Running a PEP and sanctions check takes a few seconds. Proving later that you ran it properly, understood the result and made a sensible screening decision is the part many small firms find harder. If AUSTRAC asks how you handled a client, your records are the only evidence you have.
This guide explains what the AML/CTF Act expects your customer due diligence (CDD) records to show, how long to keep them, and gives you a field-by-field template for recording each screening decision. It is written for Australian reporting entities, including firms newly regulated under Tranche 2. It is general information, not legal advice.
What AUSTRAC expects your records to show
Under section 111 of the AML/CTF Act, when you provide or propose to provide a designated service you must make and keep records of your CDD. AUSTRAC’s record keeping guidance says those records must be reasonably necessary to show you complied, and must clearly show three things:
- what customer information you collected
- the steps you took to verify it, or to make sure a third party verified it
- the analysis, risk assessment or decision-making that explains why you applied the level of CDD you did
Screening sits across all three. The details you entered are information you collected. The check itself is part of your verification and risk identification. Your review of any potential match, and what you decided, is the decision-making AUSTRAC expects to see explained.
The third point is where most records fall short. A screening certificate that says ‘potential match found’ proves you ran a check. It does not show what you made of the result.
How long to keep screening records
AUSTRAC’s guidance says CDD records must be kept for 7 years from when either:
- the business relationship ends, or
- an occasional transaction is completed (a one-off service that is not part of an ongoing relationship)
For an ongoing client, the clock does not start at onboarding. If a client stays with you for ten years, their first screening record needs to be kept for 7 years after they leave, which is 17 years after the first check. AUSTRAC gives the example of a relationship that starts on 7 February 2027 and ends on 5 April 2029, where the record must be kept until 4 April 2036.
When you re-screen a client during the relationship, keep the earlier records too where they are needed to show compliance. AUSTRAC notes that collecting new information does not remove the need to keep previous CDD records.
Records must be in English or in a form that can easily be accessed and translated into English.
A template for every screening record
The table below sets out the fields a screening record should hold. Your screening tool will capture some of them automatically. The rest need a short note from the person reviewing the result.
| Field | What to record | Why it matters |
|---|---|---|
| Client and reference | Client name and your internal client or matter reference | Links the check to the CDD file |
| Date and person | When the check ran and who ran it | Shows timing against when the service started |
| Details screened | The exact name, date of birth, country and other identifiers entered | Shows the check was run on the right data |
| What was checked | PEP, sanctions, adverse media, and the data source or service used | Shows the scope of the check |
| Result | No match, or the potential matches returned | The raw outcome |
| Match review | For each potential match, the identifiers compared and what they showed | The reasoning AUSTRAC expects to see |
| Decision | False positive, unresolved or true match, with the reason in one or two sentences | The conclusion |
| Risk impact | Whether the result changed the client’s risk rating, and to what | Connects screening to your risk assessment |
| Escalation or approval | Who reviewed or approved, where your program requires it | Shows senior manager approval for PEPs where needed |
| Next action | Re-screening date or trigger, and any further information requested | Shows ongoing CDD is planned |
Keep suspicious matter reports, and anything that would reveal one, out of the general client file. Store them separately with restricted access.
A weak record and a strong record
Illustrative example. A conveyancing practice screens a new buyer, Daniel Ng, and the check returns a potential PEP match.
A weak record reads: “PEP check done 3/10. Possible match, not him. OK to proceed.”
A strong record reads: “3 October 2026, screened by J. Patel. Entered Daniel Ng, DOB 14/05/1988, Australia. PEP, sanctions and adverse media checked. One potential PEP match: Daniel Ng, born 1961, member of a provincial assembly overseas. Ruled out: year of birth differs by 27 years and client holds an Australian passport with no foreign public role disclosed. Decision: false positive. Risk rating unchanged (low). No approval required under our program. Re-screen at next instruction.”
The second record takes about a minute longer to write. It answers every question a reviewer would ask without anyone needing to remember the conversation.
Records you do not need to keep
You do not have to keep copies of identification documents to meet your AML/CTF record keeping obligations. AUSTRAC says you must keep records of what you did to identify the client and the details they provided, such as passport details used for verification, rather than a copy of the passport. Other laws may still require you to keep copies, so check your professional obligations.
Keeping less personal information can also reduce your privacy exposure. AUSTRAC points out that every reporting entity, even a small business, is covered by the Privacy Act 1988 because of its AML/CTF obligations.
Storing records so they stay usable
AUSTRAC expects records to be kept in their original or usual format, stored securely and accessible only to authorised staff. Insecure storage of sensitive records, such as identification details and suspicious matter reports, increases the risk of tipping off. In practice, for a small firm this means:
- keep screening results and review notes in the client’s CDD file, not in personal email inboxes
- export or save results from your screening tool so they survive a change of provider
- name files consistently, for example client reference, date and check type
- restrict access to SMR records to the compliance officer and anyone they authorise
- set a retention reminder from the date the relationship ends, not the onboarding date
Common record keeping gaps
- No reasoning for false positives. The result is saved but nothing explains why the match was ruled out.
- Missing input data. The record does not show which date of birth or country was screened, so nobody can tell whether the check was meaningful.
- Retention counted from onboarding. Records deleted 7 years after the first check, while the client is still active.
- Overwritten history. A new screening result replaces the old one instead of sitting alongside it.
- Records only in a vendor account. If the subscription lapses, the evidence goes with it.
Frequently asked questions
Do I need to keep a record when the check returns no match?
Yes. A clear result is still part of your CDD. Keep the date, the details screened and the result.
How long do I keep screening records for a one-off client?
For an occasional transaction, keep CDD records for 7 years from the date the transaction was completed.
Can I store records with my screening provider?
You can use an external provider, and AUSTRAC accepts that records may be kept by a third party. You remain responsible for being able to produce them, so make sure you can export them and that access continues if you change provider.
Do I need to keep a copy of the client’s passport?
Not for AML/CTF purposes. You must record the details you used to verify identity. Other professional rules may require a copy.
What should I do with records of a suspicious matter report?
Keep them separately from the general client file, with access limited to authorised staff, to reduce the risk of tipping off.
How NameScan can help
Each NameScan check produces a dated result that you can keep on file. In the NameScan dashboard you can record whether a result is a true match, document your decision and assign a risk level, which covers several of the fields in the template above. Your own CDD file should still hold the risk assessment, approvals and any further information you collected.
Start screening with NameScan, or read our guide to proportionate client checks under Tranche 2.
0 Comments