Regulation 40 of the Money Laundering Regulations 2017 requires a practice to keep its customer due diligence evidence and enough transaction records to reconstruct each transaction for five years from the end of the business relationship, or from completion of an occasional transaction. When that period ends, personal data obtained for AML purposes must be deleted unless an exception applies. Supervisors also expect to see the firm’s risk assessment, policies, training records and suspicious activity reporting records.

Which records does regulation 40 cover?

Regulation 40(2) specifies two categories for an accountancy practice:

  • Due diligence records: a copy of any documents and information obtained to satisfy the customer due diligence requirements in regulations 28, 29 and 33 to 37, and the requirements of regulation 30A on checking and reporting discrepancies in the Companies House register. That includes identity evidence, beneficial ownership work, enhanced due diligence on politically exposed persons and the reasoning behind any simplified due diligence.
  • Transaction records: sufficient supporting records, either originals or copies, for any transaction that was subject to due diligence or ongoing monitoring, to enable the transaction to be reconstructed.

Regulation 40(9)(b) defines a copy as one that would be admissible in court as evidence of the original. A scan held in a secure document management system will usually meet that test; a blurred phone photo of a passport may not. The checks that generate these records are covered in customer due diligence for accountants and ongoing monitoring of clients.

When does the five year clock start?

Regulation 40(3) says the period is five years beginning on the date on which the firm knows, or has reasonable grounds to believe:

  • for an occasional transaction, that the transaction is complete;
  • for a business relationship, that the relationship has come to an end. This applies both to due diligence records and to records of transactions within the relationship.

The trigger is the end of the relationship, not the date the document was obtained. Identity evidence taken when a client joined in 2012 must still be held five years after that client finally leaves. ICAEW’s smaller practices guidance adds that the records must be readily retrievable.

Regulation 40(4) caps the retention of transaction records within a business relationship at 10 years. The cap applies only to those transaction records, not to the due diligence file, so for a long standing client the firm may discard transaction support more than 10 years old while still holding the identity evidence.

Must records be deleted when the period ends?

Yes, for personal data. Regulation 40(5) requires the firm to delete any personal data obtained for the purposes of the Regulations once the period has expired, unless:

  • it is required to keep records containing the data by or under any enactment, or for the purposes of court proceedings;
  • the data subject has consented to retention; or
  • the firm has reasonable grounds for believing the records need to be kept for legal proceedings.

This sits alongside regulation 41, which says personal data obtained for AML purposes may only be processed to prevent money laundering, terrorist financing or proliferation financing unless another use is permitted by law or the client consents. Before taking on a new client, the firm must give a statement to that effect in addition to its normal privacy notice. Using passport copies gathered for AML checks for marketing, for example, would breach regulation 41. The wider retention picture, including tax records, is covered in data protection for accountancy practices.

What other AML records do supervisors expect to see?

Several other regulations impose written record duties. HMRC’s record keeping guidance lists them together:

Record Requirement
Firm wide risk assessment and the steps taken Regulation 18(4), up to date written record
Policies, controls and procedures, changes to them and how they were communicated Regulation 19(1)(c)
Training measures and training given Regulation 24(1)(b)
Internal reports, the nominated officer’s consideration and external reports HMRC and ICAEW guidance
Compliance monitoring reports to senior management and the response HMRC guidance

See the firm wide AML risk assessment and AML training for practice staff for what those records should contain. When ICAEW reviewers visit, they check among other things that there is enough on file to show the client’s identity was verified and evidence retained, that relevant staff were trained, and that any suspicious activity report made was accurate and complete.

Regulation 21(8) adds a practical test. The firm must have systems that let it respond fully and rapidly to enquiries from accredited financial investigators and law enforcement officers about whether it has had a business relationship with a person during the previous five years, and the nature of that relationship. A former client list that cannot be searched does not meet it.

How long should suspicious activity records be kept?

The Regulations set no specific period. HMRC’s guidance for the businesses it supervises says records of internal and external reports should be kept for at least five years from the date the report was made, and that copies of reports sent to the NCA should be retained, because the SAR Portal does not keep a copy once a report is submitted. HMRC also says that where the nominated officer considered material but did not report, a record of what was considered should be kept. ICAEW’s document retention helpsheet notes that no official period applies to these records and that, since they may form the basis of a defence, a firm may decide five years is suitable.

These records should be held by the MLRO, separately from the client file. ICAEW tells new nominated officers to make sure internal and external reports are stored securely and confidentially. A report saved on the client file risks being seen by staff who do not need to know, or being handed over with the file, which could amount to tipping off.

What about reliance, outsourcing and practice sales?

  • Reliance. Under regulation 40(6), a firm that is relied on by another firm under regulation 39 must keep the records for the same period. Regulation 40(7) requires it to hand over the due diligence information and copies of documents immediately if asked within that period.
  • Third party storage. HMRC’s guidance says that where record keeping is delegated, the firm remains responsible and must make sure the third party keeps the records as required. Records held outside the UK must still be readily available.
  • Mergers and acquisitions. HMRC reminds businesses that changes of system or storage on a merger or takeover must not break the record keeping chain. A practice buying a fee bank needs to know what due diligence records come with each client and for how long the seller must keep its own.

How does the timing work in practice?

Illustration only. A practice acted for a limited company from 2015. The client moves to another firm, and the practice’s engagement ends on 31 March 2026 when its final return is filed. The five year period begins on that date, so the due diligence file, including director identity evidence and the people with significant control checks, is kept until 30 March 2031. Transaction records from the relationship older than 10 years can already be removed under regulation 40(4). On the review date in 2031, the MLRO checks whether any proceedings or other legal duty require retention; if not, the personal data obtained for AML purposes is deleted and the deletion is logged. Records the firm holds for other reasons, such as working papers needed for professional indemnity purposes, follow their own retention policy.

What are the common mistakes?

  • Starting the five year clock from the date the evidence was obtained rather than from the end of the relationship.
  • Keeping AML personal data indefinitely, in breach of regulation 40(5).
  • No written record of decisions not to report, or of training.
  • Storing suspicious activity reports on the client file.
  • Copies of identity documents that are illegible or would not stand as evidence of the original.
  • No way of searching former clients when law enforcement makes an enquiry.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.