AML Compliance Guide
Log in Create Free Account

Record keeping (7 years) for Lawyers — 2026 AUSTRAC Guide

If your law practice provides a designated service from 1 July 2026, you must keep AML/CTF records for 7 years. For lawyers, this usually matters when you handle client money or assets in connection with a transaction, not when you are only giving pure legal advice. If you cannot produce proper records, AUSTRAC can treat that as a breach of the Act, with civil penalties up to $33.5 million per contravention and criminal penalties for intentional contraventions.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

For a legal practice, record keeping is about being able to show exactly what you did before and during a designated service. You must keep customer due diligence records, transaction records, customer-provided transaction documents, and your AML/CTF program documents for 7 years. As a practical rule, keep enough detail to let AUSTRAC reconstruct the matter later: who the client was, what transaction you were involved in, what money or property moved, what documents the client gave you, what checks you performed, and why you proceeded.

What a lawyer should keep on each designated matter

  • CDD records: the client’s identifying details, what government-issued ID or ASIC search you relied on, beneficial owner information for companies and trusts, and any enhanced due diligence for PEPs or higher-risk matters
  • Transaction records: date and time, amount and currency, payer and recipient details, matter reference, trust account or other account identifiers, payment method, and supporting documents such as settlement statements, invoices, contracts and transfer instructions
  • Customer-provided transaction records: signed contracts, sale authorities, trust deeds, company documents, payment directions, source-of-funds documents, and any other transaction document the client gave you
  • Program records: your ML/TF risk assessment, AML/CTF policies, training records, sanctions screening evidence, and any internal decisions about suspicious matter reporting

Retention periods are not all counted from the same date

CDD records are kept for 7 years after the business relationship ends. General transaction records are kept for 7 years from the day the record is created. Customer-provided transaction documents are kept for 7 years from the day the client gave them to you. AUSTRAC guidance also expects records to be in English, or in a format that can be easily translated into English.

In a small firm, the cleanest approach is to build record keeping into matter opening and file closing. First, decide whether the matter is a designated service at all. If it is, collect and record CDD before acting, screen the client against sanctions lists, and save the evidence to the electronic matter file. During the matter, save all transaction documents and enough detail to reconstruct any movement of money or property. When the matter ends, mark the AML/CTF retention date so the file is not destroyed under your normal document destruction policy before the 7-year period expires.

A common mistake for lawyers is assuming every legal file is covered. It is not. Pure legal advice is generally not a designated service; the AML/CTF obligation is usually triggered when the practice handles money or assets in connection with a transaction. Another mistake is keeping only copies of passports and driver licences without recording what verification was actually done. AUSTRAC guidance says you are not required under the Act to copy ID documents, but you must keep records of the information provided and the steps you took to verify identity. Also, do not forget old CDD records when client details change during a long-running matter; previous records may still need to be retained to demonstrate compliance.

Practical tips for law firms

  • Create an AML/CTF subfolder inside each designated matter file for CDD, sanctions results, source-of-funds material, and transaction documents
  • Apply the same retention rule to email instructions, scanned authorities, and text or app messages if they form part of the transaction record
  • Restrict access to SMR-related records and never tell the client you lodged or considered lodging an SMR, because tipping off is a criminal offence
  • If you rely on another reporting entity for CDD, document the arrangement and your assessment of that third party, and keep those records for the required period
  • Check your file destruction policy, cloud storage settings, and trust account archive process now so they do not conflict with AML/CTF retention periods

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need to keep AML/CTF records for every legal matter in the firm?
No. The obligation applies when your practice provides a designated service, not every legal service you offer. Pure legal advice is generally not a designated service for lawyers, but matters involving handling money or assets in connection with a transaction commonly are.
Can I destroy the file 7 years after settlement if the client relationship continued for other matters?
Not always. CDD records are kept for 7 years after the business relationship ends, so if the client remained a client of the firm for later designated work, the retention period may run from the end of that later relationship. Transaction records and customer-provided transaction records have their own timing rules and may be counted from the date created or received.
Do I have to keep copies of passports, driver licences and trust deeds?
You do not have to copy ID documents under the Act if you have properly recorded what information you relied on and how you verified it. In practice, many firms keep copies where permitted because it helps with consistency, but the legal requirement is to keep records of the CDD information and verification steps. Trust deeds and other customer-provided transaction documents should be retained if the client gave them to you for the designated service.
What if our firm uses a practice management system hosted overseas?
You can store records electronically, but your firm must be able to quickly access them and produce them in English, or in a format that can be easily translated into English. Make sure the system allows reliable retrieval for at least 7 years, preserves audit trails, and protects records from unauthorised access, loss or tampering.
Will this create major extra cost for a small law practice?
Usually the main cost is setting up a consistent process, not buying specialist software. Most small firms can use their existing matter management, trust accounting and document storage systems if they add clear AML/CTF folders, retention tags, access controls and backup arrangements. The expensive option is poor record keeping, because failing to produce records can lead to enforcement action and disrupt every future AUSTRAC review.

Related guides