A useful AML file explains the evidence and decisions without spreading sensitive customer material across email, shared drives and sales systems. AUSTRAC states that reporting entities must comply with the Privacy Act, including small businesses that are reporting entities. Plan collection, storage and access together. Keeping a record because the law requires it does not justify giving everyone unrestricted access or retaining unrelated duplicates indefinitely.
Collect information for an identified purpose
Identify the CDD matter and the evidence method before requesting a document. Record what information is necessary and where it will be stored. Avoid asking customers to send identity images to several staff members because each team has a separate checklist. Where a provider collects information, understand what the practice receives and can retrieve. Distinguish the required verification record from an assumption that a full image must always be copied into every system.
Make access follow the work
Separate ordinary client administration, detailed identity evidence and protected reporting material. Assign access according to the person's actual role and remove it when responsibilities end. Use an approved secure channel for requests and exchanges, and check the intended recipient before sharing. A client folder shared with an external bookkeeper should not silently expose unrelated beneficial-owner documents or internal suspicion records. Record significant access or disclosure decisions where appropriate.
Apply retention and security together
OAIC's APP 11 guidance addresses both security and destruction or de-identification when information is no longer needed, subject to legal retention exceptions. Apply the relevant AML retention period and any other lawful requirement to each record class. Keep necessary records protected and retrievable. Review temporary downloads, test copies and duplicated attachments separately; a seven-year obligation for a retained record is not a blanket instruction to keep every working copy forever.
Test the process with a common request
Suppose a customer asks for a correction or another adviser requests their file. Confirm authority, decide what can lawfully be shared and exclude material subject to disclosure restrictions. Use a controlled export rather than forwarding the entire folder. If information was sent to the wrong recipient, use the incident procedure and assess applicable notification duties. Periodically test retrieval and access removal so the policy reflects what people can actually do.
Official sources
Confirm the current rules against these primary sources, last checked .
Questions
Can a small reporting entity ignore privacy duties?
No. AUSTRAC's record-keeping guidance expressly explains that reporting entities have Privacy Act obligations even when they are small businesses.
Must every identity document image be retained?
Do not assume that. Apply the relevant record-keeping and verification requirements and retain sufficient information about what was done, using an appropriate evidence method.
Does a customer's request authorise disclosure of an SMR?
No. Consider protected-information and other legal restrictions separately when handling access, correction or file-transfer requests.
General information for Australian professionals, not legal advice. It does not replace the AML/CTF Act, the Rules or AUSTRAC guidance. See our editorial standards.
Keep reading
- Seven-year record keeping6 min
A practical retention schedule for CDD, transactions, programs, reports, screening and governance evidence under Australian AML/CTF law.
- Correcting a customer record3 min
Correct inaccurate customer information, reassess affected checks and retain the necessary history without treating an audit log as a reason to leave bad data in use.
- Tipping off explained4 min
What tipping off means under the AML/CTF Act, which SMR-related information is protected and how Australian firms communicate without disclosing it.