset freeze.²

Where a licence is relevant, retain its reference, scope, conditions and the assessment connecting it to the proposed activity. A Defence Against Money Laundering (DAML) is not an OFSI licence. An internal approval or legal opinion does not override a prohibition. Use the sanctions alert investigation guide for the evidence to retain in each case.

Record reporting decisions without widening access

Keep internal escalation, the nominated officer's assessment of internal suspicions, an external suspicious activity report (SAR) and any DAML request distinguishable. “Reported” should identify the actual submission and reference, not merely that an analyst opened an internal case.

Where the nominated officer decides not to submit a SAR, retain the material considered and the reasoning against the applicable reporting threshold. Lack of external corroboration alone is not a sufficient rationale: suspicion does not require proof. HMRC's guidance for businesses it supervises addresses both submitted reports and decisions not to report.¹⁰

Restrict access to reporting records appropriately. Tipping-off and prejudicing-an-investigation offences have specific conditions and scope under POCA and terrorism legislation. Whether a particular disclosure is prohibited depends on those conditions. Handle information requests and communications through the appropriate legal and reporting process.¹¹

Apply the right retention clock

Start with the record category and triggering event, not a generic “created date plus five years” setting.

Regulation 40(5) requires deletion of relevant personal data after the applicable period unless an exception applies: retention required by an enactment or for court proceedings, consent, or reasonable grounds to retain it for legal proceedings. Record the actual basis; consent is not a general permission to keep everything indefinitely.⁸

The ICO's storage-limitation guidance requires justified retention and periodic review. Define who can authorise an exception or hold, when it will be reviewed and how deletion will be checked. Do not use “might be useful one day” as the retention policy.¹²

Test retrieval, migration and disposal

Choose a completed case and ask someone outside its original review team to reconstruct the decision using their permitted access. Can they find the evidence, identify the reviewer and distinguish an original record from a later amendment?

Repeat for an old policy, training record and restricted reporting record. Test retrieval after account closure, staff departures and provider migration. Record failures and corrective action.

Check disposal triggers, exceptions and connected copies. A deletion task is incomplete if unmanaged exports remain indefinitely.

Evaluate software against the records you need

Ask a provider to retrieve a historic screening decision and explain what survives data or configuration changes. Verify inputs, source context, reviewer attribution, amendments, retention, access and export arrangements. Check contractual and technical limits behind the “audit trail” label.

Checklynx groups screening candidates into profiles with available structured identity and source context, helping reviewers compare supplied parties with candidates. That supports investigation; it does not establish identity, decide legal consequences or replace the firm's policy, training and reporting archives. Assess the audit trail and evidence solution against your actual retrieval requirements and confirm the arrangements you need before procurement.

Three practical examples

These hypothetical examples illustrate what a decision record should explain.

A customer shares a PEP's name. Keep the supplied identifiers and candidate context, explain identity resolution and record any remaining uncertainty. If the person qualifies, retain the risk and measures assessment rather than automatically assigning the same risk category to every PEP.

A sanctions candidate affects a planned payment. Preserve the identity and restriction analysis. If proceeding depends on a licence, document that the activity falls within its terms and conditions. A case note saying “MLRO approved” cannot substitute for the required legal authority.

An internal report does not lead to a SAR. Retain the facts considered, threshold assessment, decision-maker and date with appropriate access restrictions. Record further work where necessary; “no external evidence found” does not answer whether the reporting threshold was met.

Frequently asked questions

Must every AML document be kept for five years?

No. Regulation 40 covers specified CDD and transaction records with particular triggers and deletion provisions. Reporting guidance has its own context, while policy, training and review records need an appropriate retention basis.

Is a screening result enough to document a decision?

A result shows what the system returned. The decision also needs relevant identity evidence, analysis, action and attribution. Preserve enough context to explain the outcome without treating the candidate as a conclusion.

Can a provider hold records on our behalf?

A storage arrangement does not by itself establish that your obligations are met. Check continued access, retrieval, retention, migration and disposal, including what happens when the contract ends.