Record Keeping: What Must Be Stored and For How Long
Retention obligations are specific, enforced, and the most common finding in enforcement actions. What they cover.
Record keeping is the least discussed obligation and the one most frequently breached. It is also the easiest to satisfy.
What must be kept
Customer identification records and the evidence supporting them. Transaction records sufficient to reconstruct individual transactions. Records of the analysis underlying any internal report. And records of risk assessments and policies.
In plain terms: who the customer is, what they did, and why the firm concluded what it concluded.
The reconstruction standard
The test is usually whether records permit a transaction to be reconstructed so that it could be used as evidence. That is a higher bar than having a list.
A record showing an amount and a date, without the counterparty or the purpose, does not meet it.
Retention periods
Set in the rules, commonly running from the end of the relationship or the date of the transaction. The period differs between frameworks and between record types.
The current instrument is the source. A number quoted from memory is a number that will be wrong somewhere.
Who this binds
Authorised firms. Customers have their own obligations under tax and accounting law, which are separate and frequently longer.
Why it appears in so many enforcement actions
Because it is provable without establishing anything about intent. A supervisor can determine that records were absent and nothing further is required.
Firms with complete records resolve enquiries. Firms without them escalate, regardless of whether anything else went wrong.
What a customer gets from this
The right to a record of their own activity, and a counterparty able to produce evidence years later when a bank or an authority asks.
That capability is worth more than most people realise until the moment it is needed.
The practical test when choosing a platform
Ask whether it issues statements, in what form, and how far back. An exchange with compliance built into onboarding generally has the record keeping to match.
Venues that report what they are required to report keep the underlying records as a condition of doing so, and Collect & Exchange issues statements rather than screenshots, which is the customer-visible end of this obligation.
This page restates a published requirement. It is not the requirement itself and it is not legal advice. Rules change, and some take effect on a date later than their publication.