What must remain understandable
An AML file should make it possible to reconstruct the verified identity, ownership and control structure, purpose of the relationship and information used to assess risk. Transaction data and decisions are part of the same chain: an isolated attachment without a date, source or connection to the decision may have limited value even when it has technically been stored.
Quality is not the same as quantity
An effective model makes successive versions of the customer profile, the reason for a review, the evidence examined and the person who approved the outcome understandable. The operational objective is to explain the decision later without having to rebuild it from memory.
- Source and date of relevant information.
- Version of the risk assessment and reason for the update.
- Outcome of controls, anomalies, reviews and escalations.
- Owner, approval and management of exceptions.
What to test for the new framework
Regulation (EU) 2024/1624 establishes a directly applicable framework for obliged entities. A record-keeping review should start from the relevant provisions, applicable law and actual processes, distinguishing legal duties, organisational design and data-protection constraints. This page should not be used to infer one retention period or one technical solution for every record and entity.
The AMLR generally applies from 10 July 2027. Today’s process must meet the rules already applicable to the entity; comparison with the new framework supports readiness rather than bringing every future requirement forward.
Practical scenario
A relationship has ended and the team must decide what to retain, for how long and with which access. The repository still contains duplicates, local exports and attachments with no clear category. The issue here is not decision history but retention scope: data category, purpose, triggering event, access and deletion should map back to the applicable rule.
Useful check: select one data category from a closed relationship and reconstruct the retention basis, start event, expiry, systems holding copies and deletion or restriction control. If one step cannot be evidenced, record-keeping needs review.
Related: timestamp, versions and decision history →
Sources and references
Informational content. It does not replace an assessment of a specific case.
Regulation (EU) 2024/1624European Commission — EU AML/CFT framework