AML/CTF legislation stipulates a required AML data retention period. This period varies between market segments, and is usually five to seven years. Conversely, the Privacy Act requires organisations to dispose of data when no longer required.
AMLHUB provides a data retention/disposal (DRD) module to enable compliance with these regulations.
Retention and disposal process
The DRD module regularly updates (nightly) a "deletion candidates" report. This report includes all deals and parties that are now candidates for deletion.
The module is only accessible to individuals with the AMLCO role.
AMLCO reviews the report; if any of the records must be retained for legal reasons, the AMLCO needs to reach out to support@amlhub.co.nz and request a hold for these specific records.
In most cases, AMLCO approves the deletion of records.
AMLHUB permanently deletes the transactions, beneficial owners, and all associated data
An approval report is required for AMLHUB to remove any data. If a report is not approved, nothing happens - the data stays intact in AMLHUB.
How records are selected
Deals are marked for deletion based on the deals age AND last activity for any client in the deal. For example, a deal with clients A and B would not be eligible for deletion if either client transacted with you in the last five (or seven) years.
What is deleted
The DRD operates on a transaction and all beneficial owners.
The deletion process removes the transaction, parties, individuals, checks, documents, and audit records. A data removal audit record is created to reflect the deletion, but does not include any client data (i.e. names).