Fintech
The platform migration
“The core system or the KYC provider changes, and the old files end up in a system nobody can access anymore.”
AML Record Keeping in Spain (10 Years)
Article 25 of Law 10/2010 requires you to keep due diligence and transaction records for ten years. It is the obligation that gets the least attention, and the one that turns any inspection into a problem when it has not been met.
Can you retrieve a customer file from eight years ago? Free assessment
Tell us how you store your records today and we will tell you whether they would hold up to a request for information.
- 50+ entities advised
- Reply within 24 h
- No commitment
- Retention period
- 10 years
- Legal basis (Law 10/2010)
- Art. 25
- Minimum fine (serious infringement)
- €60,000
- GDPR lawful basis
- Art. 6(1)(c)
Services
What we do for you on AML record keeping
Keeping records is not just storing them: it means being able to retrieve a specific document, complete and in context, eight years later.
Policy
Retention and deletion policy
We draft the policy that sets what is kept, for how long, on what medium, who can access it and—what almost nobody has—what is deleted when the period expires and how that deletion is recorded.
Learn more →
Art. 2510 yearsDeletion
GDPR
Alignment with data protection
AML record keeping gives you a lawful basis for processing (a legal obligation), but it is not a blank check: you need to define purpose, access and erasure at expiry so that you do not clash with the GDPR.
Learn more →
GDPRLegal basisErasure
KYC
KYC file traceability
Making sure the file not only exists but can be reconstructed exactly as it stood at the time.
Learn more →
FileVersion
Third parties
Records held by providers
Who holds what when onboarding or archiving is outsourced.
Learn more →
ProviderCustody
Inspection
Responding to requests for information
How historical records are retrieved and handed over in response to a request for information.
Learn more →
RequestDelivery
Audit
Retrieval test
A dry run retrieving old customer files to check that the archive works.
Learn more →
Dry runSampling
Concept
What you must keep and for how long
Ten years, on a retrievable medium, with the ability to reconstruct the file as it stood.
Article 25 of Law 10/2010 requires obliged entities to keep, for a period of ten years, the documentation evidencing compliance with their due diligence obligations, as well as transaction documents and records. It is a long period, well above the one usually applied by default to ordinary business records.
What matters is not the period itself but what it implies: you do not comply by storing, you comply by being able to retrieve. An archive that exists but does not let you locate a specific customer’s file within a reasonable time, or that returns a document you cannot open because the format has become obsolete, does not satisfy Article 25, even if technically nothing has been lost.
And there is a second side that almost nobody works on: deletion. Keeping records beyond the legal period without justification is not prudence; it is processing data without a lawful basis. The retention policy has to say when records are kept and also when they are destroyed, with a record showing that they were destroyed.
Scope
Which documents the obligation covers
Six blocks, each with its own start-date rule and its own pitfalls.
| Block | What it includes | When the period starts | Common mistake |
|---|---|---|---|
| Customer identification | Identity document, verification data, representation and powers of attorney | From the end of the business relationship | The period is counted from onboarding instead of offboarding, which shortens the real period by several years. |
| Beneficial owner | Organization charts, declarations, verifications and the reasoning behind the control-chain analysis | From the end of the relationship | The outcome is kept but not the reasoning, which is exactly what inspectors ask for. |
| Purpose and nature | Information on the customer’s business and the purpose of the relationship | From the end of the relationship | It stays in a salesperson’s loose notes that never reach the file. |
| Transactions | Documents and records evidencing each transaction | From the execution of the transaction | The accounting entry is kept but not the supporting documents that justified it. |
| Analysis and alerts | Alerts generated, analysis performed, conclusion and decision taken | From the close of the analysis | Alerts closed as false positives are deleted, and they are precisely the ones that show analysis took place. |
| Reports | Reports filed with SEPBLAC and acknowledgments of receipt | From filing | The acknowledgment is kept on its own, without the file that gave rise to it. |
The start date is not the same for every block: due diligence records are tied to the end of the business relationship, and transaction records to the execution of the transaction. It is advisable to set this down in writing in the retention policy to avoid premature deletion.
Comparison
AML record keeping vs. data protection
Two obligations that seem to conflict but in fact apply one after the other.
| Issue | AML framework (Law 10/2010) | GDPR framework | How it is resolved |
|---|---|---|---|
| Lawful basis for processing | Legal obligation to keep records | Compliance with a legal obligation (Art. 6(1)(c)) | The basis exists; it must be documented in the record of processing activities |
| Period | Ten years | As long as necessary for the purpose | The AML period sets the GDPR period; it does not go beyond it |
| Purpose | Preventing money laundering and responding to requests for information | Limited and explicit | The AML archive cannot be used for commercial purposes |
| Access | Restricted to those who need it | Data minimization and access control | Specific permissions and an access log |
| Right to erasure | Gives way to the legal obligation | Can be exercised, within limits | Refused, with reasons, during the period |
| When the period expires | The obligation to keep records ends | Requires erasure if there is no other basis | Documented deletion |
The apparent conflict between the two frameworks is almost always resolved the same way: during the legal period, retention prevails; once the period has expired, erasure prevails. What cannot be defended is keeping records indefinitely “just in case”.
Sectors
Where records get lost in each sector
The failure is rarely deliberate destruction: it is a migration, a change of provider or a format that dies.
Law firms
The paper file
“There is still a physical archive, and the criteria for what was digitized and what was not were never documented.”
Real estate
The agent who left
“The customer’s records were in the email or on the computer of whoever handled the deal, not in a shared repository.”
Crypto
The monitoring history
“On-chain transactions are kept, but not the alerts or the analysis carried out on them.”
Consequences
What happens if you cannot retrieve the records
Record keeping is the obligation that holds up all the others: without a document, there is no proof that anything was complied with.
Being unable to produce a file is worse than having an incomplete one. A file with gaps can be argued over; a file that does not turn up is treated as nonexistent.
The breach comes to light at the worst moment: when there is already a request for information on the table and only a few days to respond.
And keeping too much is not neutral either. Holding personal data without a lawful basis after the period has expired is a different problem, but it can also be sanctioned.
| Severity | Amount | Basis or alternative |
|---|---|---|
| Minor infringements | up to €60,000 | Less significant breaches, or breaches with no appreciable impact on the AML/CFT system. |
| Serious infringements | €60,000 – €5,000,000 | Or 10% of the company’s total resources. |
| Very serious infringements | €150,000 – €10,000,000 | Or 10% of the entity’s own funds. |
Try it: ask for a customer file from eight years ago
It is the quickest test there is to find out whether your AML archive works. If it takes more than a day or comes back incomplete, you have a problem worth fixing before the next inspection.
Frequently asked questions
AML record keeping: common questions
How long must AML records be kept?
Ten years, under Article 25 of Law 10/2010. The start date is not the same for every block of records: due diligence records are tied to the end of the business relationship, and transaction records to the execution of the transaction.
Is a digital copy enough?
Yes, as long as integrity, legibility and retrievability are ensured for the whole period. What does not work is partial digitization without documented criteria, or a format that cannot be opened seven years from now. The retention policy must address storage medium, format and migrations.
When does the ten-year period start?
For due diligence records, from the end of the business relationship, not from onboarding. This is one of the most common calculation errors and the one that leads to premature deletion: a customer with a fifteen-year relationship means keeping their file until ten years after they leave.
Do alerts closed as false positives have to be kept?
Yes, and they are among the most valuable records. An alert closed with documented analysis shows that the monitoring system works and that judgment was applied. Deleting them leaves a record showing only the alerts that ended in a report, which suggests—wrongly—that nothing else is analyzed.
What about the GDPR? Don’t we have to erase the data?
During the legal retention period, the AML obligation serves as the lawful basis for processing and prevails over the right to erasure, which must be refused with reasons. Once the period has expired, the logic is reversed: if there is no other legal basis, the data must be erased. We cover this in detail on our data protection page.
What if an external provider holds the records?
The responsibility is still yours. The contract with the provider must guarantee retention for the legal period, access at any time and—critically—full return of the records when the relationship ends. If you outsource KYC or archiving, check that clause: it is the one most often missing. More on AML outsourcing.
Does deletion have to be documented?
It is strongly advisable. A retention policy that provides for deletion at expiry but leaves no record that it was carried out cannot explain why a file from twelve years ago is no longer there. The deletion record is what distinguishes compliant erasure from a loss of information.
What will they ask for in an inspection?
Usually a sample of specific files by name and date. What is assessed is not only whether they turn up, but how long it takes to locate them and whether they come complete with their context: identification, beneficial owner, purpose, transactions, alerts and decisions.
Does the AMLR change the period?
Regulation (EU) 2024/1624 also regulates the retention period, with a similar scheme, and harmonizes it at EU level from July 10, 2027. Before that date, it is advisable to review your internal policy to check that there are no differences in how the period is calculated. More on the AMLR page.
Can records be kept for more than ten years just in case?
Not without a basis that justifies it. Ongoing court proceedings, sanction proceedings or a pending claim may justify keeping specific records for longer. What does not hold up is indefinite, across-the-board retention as a default policy.
Practical guide
Practical guide to AML record keeping
A useful retention policy fits in a few pages and answers five questions: what, how long, where, who has access and when it is deleted. Ten steps to write it and test it.
Set the start date
For each block of records. Due diligence from when the customer leaves; transactions from their execution. Without this precision, deletions will be premature or late.
Test that it works
A policy nobody has tested is a hypothesis. Once a year, ask for two old files at random and time how long it takes.
And close the loop
Define what is destroyed at expiry, who carries it out and how it is recorded. Documented deletion is part of compliance, not the opposite.
10-step AML record-keeping checklist
- Inventory the blocks of records subject to retention and where each one currently sits.
- Set down in writing the rule for calculating the period for each block, distinguishing due diligence from transactions.
- Define the storage medium and format, planning for technology migrations.
- Set access permissions for the archive and keep an access log.
- Regulate custody by contract when a provider holds the records, including their return.
- Draft the procedure for responding to requests for information: who locates the records, within what time frame and in what format they are delivered.
- Document the lawful basis for GDPR purposes and the policy for responding to erasure requests.
- Define the deletion procedure at expiry, with a person in charge and a record of execution.
- Run an annual retrieval test on old files chosen at random.
- Review the policy after each system migration, change of provider or relevant regulatory change.
If you want to test your archive before the supervisor does, start with an AML/CFT audit or the external expert report.
Record keeping in operation
From “it’s all on file” to being able to prove it
Record keeping breaks down at specific, predictable moments. These are the four.
1) CaptureGetting the document into the archive
A file that lives in a salesperson’s email or in a local folder is not being kept: it is at risk of disappearing along with that person.
- Single repository
- No local copies
- Capture within the workflow
2) IntegrityKeeping it the same document
Stable format, preserved metadata and a record of versions. A PDF regenerated without its context loses much of its evidential value.
- Durable format
- Metadata
- Versioning
3) MigrationSurviving a system change
This is when most records are lost. Every migration needs an explicit plan for historical records, not just for live data.
- Plan for historical records
- Post-migration check
- Access to the old system
4) RetrievalBeing able to find it
The real test. An archive that keeps everything but takes three weeks to locate a file does not solve a request for information with a ten-day deadline.
Tip: run a retrieval test once a year with two files chosen at random, and keep a written record of the time taken and how complete the files were. It is top-tier evidence in an inspection.
Quick decisionQuick map: do we keep this?
Three common questions and their answers.
Closed alert
Yes. It is the proof that analysis took place. Keep it with its conclusion and date.
Prospect who never became a customer
Yes, if due diligence was started. Keep what was collected.
File from eleven years ago
No, if the period has expired and no proceedings are open. And keep a record of the deletion.
Records playbook
AML record keeping in practice
Written policy
A document setting out what, how long, where, who has access and when records are deleted.
Policy approved by the OCI, with version and date.
Start-date rule
Start of the period defined for each block of records.
A specific section of the policy and the matching system settings.
Capture
Every relevant document reaches the single repository.
No records in local folders or email.
Retrieval
Locating a specific file within a reasonable time.
Written record of the annual test, with time taken and completeness.
Deletion
Destruction at expiry, with a record.
Deletion log with date, scope and person responsible.
Signs that your AML archive will not deliver
Any one of these should prompt you to run a retrieval test this week.
- Nobody knows for sure where the files from before the last migration are.
- The period is counted from customer onboarding instead of offboarding.
- Alerts closed as false positives are purged periodically.
- A provider holds the records and there is no return clause.
- No one has ever tested retrieving an old file.
Working glossary
Key concepts in AML record keeping
Terms that come up in archiving policies, requests for information and external expert reports.
Art. 25Basis
Record keeping
The obligation to keep due diligence and transaction records for ten years.
Law 10/2010, Article 25.
Start dateCritical
Start of the period
Due diligence from the end of the relationship; transactions from their execution.
Common mistake: counting from onboarding.
IntegrityRequirement
Unaltered document
The document kept must be the same one, legible and with its context.
Format and metadata matter.
RetrievabilityTest
Ability to locate
Being able to find a specific file within a time frame compatible with a request for information.
Proven with a dry run.
DeletionClosure
Erasure at expiry
Documented destruction of information whose retention period has expired.
With a record of execution.
GDPRCoexistence
Lawful basis for processing
The legal obligation to keep records justifies processing during the period, not beyond it.
See: data protection.
MigrationRisk
System change
The moment when most records are lost. It requires an explicit plan for historical records.
Check afterwards, not just before.
CustodyThird parties
Outsourced archive
Responsibility cannot be outsourced: the contract must guarantee access and return.
See: AML outsourcing.
AMLR2027
Regulation (EU) 2024/1624
Harmonizes the retention regime at EU level from July 2027.
See: AMLR.
COMPLIANCE CONTROL CENTER · ARCHIVE
Decision matrix: keep, migrate or delete?
Cross the age of the file with its situation. The cell tells you what to do and how to record it.
Retention matrix
Green: ordinary situation. Red: requires a documented decision.
Age \ Situation
Active relationship
Relationship ended
Open proceedings
Under 5 years
Keepno doubt
Keepperiod running
Keepdeletion hold
5 to 10 years
Keepno doubt
Keepcheck start date
Keepdeletion hold
Over 10 years
Keeplive relationship
Deletewith a record
Keepuntil resolved
Obliged entities
Who does the record-keeping obligation apply to?
All obliged entities under Law 10/2010, regardless of size.
General
Obliged entities under Law 10/2010
We analyze whether you qualify as an obliged entity and which blocks of records you must keep given how you operate.
See obliged entities →
Law 10/2010Art. 25
Law firms
Lawyers and advisory firms
Mixed paper and digital archives, with digitization criteria that are almost never documented.
See AML for law firms →
PaperDigital
Fintech
Payment institutions and fintechs
Platform migrations are the main point where records get lost in this sector.
See our fintech approach →
MigrationHistorical records
Real estate
Real estate agents
Records tend to stay with the agent who handled the deal rather than in a shared repository.
See AML for real estate →
RepositoryStaff turnover
Common mistakes
The six record-keeping failures we see most
None of them is detected until a request for information arrives, which is exactly the problem.
Counting the period from onboarding
The period for due diligence records starts at the end of the relationship. Counting from onboarding leads to premature deletion of files that still had to be kept.
Purging closed alerts
Alerts that did not lead to a report are the proof that analysis exists. Without them, the record suggests that you only look at what gets reported.
Migrating without a plan for historical records
The migration project focuses on live data, and closed files are left in a system that nobody will be able to access two years later.
Outsourcing without a return clause
The provider holds the records and the contract does not say what happens when the relationship ends. When it does end, it is too late to negotiate.
Not documenting deletion
Records are correctly destroyed at expiry but no record of it is kept, and years later you cannot tell compliant erasure apart from a loss.
Never testing retrieval
The policy exists, the archive exists, and nobody has ever checked how long it takes to pull a file from eight years ago. It is an afternoon’s test.
Official sources
Where all of the above comes from
Direct links to the consolidated texts and to the competent bodies.
BOE
Law 10/2010 of April 28
Consolidated text. Article 25: record keeping.
BOERoyal Decree 304/2014 of May 5
Implementing regulations: storage media and retention conditions.
EUR-LexRegulation (EU) 2024/1624 (AMLR)
Harmonizes the information retention regime from July 2027.
EUR-LexRegulation (EU) 2016/679 (GDPR)
Data protection framework: lawful basis, minimization and erasure.
AEPDSpanish Data Protection Agency (AEPD)
Guidance on retention periods and the right to erasure.
SEPBLACExecutive Service of the Commission for the Prevention of Money Laundering
Financial intelligence unit and the authority that issues requests in inspections.
Initial publication, covering how AML record keeping fits with the GDPR and how deletion is handled.
Planned review: application of Regulation (EU) 2024/1624.
Contact
Book a call
Tell us where you keep your files today and when your last system migration took place.
Legal framework for AML/CFT record keeping
The record-keeping obligation is set out in Article 25 of Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing. It requires obliged entities to keep, for ten years, the documentation evidencing compliance with their due diligence obligations, as well as the documents and records of the transactions carried out.
Keeping is not storing: it is being able to retrieve
Complying with Article 25 is not just a matter of the document existing, physically or electronically. It requires integrity (the document kept is the same one and remains legible), context (the file can be reconstructed as it stood at the time) and retrievability within a time frame compatible with responding to a request for information. An archive that keeps everything but takes weeks to locate a specific file does not meet the obligation in substance, even if nothing has been lost.
Calculating the period
This is where most errors are concentrated. Due diligence records are kept for ten years from the end of the business relationship, not from customer onboarding. Transaction records are tied to the execution of each transaction. Applying a single start date from onboarding leads to premature deletion of files that legally still had to be kept, and it is a recurring deficiency in external expert reports.
Coexistence with the GDPR
The legal retention obligation is a lawful basis for processing under Article 6(1)(c) of the General Data Protection Regulation, and during the legal period it allows erasure requests to be refused with reasons. Once the period has expired, the relationship is reversed: if there is no other legal basis, the data must be erased. Indefinite retention “just in case” has no support in either framework. You can see the full picture on our data protection page.
What changes with the AMLR
Regulation (EU) 2024/1624 (AMLR), applicable from July 10, 2027, also regulates the retention period for information obtained when applying due diligence measures, harmonizing it at EU level. For Spanish entities, the useful exercise before that date is to review the internal policy—especially the start-date rules and the deletion procedure—to identify differences and correct them in good time. This work fits naturally with the review of the AML manual and with the year’s external expert report.
Related obligations
AML/CFT system
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Regulation (EU) 2024/1624 of May 31, 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingEUR-Lex · Official Journal of the EU
- Royal Decree 304/2014 of May 5 approving the Regulations implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .