How long practices should keep client files

Q: How does this work for a typical client?

Illustration only. A practice prepares accounts and the company tax return for a client company with a 31 March 2026 year end and also advises the shareholders on a share reorganisation in the same year. The client leaves the practice in June 2027. Accounts and corporation tax working papers for the 2026 year: keep to at least 31 March 2033 on the current year plus six pattern. Due diligence records: keep for five years from June 2027, then delete the AML personal data unless an exception in regulation 40(5) applies. Share reorganisation file: the advice affects future capital gains, so treat it as a chargeable assets file and keep it indefinitely, or at the very least beyond the 15 year longstop that runs from the advice. If a complaint is received in 2031, suspend destruction of every file connected with that client until the matter is closed.

No statute sets a single retention period for an accountant’s own working papers. A practice builds its schedule from its clients’ statutory record keeping periods, the five year anti money laundering rule, its insurer’s conditions and the Limitation Act 1980, under which a negligence claim can in some cases be brought up to 15 years after the work was done. ICAEW’s indicative guidance points to the current year plus six further years for most accounts and tax files, with longer periods for some categories and secure destruction once the period ends.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

Is there a legal retention period for an accountant’s working papers?

Not as such. The statutory periods belong mainly to the client. Section 12B of the Taxes Management Act 1970 requires a person in business to keep records until the fifth anniversary of the 31 January following the tax year, and other taxpayers until the first anniversary of that date, with the period extended while an enquiry is open. Schedule 18 to the Finance Act 1998 requires a company to keep the records needed for a correct and complete company tax return until the sixth anniversary of the end of the period, which is longer than the three years (private companies) or six years (public companies) required by section 388 of the Companies Act 2006. The client’s own duties are covered in how long companies must keep records.

ICAEW’s document retention helpsheet makes the practical point: original records should normally go back to the client as soon as practicable, but firms would be wise to keep their own copies in line with indicative retention periods, plus any longer period their insurer specifies, so that they can defend themselves if a claim arrives. Who owns which papers is a separate question, dealt with in who owns the records.

Why does the Limitation Act drive the retention period?

A practice keeps working papers mainly because they are its evidence if a client sues. The limitation periods for England and Wales are:

Contract: six years from the date the cause of action accrued (section 5).
Tort, including negligence: six years from accrual (section 2).
Latent damage in negligence: section 14A allows the later of six years from accrual or three years from the date the claimant first had the knowledge needed to bring the claim.
Longstop: section 14B bars a negligence action, other than for personal injury, 15 years after the last act or omission alleged to be negligent, even if the claimant has not yet discovered the damage.
Deeds: 12 years for an action on a specialty (section 8), relevant where engagement terms are executed as a deed.
Concealment: under section 32, where a relevant fact has been deliberately concealed, time does not start until the claimant discovers it or could with reasonable diligence have discovered it, and the 14A and 14B rules do not apply to those cases.

HMRC’s own time limits feed into this. Under sections 34 and 36 of the Taxes Management Act 1970, an income tax or capital gains tax assessment can normally be made up to four years after the tax year, six years where a loss of tax was brought about carelessly and 20 years where it was deliberate. An error found by HMRC in year five may lead to a claim against the adviser in year six or later, which is why the “current year plus six” pattern is a floor rather than a ceiling.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

What periods does ICAEW suggest?

Appendix 1 to ICAEW’s document retention helpsheet gives indicative periods. A selection:

Type of file	Indicative period	Basis given
Accounts preparation working papers	Current year plus six further years	Schedule 18 FA 1998 and section 388 CA 2006
Audit files	At least six years from the date of the auditor’s report	Audit Regulation 3.11 and ISQM (UK) 1 paragraph 60-1
Income tax, capital gains tax, corporation tax and VAT papers	Generally six years, by reference to the end of the period	HMRC Compliance Handbook CH14530, CH14600 and CH15000
PAYE files	Three years from the end of the tax year as a minimum; current year plus six as best practice	Government guidance for employers
Customer due diligence records	Five years from the end of the relationship	CCAB AML guidance paragraph 3.6.18
Information on chargeable assets and gifts	Indefinitely	Useful for an indefinite period
Documents of title such as leases	12 years after the end of the interest	Limitation Act 1980 section 15
Identity verification records as an Authorised Corporate Service Provider	Seven years from the date verification was completed	Companies House guidance

Correspondence and time records should follow the working papers they relate to, and ICAEW suggests treating non audit assurance files like accounts and audit files.

How do AML records and data protection change the answer?

Two rules push in the opposite direction from “keep everything”. Regulation 40 of the Money Laundering Regulations 2017 requires due diligence records to be kept for five years from the end of the business relationship, and regulation 40(5) then requires personal data obtained for AML purposes to be deleted unless another enactment, court proceedings, consent or reasonable grounds relating to legal proceedings justify keeping it. The detail is in AML record keeping.

Article 5(1)(e) of the UK GDPR, the storage limitation principle, says personal data must not be kept in identifiable form for longer than is necessary. The ICO says there are no fixed periods in the UK GDPR, that organisations should have a policy with standard retention periods where possible, and that personal data held for too long is unlikely to have a lawful basis. ICAEW’s view is that the “necessary” period for a practice can usually be justified by statutory periods, regulatory requirements and insurers’ requirements, extended where a complaint, claim or inquiry has been received or notified. The wider position is covered in data protection for accountancy practices.

What should a written retention policy cover?

ICAEW recommends a clear written policy that all staff know, covering paper and electronic records, who may access each type of file, retention periods and secure destruction. It should be reviewed regularly against the law and against what staff actually do. Points that are easy to miss:

Tell clients. A summary belongs in the engagement letter and privacy notice. ICAEW’s suggested terms of business say the firm may destroy papers more than a stated number of years old, except documents it thinks may be of continuing significance, unless the client asks for longer retention.
Check the insurance policy. ICAEW notes that some professional indemnity policies contain retention clauses and that breaching them may affect cover, so review the policy before adopting or changing the schedule.
Control third party storage. An archive or cloud provider must be able to return files at short notice, must not destroy anything without the firm’s authority, and the firm must know where the data is held; storage outside the UK or EEA needs an adequate data protection regime.
Keep old data readable. Some licensed tax and accounts software stops working when the licence lapses. ICAEW suggests exporting data before giving up a licence and restoring sample files from time to time to prove retrieval still works.

How should files be destroyed?

For documents the client owns, ICAEW says the firm should not destroy them before any period set out in the engagement letter, and where the letter is silent should consult the client or take legal advice first. For the firm’s own papers, destruction must preserve confidentiality: secure shredding or incineration with clear written instructions to any contractor, attention to backups as well as live copies, and specialist destruction of old drives and devices, because deleting a file does not stop it being recovered. ICAEW suggests checking whether a destruction contractor holds BS EN 15713 or a similar certification. A destruction log recording what went, when and on whose authority makes the policy auditable. Device security more generally is covered in cyber security for practices.

How does this work for a typical client?

Illustration only. A practice prepares accounts and the company tax return for a client company with a 31 March 2026 year end and also advises the shareholders on a share reorganisation in the same year. The client leaves the practice in June 2027.

Accounts and corporation tax working papers for the 2026 year: keep to at least 31 March 2033 on the current year plus six pattern.
Due diligence records: keep for five years from June 2027, then delete the AML personal data unless an exception in regulation 40(5) applies.
Share reorganisation file: the advice affects future capital gains, so treat it as a chargeable assets file and keep it indefinitely, or at the very least beyond the 15 year longstop that runs from the advice.
If a complaint is received in 2031, suspend destruction of every file connected with that client until the matter is closed.

What are the common mistakes?

Applying one blanket period to every file, so that AML personal data is kept indefinitely while advice files that need longer retention are destroyed at six years.
Starting the clock from the date of the work rather than from the end of the period, the end of the relationship or the auditor’s report date, as each rule requires.
Destroying files linked to a live complaint or a circumstance already notified to insurers.
Forgetting backups, email archives and former staff laptops when a file is “destroyed”.
Ignoring the retention clause in the firm’s own insurance policy. Claim exposure more generally is discussed in common causes of negligence claims.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.