Why Record Keeping Matters More Than You Think

Records are the difference between a compliance program that exists and a compliance program that is defensible. When AUSTRAC conducts an assessment — or when a state regulator inspects your venue — the first thing they ask for is records. The records either show a well-run program in action, or they do not.

A program without records is functionally a program that was not operated. You can describe the best procedures in the world, but if you cannot produce evidence that they were followed, the regulator will treat them as aspirational, not operational.

Record keeping is also the obligation most likely to produce compliance gaps that stack up silently over years. A CDD record not captured today is still not captured three years later. An SMR decision without a documented rationale is still missing when AUSTRAC asks. The work compounds quietly until it becomes impossible to fix.

The 7-Year Rule

The AML/CTF Act requires most records to be retained for a minimum of seven years. The seven-year period runs from different starting points depending on the record type:

Seven years is a minimum, not a target. Many venues retain records longer, particularly where records support potential investigations or where they document decisions that may be revisited.

What Must Be Recorded

The Act identifies broad categories, but AUSTRAC guidance and enforcement decisions add substantial practical detail. The following list reflects what a compliant venue should be recording:

Customer Identification (CDD and ECDD)

• Full name, date of birth, residential address
• Document type, number, expiry date
• Method of verification (sighted original document)
• Name of staff member who performed the verification
• Date and time of verification
• Outcome and any risk flags raised during verification
• Any ECDD procedures applied (additional documents, source of funds enquiry, compliance officer review)

Transactions

• Payout amount
• Date and time of the payout
• Method of payment (cash, EFT, cheque)
• Patron identification (where identified)
• Machine identifier or gaming session reference
• Staff member processing the payout
• Any risk flags or monitoring alerts raised

Suspicious Matter Reports

• Copy of the SMR filed with AUSTRAC
• The information that formed the basis of suspicion
• Internal escalation records (who raised it, who assessed it, who decided)
• Decision rationale — why the suspicion was formed, or why filing was chosen over not filing
• Timing records — when suspicion was formed, when escalated, when filed
• Related transaction and customer records

Risk Assessments

• Patron risk rating (LOW, MEDIUM, HIGH)
• Basis for the rating (risk factors considered)
• History of rating changes and the triggers for change
• Staff member who assigned or changed the rating
• Date of last review

Training

• Attendance records (names of staff trained)
• Date of training
• Content delivered (module outline)
• Attestation or completion evidence
• Trainer details
• Refresher cycle tracking

AML/CTF Program Governance

• Current and all superseded versions of the program
• Senior manager approval records
• Review and amendment history
• Compliance officer appointment documents
• Fit-and-proper assessment records
• Independent review reports and remediation tracking

Secure Storage — APP 11

Records containing personal information are also subject to Australian Privacy Principle 11 under the Privacy Act. The AML/CTF Act requirement to retain records for seven years does not override APP 11 — you must retain them securely.

What Secure Storage Looks Like

• Digital records: encryption at rest, access controls (role-based), audit logging of access, backups with equivalent protection
• Paper records: locked storage, limited access, incident logging if breached
• Destruction after 7 years: secure deletion for digital records, shredding for paper, logged destruction records

APP 11 also requires you to take reasonable steps to destroy or de-identify personal information when it is no longer required. For AML/CTF records, this triggers at the end of the seven-year retention period — records that are past retention should be destroyed on a documented schedule.

Common Record-Keeping Failures

Fragmented Records Across Multiple Systems

Many venues accumulate records across several tools — one for transactions, one for training, one for incidents, one for SMRs. When regulators ask for “everything relating to patron X,” the answer takes days to assemble and often has gaps.

Decision Rationale Missing

Venues record the fact of an SMR filing or a risk rating change, but not why. The “why” is the most important part of the record. An AUSTRAC assessor who cannot see the reasoning behind a decision has no way to evaluate whether the decision was sound.

No Version Control on the Program

Many venues can produce the current AML/CTF program but not the version that was in force two years ago. If AUSTRAC is assessing historical compliance, the version that was in force at the time matters.

Training Records That Don’t Actually Prove Training

A spreadsheet with names and dates is not a training record. Proper records include the training content, attendance evidence, attestation, and refresher cycle — enough to demonstrate the staff actually received the training they are certified as having.

Destroyed Too Early

Records purged before the seven-year retention period. This is a direct breach and creates compliance gaps that cannot be remediated retroactively.

Retained Too Long Without Purpose

The opposite problem — records kept indefinitely with no deletion protocol. This creates privacy risk under APP 11 and can create discoverable material in litigation the venue would be better off without.

State Records Overlap

Many of the records required under state gaming law overlap with AML/CTF records. NSW incident register entries often relate to events that also warrant SMR assessment. Training records under L&GNSW’s RCG requirements sit alongside AML/CTF training. Responsible gambling interactions may overlap with ECDD triggers.

A well-designed compliance system captures each event once, applies both frameworks to the single record, and produces audit-ready extracts for either regulator. A dual-tool setup ends up with two incomplete records and a lot of reconciliation effort.

The One-Platform Answer

ComplyIQ keeps every AML/CTF record in one immutable system: customer identification, transactions, risk assessments, SMRs with full decision rationale, training attestation, and program version history. The same system captures state gaming records — incident register, GPoM compliance, responsible gambling interactions — so a single patron history covers both regulators.

Records are encrypted at rest, access-controlled, audit-logged, and retained for seven years automatically. Destruction at end-of-retention is scheduled and documented. Regulator requests are produced in minutes.

For the full record-keeping obligation set, see our AUSTRAC Obligations for Gaming Venues guide.