Strong record keeping is one of the most important ways for a Money Services Business (MSB) to stay safe during a regulatory audit. When auditors review your business, the quality of your records can decide whether the audit stays manageable or turns into a serious problem.
In this blog, you will understand why proper records matter, which documents you must keep, how good record keeping protects your company, and the simple steps you can take to stay ready for an audit.
Why audits happen and what auditors look for?
MSBs must comply with the Money Laundering Regulations and other UK laws designed to prevent money laundering, terrorist financing, and related financial crimes. Because MSBs handle cash and move funds, supervisors such as HMRC or the FCA watch them closely.
During an audit, auditors mainly check two things:
- Do you have a proper plan and controls to prevent money laundering?
- Are you keeping the required records and reporting suspicious activity correctly?
Record-keeping problems are one of the most common issues auditors find. Even if your overall programme looks good on paper, weak record keeping, either physical or digital.
What records you must keep and why they matter?
Under the Money Laundering Regulations, most records must be kept for at least 5 years (usually from the end of the business relationship or the completion of an occasional transaction). Here are the key records every MSB should maintain:
Customer due diligence (CDD) records
Copies of identity documents and information collected to verify customers, including any enhanced checks for higher-risk situations.
Suspicious Activity Reports (SARs) and all supporting documents
When something looks unusual or suspicious, you must report it to the National Crime Agency (NCA). Keep the full file that shows why you made (or decided not to make) the report — including alerts, notes, reviews, customer history, and the final decision. This is one of the most important record sets auditors review.
Transaction records
Enough detail to reconstruct each transaction, including the parties involved, the amount, the date, the nature of the transaction, and any special instructions.
Records of higher-value or higher-risk activity
Where thresholds or risk indicators apply, keep clear details of the customer, the transaction, and the steps you took.
Customer identification records
Basic identity details (name, address, and ID information) collected as required by the rules.
Your anti-money laundering programme documents
Written policies, controls and procedures, business-wide risk assessment, staff training records, and results of any independent reviews or audits of your programme.
Registration and agent records
Evidence of registration with the relevant supervisor (HMRC or FCA) and lists of any agents who work with you.
Records must not only exist — they must be easy to find. Auditors expect you to produce requested records within a reasonable time, often within a day or two. After the retention period ends, personal data should normally be deleted unless the law or legal proceedings require you to keep it longer.
How strong record keeping protects your business?
1. It proves that your programme actually works
Having written policies is not enough. Auditors want to see real evidence that staff followed the rules, checked customers properly, monitored transactions, and acted when something looked wrong. Complete records provide that evidence.
2. It keeps problems smaller and less serious
When records are organised and complete, auditors can check samples quickly and move on. When records are missing or hard to find, auditors often expand their review. This can lead to more findings and stronger criticism.
3. It gives you a clear defence
If auditors question a decision (for example, why you did or did not submit a SAR), your old notes and forms show what information you had at the time and why you acted as you did. Without records, it becomes much harder to explain your actions.
4. It helps protect your banking relationships
Many banks are careful about working with MSBs because of the risk involved. An MSB that keeps strong, audit-ready records looks more reliable. This can make banks more willing to keep your accounts open.
5. It improves daily operations
Good records help you notice unusual patterns early, respond faster to questions from law enforcement, train new employees more easily, and manage agents more effectively.
Practical steps to build strong record keeping
Here are clear actions you can take:
- Collect every required piece of information at the time of the transaction. Incomplete forms create problems that are hard to fix later.
- Organise records so they can be searched by customer name, date, amount, or type of transaction.
- For every Suspicious Activity Report, keep a complete file that includes the original alert, investigation notes, supporting documents, the decision, and the report submitted to the NCA.
- Save both the current version and older versions of your policies and risk assessments. This shows how your programme has improved over time.
- Test your system regularly. Pick random records from the past two or three years and check how quickly you can find them.
- Make sure any agents who work with you follow the same record-keeping standards. You should be able to obtain their records when needed.
- Include record checks in your regular quality reviews and staff performance expectations.
- Train staff clearly on what information must be collected and how records should be stored.
What can happen if records are weak?
Weak or missing records can lead to several problems:
- Financial penalties
- Longer and more detailed examinations
- Damage to your company’s reputation
- Difficulty keeping bank accounts
- In serious cases, problems with your ability to continue operating
These issues almost never come from one single missing document. They usually build up over time when systems are weak, staff are not consistent, or management does not check the quality of records regularly.
What you should do right now?
Do not wait until you receive an audit notice.
Start by reviewing your current system against the five-year retention. Test whether you can quickly locate old transaction records, CDD files, and SAR documentation. Check that agents follow the same standards. Add record quality checks into your regular reviews and training.
Strong record keeping will not make every audit perfect. However, it will help you show auditors that you take the rules seriously and that your business is well managed.
Your records speak for your company when auditors are present. Make sure those records are complete, clear, and ready to support your business.