Seven Years or Seven Headaches: AUSTRACs Record-Keeping Crackdown
AUSTRAC has intensified scrutiny on advice businesses that are reporting entities. The immediate pressure point: proving you can capture, store, and retrieve AML/CTF recordsespecially customer identification and transaction recordsfor at least seven years. Heres how to translate that focus into practical steps that protect your reputation and keep operations smooth.
1) Whats happening: AUSTRACs spotlight is on your files
This is a regulatory focus and operational risk scenario. AUSTRACs expectations are clear: your AML/CTF Program (Part A governance and Part B KYC) must show how records are captured, stored, and retrievable on request. If you cant produce samples quickly, you invite breach notifications, remediation, and client disruption.
Whos in scope?
Advice businesses operating under an AFSL and other reporting entities with AML obligations. Even lean teams must demonstrate that record-keeping is consistent, controlled, and auditable.
2) Why this matters now
Operational change often breaks traceability. After a CRM or document system migration, offshoring, or restructuring, silos emerge and links snap.
A short narrative
A mid-sized AFSL holder migrates to a new DMS and later discovers 2017 KYC files (including beneficial ownership evidence) arent linked to current client profiles. AUSTRAC requests samples; the team cant produce within the timeframe. Cue breach notifications, rework, and anxious clients.
Immediate consequences
- Enforcement and reputational risk
- Service disruption and delayed onboarding
- Weaker suspicious matter reports (SMRs) and ongoing due diligence
3) Know the rulebook: seven years, Part A/Part B, and audit-readiness
Retention basics
- Keep customer identification and transaction records for at least seven years.
- Retention should persist even after services end, and be demonstrable via metadata.
- Retrieval must be timelywe can find it is not the same as we can produce it fast.
Your AML/CTF Program
- Part A (governance): risk assessment, roles, monitoring, quality assurance, issue management, and change control.
- Part B (KYC): identification/verification, beneficial ownership checks, ongoing CDD, trigger events, and re-verification rules.
Dont forget alignment
- Privacy and data handling (e.g., APPs) and ASIC/Code of Ethics record-keeping expectations.
- Clear linkage between policy, procedures, and systems: if its not written, it wont be done consistently.
4) Where good businesses go wrong (and how to spot it early)
- System migrations: legacy folders not mapped; lost links to client IDs; missing beneficial ownership documentation.
- Offshoring/remote work: informal shortcuts; files saved locally or to shadow drives; version confusion.
- Restructures: unclear ownership; duplicate repositories; broken workflows.
- Search friction: poor naming conventions and thin metadata make retrieval slow or impossible.
Document your business or get out. Policies, SOPs, and a single source of truth turn good intentions into repeatable outcomes.
Early warning signs
- Team cant retrieve a full KYC pack (including beneficial ownership evidence) in under 24 hours.
- Conflicting answers on where the truth lives for KYC, SMR notes, or CDD reviews.
- No metadata proving seven-year retention or disposition rules.
5) Do this in the next 24 hours: the AML file retrieval test
- Randomly select five clients across different segments and legacy systems.
- Retrieve Part B KYC evidence (ID, verification paths, beneficial ownership).
- Locate ongoing CDD notes and any trigger-event rechecks.
- Confirm retention metadata shows seven-year keeping and access trails.
- Record the time-to-produce for each element; set a 24-hour SLA.
- Log every gap (missing docs, broken links, inconsistent data) and assign an owner.
- Feed the gaps into your Part A governance plan with specific remediation actions and due dates.
Define Pass/Fail upfront
- Pass: full pack produced in under 24 hours with clear metadata.
- Fail: anything missing, stale, or not convincingly linked to the client profile.
6) Fix the root causes with structure, not heroics
Document control
- Publish a controlled taxonomy, naming standards, and mandatory metadata fields (client ID, KYC type, verification date, reviewer, retention date).
- Introduce versioning and approval steps; restrict ad hoc storage locations.
System architecture
- Design a single source of truth linking CRM, DMS, and KYC tooling with APIs or middleware.
- Enable automated retention timers and auditable access logs.
Change management
- For migrations/restructures, run a pre-cutover data mapping and post-cutover reconciliation of KYC/beneficial ownership files.
- Include rollback criteria and a formal data validation sign-off.
Remote work playbooks
- Role-based SOPs so remote staff follow the same steps every time.
- Prohibit local saves; mandate secure upload paths embedded in the workflow.
7) Strategy: turn compliance into a growth asset
- Speed as an edge: Retrieval SLAs reduce onboarding time, client friction, and review cycle costs.
- Better SMRs and CDD: Clean, complete files improve pattern detection and decision quality.
- Assurance reporting: Dashboards for time-to-retrieve, gap rates, and remediation status make board and regulator conversations easier.
- Trust dividend: Clients notice transparency and diligenceits a brand differentiator.
Measure what matters
- SLA: 95% of KYC packs produced in < 24 hours.
- Zero critical gaps on quarterly spot checks.
- 100% change projects with documented data-mapping and validation sign-off.
8) Your 14-day plan and call to action
- Days 12: Run the five-file retrieval test; baseline times and gaps.
- Days 35: Assign owners; update Part A governance actions; prioritize high-risk gaps (beneficial ownership, SMR notes).
- Days 610: Implement document control standards, metadata, and system links; disable shadow storage.
- Days 1114: Train remote teams on SOPs; rerun retrieval test to confirm improvement; lock in monthly spot checks.
Compliance isnt just about avoiding finesits operational resilience. Start with a simple retrieval test, fix what you find, and make documented, retrievable, auditable your default way of working.
