What Records Should an MSB Keep for AML Compliance?

Keep the current AML program and its history

Retain the written AML program, risk assessments, procedures, approval history, and prior versions needed to show what rules were in effect at a particular time. When a procedure changes, record why it changed and when the new version became effective.

Preserve customer and due-diligence evidence

Where your program requires customer identification or due diligence, retain the information and evidence required by the applicable rule and your procedures. Higher-risk reviews may also create supporting records such as ownership information, source-of-funds evidence, expected activity, or escalation notes.

Keep transaction and BSA reporting records

MSBs can be subject to multiple BSA recordkeeping and reporting requirements depending on their activities. Relevant records may include transaction details, required monetary-instrument or funds-transfer records, CTR support, SAR-related records, and other documents required by the rules applicable to the transaction.

Do not apply one guessed retention period to every AML document. Build a schedule from the current regulation and form instructions for each record category.

Save screening and alert decisions

If the business uses sanctions, PEP, adverse-media, or other screening as part of its program, retain enough evidence to show what was screened, when, what possible matches appeared, how the reviewer investigated them, and why the result was cleared or escalated.

Document training

Training records should make it easy to establish who was assigned training, what material was covered, when it was completed, and whether the employee successfully completed any required assessment or acknowledgement. Role-specific or remedial training should also be documented when used.

Retain independent-review evidence and remediation

FinCEN guidance says an MSB's independent review should be documented, including its scope, procedures, transaction testing, findings, and recommendations. Deficiencies should then be tracked along with the corrective action taken. Keeping the finding and remediation together creates a much clearer examination trail.

Build an examiner-friendly audit trail

A good recordkeeping system connects the policy, customer or transaction, alert, reviewer, decision, supporting evidence, and remediation rather than scattering those pieces across inboxes and local drives. Access controls and reliable timestamps are also important so the organization can show who performed or changed compliance work.

How PeakAML can help

PeakAML is designed to organize compliance workflows and supporting evidence in one place. The business remains responsible for determining which records it must retain and for how long under the rules applicable to its activities.