In this article, I will address the issue of how many years KYC documentation should be stored after the relationship has been closed. For financial institutions, this is a significant compliance concern.
Compliance requires effective record management within the institution’s legal framework, as well as supporting financial audits and reducing the risk of committing financial crimes. Compliant institutions are expected to have proper and well-defined granularity of timeframes for retaining information.
Overview
In the financial domain, the Know Your Customer (KYC) regulations play an important role in criminal due diligence, such as money laundering, terrorist financing, and fraud.
It is pertinent to mention here that KYC policies are an asset for organizations, particularly during business dealings. However, an intriguing and often raised concern is, ‘after the client relationship is closed, what is the appropriate duration for retaining KYC records?
The enforcement and retention of KYC records hinges on local laws, guidelines from bodies such as FATF, intergovernmental normative risk mitigation frameworks, and other compliance benchmarks.
Why Is KYC Record Retention Important?
KYC record retention has several purposes:
Compliance: Businesses need to show compliance with regulations for KYC record retention procedures.
Verification: Regulatory authorities may demand the historical KYC information during the audits or investigations.
Legal: There may be possible legal or compliance risks that arise in the future, therefore retaining data minimizes the risks.
The Purpose of Retaining KYC Records
Retaining KYC records is useful for legal compliance and as a means to show historical compliance in case of audits and regulatory inquiries. In some cases, though the consumer is no longer in a relationship with the institution, he or she may be relevant due to previous transactions or identity documents in investigations regarding fraud, money laundering, or other financial crimes. This is why regulators across the globe enforce a minimum duration for which KYC records need to be stored.
Global Guidelines – The FATF Standard
The international body responsible for anti-money laundering (AML) and counter-terrorism financing policies is Financial Action Task Force (FATF). Many countries seem to follow its guidelines. FATF states:
“Customer due diligence (CDD) information and transaction records should be maintained for at least five years after the termination of the business relationship.”
This five-year duration has become a de facto global standard and is incorporated into the legislation of several countries. FATF also suggests these files should not only be kept, but that they should be easily retrievable to be supplied to the competent authorities whenever required.
KYC Records Retention Timeline India
The Reserve Bank of India (RBI) supervises KYC compliance for banks, non-banking financial institutions (NBFCs), and payment service providers in India. As per RBI Master Guidelines on KYC (2023 Update):
“Records of the identity of clients and beneficial owners, as well as account files and business correspondence, should be maintained for a period of five years post termination of the business relationship.”
This ensures that financial institutions are able to manage any regulatory compliance investigations and enforcement actions involving internal scrutiny even after the customer is no longer with the institution.
By Nation Retention Period Norm
There is variation in implementation across countries that follow FATF recommendation. While most regions observe a minimum of five years, some areas extend further.
- United States (FinCEN): 5 years
- United Kingdom (FCA): 5 years
- Australia (AUSTRAC): 7 years
- Singapore (MAS): 5 years
- European Union (under AMLD5): 5 years, extendable to 10 in special cases
In jurisdictions with greater risks for money laundering, controllers may impose stricter retention policies. In the EU for instance, customer information may be retained for up to 10 years justified by the type of business or risk exposure.
What Type of KYC Records Are Required to be Maintained?
KYC documentation goes beyond simple identity verification and includes a collection of records that needs to be maintained. Institutions usually have to retain:
- Customer identification documents (Aadhaar, PAN, passport)
- Address verification documents
- Image files
- Risk rating or risk assessment notes
- Chat transcripts pertaining to compliance
- Historical transaction records
- Documents pertaining to closure such as termination forms
These documents are referred to as the “KYC file” and are considered highly sensitive and confidential.
Implications of eKYC With Privacy Regulations
The onboarding process has become simpler and quicker with eKYC. Nonetheless, it poses new problems regarding data storage, privacy, and access control. With legislative frameworks like General Data Protection Regulation (GDPR) in Europe and India’s Digital Personal Data Protection (DPDP) Act, there is a fine line between data retention and data minimization along with secure disposal.
Post customer KYC record retention period, institutions are mandated to securely delete or destroy the records unless there are ongoing legal or regulatory inquiries. Moreover, retaining data longer than necessary attracts penalties under data protection frameworks.
Recommendations for Compliance
To protect themselves, financial institutions and fintech organizations need to take the following steps:
- Have a retention policy that is tailored to local and international legislative frameworks.
- Уse secure digital storage of KYC documents with limited or no access.
- Program automated systems to enforce timely deletion of KYC documents post retention period.
- Put routine checks in place for all retention and deletion processes.
Conclusion
In summary, KYC documentation needs to be kept for at least five years after the customer relationship is closed, both globally and as per Indian laws. While drafting policies on retention and disposal, institutions need to pay attention to local rules and privacy laws. Compliance with these regulations enhances legal compliance while safeguarding the institution from potential liabilities in the future.
