What records should a practice keep after client onboarding?

What records belong in a post-onboarding due diligence file?

A practice should keep the identity evidence it relied on, the verification decision it made, the engagement purpose, and the relationship end date in a single retained record set. For AML and KYC workflows, that file should be complete enough to show why the client was accepted, what was checked, and when the retention clock starts.

That is more than a filing convenience. The retained package needs to let a reviewer reconstruct the decision path later, so the record should be consistent, searchable, and tied to the specific client relationship rather than scattered across email, CRM notes, and onboarding forms.

How long should the practice keep those records?

The retention period in the direct answer is five years after the relationship ends or the transaction completes. The practical point is that the record clock should begin from the correct end event, because a wrong start date can create either premature deletion or unnecessary over-retention.

Practices often get the timing wrong when onboarding, account opening, and transaction completion do not happen on the same day. The retention rule is easiest to apply when the file includes a clear relationship end date and a consistent policy for which event controls the start of the five-year period.

Why does this record set matter for supervision and deletion?

The retained file is the evidence trail that lets a supervisor test whether the firm met its due diligence obligation. If the practice cannot produce the identity evidence and the verification decision together, it may have followed the process operationally but still be unable to prove it after the fact.

It also supports controlled deletion. Once the retention period expires, the practice can remove the file with more confidence because the record already captured the minimum evidence needed for oversight, audit reconstruction, and consistent disposal.

Risk and Threat Considerations

Weak retention design creates two opposite risks, under-retention can leave the firm unable to evidence due diligence, while over-retention can keep sensitive client identity material in circulation longer than needed. Both problems become worse when the onboarding record is fragmented across systems and no one can prove which date started the clock.

Failure mechanism: Retention fails when the firm cannot link identity evidence, verification outcome, purpose, and end date to one governed record, so deletion is either delayed, incomplete, or impossible to justify during review.

Impact: The practice may face audit findings, supervisory criticism, inconsistent disposal, and unnecessary exposure of sensitive onboarding data if records are kept longer than policy requires or deleted too early.

Practitioner Guidance

What to verify: Confirm that every onboarding file has four durable elements, the identity evidence used, the verification decision, the engagement purpose, and the relationship end date. If any one of those is missing, the file is not yet retention-ready even if the client was successfully onboarded.

Decision rule: Use one retention rule for the whole record set, not separate ad hoc timers for each document. If the onboarding file spans multiple systems, define a single system of record for the retained package and make the deletion trigger depend on that record, not on local copies.

Common mistake: Treating onboarding as complete when the client is accepted, while failing to preserve the evidence of why that decision was made. That creates a gap between operational completion and defensible compliance.

Practitioner takeaway: The objective is not to keep everything, but to keep enough to prove the due diligence decision and then delete consistently when the retention period ends.

Related resources from NHI Mgmt Group

• When does an NHI become too risky to keep as-is?
• What breaks when organisations keep using a compromised client-side library after the attack is discovered?
• How do security and privacy teams keep vendors accountable after onboarding?
• What breaks when TXT records are left unmanaged after onboarding?