Record-Keeping Obligations for Law Firms Under Tranche 2
Law firms must retain CDD, transaction, and AML/CTF programme records for seven years under Tranche 2. Here is what AUSTRAC expects and how long.
Australian law firms providing a designated service must keep client identification, transaction, and AML/CTF programme records for seven years under the AML/CTF Act 2006 -- and since Tranche 2 commenced on 1 July 2026, AUSTRAC can request them at any time.
What records must a law firm keep under Tranche 2?
The AML/CTF Act 2006 requires reporting entities to retain three categories of records: - Customer due diligence (CDD) records -- identity documents, verification results, and beneficial ownership information for every client on a designated-service matter - Transaction records -- dates, parties, and the nature of each designated service provided - Programme and risk records -- the firm's AML/CTF programme, its ML/TF risk assessment, and evidence of staff training
How long must these records be kept?
Client identification and transaction records must be retained for seven years from the end of the client relationship or completion of the transaction, whichever is later. Programme documents, risk assessments, and training records must be kept for seven years from the date they stop being current. Destroying records early -- even by accident -- is a contravention in its own right.
Where and how should records be stored?
AUSTRAC doesn't mandate a specific format, but records must be retrievable in a usable form on request, in English, and protected against unauthorised access or loss. Scattered PDFs, email attachments, and shared drives make it hard to prove completeness during an audit. A single, timestamped repository tied to each matter -- rather than reconstructed after the fact -- is the safer approach.
What happens if records are missing or incomplete?
Failing to keep required records is a separate contravention under the AML/CTF Act 2006, independent of whether any suspicious activity occurred. AUSTRAC can request records during routine supervision, not only an investigation, and gaps are treated as evidence a firm's compliance programme isn't actually operating.
How does AMLify handle record-keeping for law firms?
AMLify for law firms timestamps and retains every CDD document, verification result, risk assessment version, and training record automatically against the relevant matter, for the full seven-year period. When AUSTRAC or an auditor asks for a client's file, it's a single export rather than a search across inboxes and drives.
Key Takeaways
- Seven-year retention applies to CDD records, transaction records, and AML/CTF programme documents
- The retention clock differs by record type -- from the end of the client relationship for CDD, from when a programme version stops being current for programme records
- Records must be retrievable and secure, not just stored -- scattered files rarely survive an audit
- Missing records are a contravention on their own, regardless of whether suspicious activity occurred
- AMLify automates record retention against each matter -- see pricing for a free trial
Frequently Asked Questions
Q: Does the seven-year period start when a matter opens or closes?
For CDD and transaction records, the seven years runs from the end of the client relationship or completion of the transaction, whichever is later -- not from when the matter first opened.
Q: Can a law firm store AML/CTF records in its general practice management software?
Yes, provided the records stay retrievable, protected from unauthorised access or loss, and can be produced on request. Many firms keep compliance records separate specifically so they aren't buried or deleted during routine file management.
Q: Can a firm be penalised for losing records without an AUSTRAC investigation?
Yes. Failing to retain required records is a contravention of the AML/CTF Act 2006 in its own right, and AUSTRAC can identify the gap during routine supervision rather than only a targeted investigation.
Q: Do sole practitioners have a shorter record-keeping obligation?
No. The seven-year retention requirement applies to every reporting entity providing a designated service, regardless of firm size.
This is general information only and not a substitute for legal advice.