Which records are subject to 7-year retention
The Act and Rules name twelve broad record classes. The most common in a small practice are: customer identification records, transaction records related to designated services, AML/CTF Program versions including all superseded versions, sanctions and PEP screening history, AUSTRAC reports lodged (SMR, TTR, IFTI), training records, audit logs, ML/TF risk assessment versions, and correspondence with AUSTRAC.
- Customer identification records (clock from end of customer relationship)
- Transaction records (clock from transaction date)
- AML/CTF Program versions (clock from when superseded)
- Sanctions / PEP screening history
- AUSTRAC reports lodged
- Training records per staff member
- Audit logs
- ML/TF risk assessment versions
- AUSTRAC correspondence
Retention clock start dates
Different record classes have different start dates for the 7-year clock. Customer identification records run from the date the customer relationship ends. Transaction records run from the transaction date. Program versions run from when the version is superseded. Getting the start date wrong is the most common retention failure; it shows as records that look compliant today but are under-retained 6 years later.
The defensible mitigation is to never hard-delete and to use soft-archive instead. Caltury implements soft-archive at the application level so the retention period is reliably met regardless of which class of record is involved.
How Caltury holds the records
Records sit in an append-only vault hosted in Sydney (Supabase ap-southeast-2). The audit log records who created or modified each record and when. Records are exportable to CSV or PDF at any time, including for AUSTRAC inspection or independent review.
Hosting in Sydney is a deliberate data-residency choice. AU compliance data on AU soil eliminates a category of regulatory friction that comes with offshore-hosted systems.
Common questions
What if I move providers; do my records move with me?
Yes. Caltury supports export to CSV and PDF at any time, including immediately before cancellation. There is no fee for export and no lock-in. The retention obligation moves with the records; whoever holds them is responsible for meeting it.
Can records be soft-deleted to save storage?
Caltury does not charge for storage on any standard tier, so there is no commercial reason to delete. The default behaviour is soft-archive to ensure retention is reliably met across all record classes.
Is the audit log itself a retained record?
Yes. The audit log is itself subject to the 7-year retention obligation as a record of practice activity related to designated services.
What if AUSTRAC asks for a record older than 7 years?
Records older than the 7-year period are no longer required to be retained but may have been kept anyway. Caltury's default is to retain unless explicitly purged; you can purge records that have aged out of retention if you choose, but most practices keep them.
This page is general information about Australian AML/CTF obligations. It is not legal advice. AUSTRAC has not reviewed this content. For situations specific to your practice consult an Australian-qualified lawyer or AML/CTF adviser.