AML Records, Confidentiality, Training and Independent Review

Tipping-off rules protect confidential reporting and related processes. A routine customer explanation should not reveal a report or investigation. Staff should know how to escalate without discussing cases broadly.

An internal review finds that reports were prepared but some goAML submissions were rejected. The compliance team preserves rejection evidence, corrects the report through the lawful process, confirms accepted submission and investigates why monitoring failed. Replacing the old log with a clean list would erase the evidence and prevent a meaningful root-cause review.

Train staff on the risks they encounter, including ownership, unusual patterns, thresholds, sanctions and confidentiality. Attendance alone does not establish competence. Review sample cases and document how weaknesses are corrected. Update procedures when the law, regulator or business changes.

An AML review should have appropriate competence and independence from the work assessed. Findings need owners, deadlines and verification of remediation. Check current sector audit requirements, retention rules and reporting confidentiality obligations.

For auditors' STR decisions, ICAN's current guidance specifies at least five years from identification of the transactions for the working papers and supporting documentation, including decisions not to report. This is a particular requirement for those records. It should not be used as a universal five-year destruction rule for all customer, transaction, corporate or audit records.

A retention schedule therefore needs the record category, legal basis, start event, minimum period and any longer requirement arising from an investigation, legal hold or another professional obligation. Preserve the original evidence and subsequent versions. If a relationship closes, that event does not automatically end every retention obligation. Access and disposal decisions should be logged so that the firm can explain both what it retained and what it lawfully destroyed.

ICAN's STR guidance prohibits telling the audit client or a third party that an STR has been filed or considered. An audit report should address financial-statement consequences under the applicable auditing standards without revealing the filing. FIU's July 2025 guidance also describes the statutory protection of specified reports, records and information.

A restricted case file should contain the identification of the concern, evidence considered, decision-maker, report references and subsequent communications. The general client file can hold ordinary accounting and audit evidence, but permissions should prevent confidential reporting material appearing in a routine client download or shared meeting pack. Staff need a lawful way to answer routine questions without exposing a reporting decision.

Suppose an independent review finds that rejected submissions were recorded as completed because a staff member treated an upload as acceptance. The corrective action is more than revising a spreadsheet label. The firm corrects the outstanding reports through the permitted channel, retains acceptance evidence, identifies the affected reporting population and gives the responsible staff targeted training.

A reviewer then checks a later sample of submissions to confirm that the acknowledgement is captured and unresolved rejections remain visible. Management can close the finding when evidence shows the revised process works. A completion email without that evidence would leave the original reporting weakness unresolved.