Immutable AML Audit Trail 7-Year Record Retention

What AUSTRAC requires in an audit trail

Under section 107 of the AML/CTF Rules, every reporting entity must retain AML/CTF records for a minimum of 7 years. AUSTRAC inspectors expect to find records that are complete, dated, attributable to specific staff, and produced without delay.

The records that must be retained include: customer identification documents, the outcome of every identity verification check, all screening results and how matches were resolved, risk assessments for each client, copies of every SMR and TTR lodged, your AML/CTF program document and every version of it, and evidence of staff training completion.

Manual record-keeping — folders, spreadsheets, email archives — creates significant risk that records will be incomplete, inconsistently dated, or difficult to locate under inspection pressure. ClearAML eliminates this risk by logging every event automatically and making records instantly searchable.

What "immutable" means and why it matters

An immutable audit trail is one where records are append-only: new events can be added, but existing records cannot be edited, overwritten, or deleted. ClearAML's audit log is built on this principle. Once an event is recorded — whether it's an identity verification outcome, a risk rating decision, or a staff quiz completion — that record is permanent.

This matters to AUSTRAC because it provides tamper-evident evidence. If a record shows a client was screened on a specific date, that record cannot have been backdated or altered after the fact. This is the standard that regulators expect from compliance systems operating under the AML/CTF Act.

Manual filing vs ClearAML