A file you cannot find, cannot prove or kept for too long is an audit finding. Six document management practices for regulated firms, and a three-question drill to check that they work.
When a supervisor or an auditor asks for a customer file, they are not reviewing your policy: they are checking whether you can hand it over complete, show who has touched it and explain what was done with what you no longer needed. Document management is the part of a compliance programme where intentions turn into evidence.
What the rules actually ask of your archive
The international standard sums it up in a few lines. FATF Recommendation 11 calls for keeping, for at least five years, transaction records sufficient to reconstruct individual transactions, and the information obtained through customer due diligence (copies of identification, account files, business correspondence and the results of any analysis), counted from the end of the business relationship or from the date of the occasional transaction. These records must also be available swiftly to the competent authorities.
Two clarifications. First, five years is the standard's minimum: your country's law may require more, and that is the number that governs. Second, keeping too much is also a risk. Data protection principles, such as the storage limitation principle in Article 5(1)(e) of the GDPR, say personal data should not be kept longer than necessary for its purpose. A compliance archive lives between two forces: keep what the rules require and no more than you can justify.
Six practices that make an archive auditable
1. An inventory of where each document lives. List the document types (identification, proof of address, beneficial ownership declaration, screening results, correspondence) and where they really sit. Files scattered across email, shared folders and the core system are a common cause of incomplete files.
2. Classify on the way in, not afterwards. Every document should arrive with minimum metadata: customer, type, date, risk level and retention class. If classification depends on someone tidying the archive "when there is time", it will not happen.
3. Calculate the disposal date from day one. Retention runs from an event, such as the end of the relationship, not from the upload date. Store the event, compute the date and treat disposal as a process with approval and evidence, not an informal clean-up.
4. Record who did what. An audit trail should answer who viewed, changed, downloaded or deleted a document, and when, and it should not be editable. Keep versions too: what was provided at onboarding may not be what is current today.
5. Role-based access and least privilege. Whoever reviews alerts does not need to edit files, and whoever uploads documents does not need to download them all. If you manage several entities or units, keep each one's data separate.
6. Signatures and consent you can demonstrate. Contracts, authorisations and consents signed electronically are evidence only if you also keep the signature trail: who signed, when and on which version of the document.
A three-question drill
To check that this works, pick a customer at random and answer within one working day:
- Can you hand over the complete file without going through five systems?
- Can you show who accessed or changed each document?
- Can you explain what was deleted and why, or what disposal date applies?
The "one working day" target is an internal yardstick we propose, not a deadline set by any rule. If any answer is "no", you already have next quarter's priority.
Where our platform fits
At GlobalKYCS we offer document digitisation and secure storage and we build Global Documents Manager, a platform for document governance and digital case management. According to its description, it includes AI auto-classification, retention and disposition policies, an immutable audit trail, e-signatures, full-text search and role-based access in multi-tenant environments. It is our own product, so read this paragraph as a description and not as a comparison: any tool will do if it covers the six practices above and can prove it in the drill.
A tool does not replace the policy: it makes it executable. And if your processes include AI agents, traceability matters even more; we looked at it in our article on the KYA framework.
Checklist
- Inventory of document types and locations, updated this quarter.
- Mandatory minimum metadata on upload: customer, type, date, risk and retention class.
- Retention policy with the event that starts the clock and the period required in your jurisdiction.
- Disposal process with approval and evidence.
- Non-editable audit trail and versions of each document.
- Role permissions reviewed at least once a year.
- Three-question drill documented and repeated on a defined schedule.