FATF ¦ R.11 Re­cord-Keep­ing

Recommendation 11: The Backbone of Effective Financial Crime Compliance

Accurate, timely record-keeping is more than a regulatory checkbox — it is the foundation of an institution’s ability to detect, investigate, and prosecute financial crime. Financial institutions should maintain all necessary records on domestic and international transactions for at least five years. These records must be sufficiently detailed to reconstruct any individual transaction, including amounts and currency types, enabling swift responses to competent authorities and supporting evidentiary needs in criminal proceedings.

Customer Due Diligence: Documentation That Endures

Beyond transactional data, the integrity of Customer Due Diligence (CDD) documentation is vital. Institutions should retain CDD records — copies of official identification (passports, identity cards, driving licences), account files, and business correspondence — for at least five years after a business relationship ends or after the date of an occasional transaction. This retention must also cover analytical outputs, such as inquiries into the background and purpose of complex or unusually large transactions, ensuring that risk assessments are traceable and defensible.

Bastian Schwind-Wagner_Follow

"Robust records are the backbone of credible financial crime compliance. Five-year retention paired with rapid retrieval enables effective investigations and defensible enforcement.

Embedding strong CDD documentation and analytics makes risk decisions traceable and transparent. Legal mandates must be matched by operational excellence to protect customers and the financial system."

Legal Mandate and Availability to Authorities

Laws should obligate institutions to maintain both transaction records and CDD information, ensuring that these materials are readily accessible to domestic competent authorities upon appropriate authorization. Availability is as important as retention: institutions need systems that guarantee prompt retrieval without compromising data integrity or privacy.

Operationalizing Compliance

Effective compliance demands disciplined data governance, secure storage, and clear retrieval protocols. Institutions that invest in these capabilities enhance investigative cooperation, reduce regulatory risk, and strengthen their resilience against financial crime.

Dive deeper

• FATF ¦ The FATF Recommendations ¦ Link