Seven years sounds like a long time when you first read the obligation, and it is, long enough that the real estate agent who conducted a CDD check today may well have left your agency, changed careers, or simply moved on, well before that record is due for disposal. The record keeping requirement itself is simple to state. Actually delivering on it, reliably, across a period that long, in a small business where people come and go, is a genuinely different challenge.
Here’s what actually needs to be kept, why the seven year window matters more than it first appears, and how to build a system that doesn’t quietly fall apart the moment a key staff member leaves.
What actually needs to be kept
Your record keeping obligation spans several distinct categories, and it’s worth being clear on all of them rather than assuming CDD files alone cover it.
Customer identification records. The steps taken to verify each customer’s identity, what information was collected, and how it was verified. This is the file most agencies think of first, and rightly so, it’s usually the largest category by volume.
Transaction records. Details of the actual transactions your agency has been involved in as part of a designated service.
Program records. Your AML/CTF program itself, including adoption dates, senior management approval, and a genuine history of subsequent changes, which is exactly why the document control discipline we’ve covered separately matters so much here.
Reporting records. Copies or details of anything submitted to AUSTRAC, Suspicious Matter Reports, Threshold Transaction Reports, and your Annual Compliance Reports, kept as evidence that these obligations were actually met, not just assumed to have been.
Why seven years is genuinely long for a small business
Think honestly about how much your agency is likely to change over a seven year stretch. Staff will almost certainly turn over, in real estate this can happen faster than in many other industries. The software or systems you use for record keeping today may well be replaced or upgraded more than once. You might change office locations, merge with another business, or shift how your agency is structured entirely.
None of that is unusual, it’s just normal business life. But it means a record keeping system that only works because one particular person understands where everything is, or because it depends on a specific piece of software your agency happens to be using this year, is a system that’s likely to fail well before the seven years are up.
The staff turnover problem, specifically
This is worth naming directly because it’s the single most common way record keeping quietly breaks down in small agencies. Picture the scenario: your Compliance Officer, or simply the staff member who happened to set up the filing system in the first place, built a structure that made complete sense to them. Folders organised their way, files named according to a logic only they fully understood, some records saved to their personal email or their own device rather than a shared, business owned location.
Then they leave. Suddenly, records that technically exist somewhere are effectively unfindable, because the person who understood the system is no longer there to explain it, and nobody documented how it actually worked. From an outside perspective, whether that’s a new staff member trying to locate a file or an examiner asking for one, this looks identical to records simply not existing at all.
The fix isn’t complicated in principle: build the system around the role, not the individual currently occupying it. Anyone who steps into the Compliance Officer position, or simply needs to locate a record, should be able to find what they need without relying on tribal knowledge that walked out the door with a previous staff member.
What a system that survives turnover actually looks like
A few practical characteristics separate a genuinely durable system from one that only works while the right person is still around.
Records live in a centralised, business owned location, not scattered across individual staff members’ personal inboxes, desktops, or accounts. If a record only exists in someone’s personal email, it isn’t really your agency’s record, it’s that person’s, and it leaves with them.
The structure is self explanatory, documented clearly enough that someone unfamiliar with it could find a specific file within a few minutes, not dependent on unwritten conventions only the original creator understood.
Access isn’t tied to one person’s login or one person’s device. If retrieving a record requires getting into a specific staff member’s account after they’ve already left the business, you have a genuine continuity problem, not just an inconvenience.
A simple, practical test
Here’s a useful way to check whether your current system would actually hold up: pick someone in your agency who wasn’t involved in setting up the record keeping system, and ask them to locate a specific customer’s CDD file from eighteen months ago, without help. If they can do it in a few minutes, your system is probably genuinely durable. If they can’t find it at all, or need to track down a former colleague to ask where things are kept, that’s a real gap worth fixing now, while you still have the people around who understand the current setup, rather than discovering it the hard way after they’ve gone.
Common mistakes worth avoiding
Records saved to personal email accounts rather than a shared business system are the most common failure point, precisely because it feels convenient in the moment and nobody thinks about what happens when that person moves on. Physical paper files with no digital backup are a similar risk, vulnerable to loss, damage, or simply becoming impossible to locate once the person who filed them is no longer there to ask. And a record keeping structure with no clear separation between current and archived material, the same issue we’ve covered in relation to document control, makes it hard to quickly confirm you’re looking at a complete, accurate file rather than a partial one.
Where Lead Comply fits into this
This is precisely the kind of continuity problem a properly built portal solves structurally, rather than relying on any one person’s habits or memory. The Lead Comply AML Portal keeps customer due diligence records centralised within your agency’s business account, not tied to any individual staff member’s personal login or inbox, so when someone leaves, the records they created stay exactly where they were, immediately accessible to whoever takes over their responsibilities. Our free account gives you this structure from day one, at no cost, so your record keeping system is built to survive staff changes rather than depending on any one person sticking around for the next seven years.
Create your free account → Lead Comply AML Portal
