AML Compliance Guide
Log in Create Free Account

Record keeping (7 years) for Accountants — 2026 AUSTRAC Guide

If your accounting practice provides a designated service from 1 July 2026, you must keep AML/CTF records for 7 years. For accountants, this usually matters when you go beyond routine tax or bookkeeping work and start handling client money, assets, entity structures or other designated services. If your records are incomplete, missing or cannot be produced, AUSTRAC can treat that as a compliance failure, with civil penalties up to $33.5 million per contravention and criminal penalties for intentional breaches.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

Record keeping means making full and accurate records, storing them securely, and being able to retrieve them quickly. The records you must keep fall into 3 main groups: your AML/CTF program records, your customer due diligence records, and transaction records connected to a designated service. AUSTRAC expects records to be reasonably necessary to show you complied, and sufficient to reconstruct individual transactions. For an accounting practice, that can include client onboarding notes, ABN or ACN checks, trust deed details, beneficial owner information, sanctions screening results, internal risk ratings, engagement documents, emails approving higher-risk matters, and working records showing what money movement or asset-related service you actually provided.

What an accounting practice should do

  • Identify which services are designated services. Tax return preparation alone is generally not one, so do not build a record-keeping system around non-designated work only.
  • Create a simple record register covering AML/CTF program documents, CDD records and transaction records for each designated-service client.
  • For individuals, record what ID you checked and the details used to verify name, date of birth and address. You are not required under the Act to copy the ID document itself.
  • For companies and trusts, keep ASIC checks, trustee and trust deed details, and records showing how you identified beneficial owners with 25%+ ownership or effective control.
  • Keep records of sanctions screening, PEP checks, enhanced due diligence decisions, suspicious matter assessment notes, staff training attendance and senior management approvals.
  • Retain CDD records for 7 years after the business relationship ends, transaction records for 7 years from the date of the transaction, and keep records in English or a format that can be easily translated into English.

7-year rule: when the clock starts

For customer due diligence records, keep them for 7 years after the client relationship ends. For transaction records, keep them for 7 years from when the transaction was completed. If you update client information during the relationship, keep the earlier CDD records as well if they are reasonably necessary to show how you complied.

The most common mistake for accountants is assuming your ordinary file retention policy covers AML/CTF automatically. It usually does not. A tax file may contain engagement letters and workpapers, but miss the exact verification details, beneficial ownership reasoning, sanctions screening evidence, or internal decisions about why a matter was low or high risk. Another common error is keeping only scanned PDFs when the original working format matters. AUSTRAC expects you to keep records in their original format or usual business format where possible, such as spreadsheets, database exports, email trails and practice management logs.

Practical tips for small accounting firms

  • Add AML/CTF fields to your client onboarding checklist in Xero Practice Manager, FYI, Karbon, APS or your existing practice system rather than creating a separate manual process.
  • Use one folder structure for each designated-service client: identification, entity documents, beneficial owners, sanctions and PEP screening, risk rating, transactions, and review notes.
  • Restrict access to sensitive records such as SMR-related notes, and never label a client file in a way that reveals an SMR was filed or considered.
  • Set automatic retention reminders so files are not deleted under your normal 5- or 7-year tax record cycle before the AML/CTF retention period has been checked.
  • Back up electronic records to secure offsite or encrypted cloud storage so you can still produce them if a staff member leaves or a system fails.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need to keep AML/CTF records for every accounting client?
No. The obligation attaches when your practice provides a designated service, not every service you offer. Tax return preparation alone is generally not a designated service for accountants, but if you do provide a designated service you must keep the required AML/CTF records for that client and matter.
Do I have to photocopy passports and drivers licences?
No. Under the Act, you are not required to copy identification documents just to meet CDD record-keeping obligations. You must keep a record of what you did to verify the client and the information they provided, such as passport details or licence details used in the verification process.
What if we rely on another reporting entity to do CDD?
You can choose to enter a CDD arrangement with a third-party reporting entity or foreign equivalent. If you do, you must assess whether that third party is properly carrying out the process, make a record of the assessment within 10 business days after completing it, and keep that assessment record for 7 years after it is prepared. You also need to keep the CDD arrangement itself.
What happens if we stop acting for a client and then they come back years later?
Your original CDD records must still be kept for 7 years after the earlier relationship ended. If the client returns and you provide a new designated service, you should assess whether the existing information is still reliable and whether updated CDD is needed. Keep both the old and new records where they are reasonably necessary to show compliance.
Does this require expensive new software?
Not necessarily. AUSTRAC allows records to be hard copy or electronic, stored onsite or offsite, as long as they are accurate, secure and retrievable. Many small accounting firms can meet the obligation by adapting their existing practice management system, document management folders and backup process, provided the records are complete and retained for the correct period.

Related guides