Risk Management · 8 min read · Updated 25 October 2026

Audit Trails in Conveyancing Compliance: What to Record and for How Long

What Regulation 40 requires, what the SRA found missing on files, and how to reconcile retention with data protection.

By Appan Pathmanathan, Chief Operating Officer, Lex Sentinel

A conveyancing firm needs an audit trail because the Money Laundering Regulations 2017 require it to keep records sufficient to reconstruct a transaction, and because the firm must be able to show its supervisor that its due diligence was appropriate. Records are kept for at least five years, after which personal data must be deleted unless an exception applies.

I work at Lex Sentinel, which builds AI tools for conveyancers, and nothing below depends on a product. This is general information for firms regulated by the Solicitors Regulation Authority (SRA) in England and Wales, not legal advice, and I will update it when the SRA or the Information Commissioner's Office (ICO) publishes something new. Our guide to the anti-money laundering (AML) framework covers the firm-level policies that sit behind the file records.

What records do the Money Laundering Regulations require?

Regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, which I'll call the Regulations, requires a firm to keep copies of the documents and information it obtained for customer due diligence, and supporting records of transactions that were subject to due diligence or ongoing monitoring. The transaction records must be enough to reconstruct the transaction. The Regulations say what the records must contain and are silent on form, though copies must be admissible in evidence.

The table sets out the main record-keeping duties.

Record	What the Regulations say	Where
Due diligence documents and information	Keep copies of what you obtained to meet your customer due diligence obligations	Regulation 40(2)
Transaction records	Keep supporting records of transactions subject to due diligence or ongoing monitoring, enough to reconstruct the transaction	Regulation 40(2)
Firm-wide risk assessment	Keep an up-to-date written record of the steps taken to assess risk, unless your supervisor has notified you in writing that none is required	Regulation 18
Policies, controls and procedures	Keep a written record of them, of any changes made on review, and of the steps taken to communicate them	Regulation 19(1)(c)
Appropriateness of due diligence	Be able to demonstrate to your supervisor that your due diligence measures were appropriate to the risks	Regulation 28(16)

How long must a firm keep AML records?

A firm must keep AML records for at least five years. Under regulation 40(3) the period runs from when the firm knows, or has reasonable grounds to believe, that an occasional transaction is complete or the business relationship has ended. Regulation 40(4) provides that records of transactions within a business relationship need not be kept for more than ten years. It does not apply to occasional transactions or to the customer due diligence copies.

Regulation 40(5) then requires personal data obtained for the Regulations to be deleted when the period ends, unless an exception applies. The exceptions in the text are retention required by law or for court proceedings, the data subject's consent, and reasonable grounds to believe the records are needed for legal proceedings. Legislation.gov.uk records two pending changes under the 2026 amending Regulations, to Schedule 6 and a new regulation 34A. I have not established that either alters regulation 40.

How does data protection law fit with keeping records?

The two pull in different directions, and the firm has to reconcile them in its retention policy. Under the storage limitation principle in Article 5(1)(e) of the UK General Data Protection Regulation (UK GDPR), personal data must not be kept in an identifiable form for longer than necessary. The ICO's guidance says the UK GDPR sets no specific time limits, and that data kept to meet a legal retention requirement is not treated as kept for longer than necessary. Regulation 40 is that kind of requirement for the AML records, but only for the period it sets.

The ICO also says the accountability principle requires you to be able to demonstrate compliance and that it is not a box-ticking exercise, and Article 30 requires records of processing to include, where possible, the envisaged time limits for erasure. The ICO marks both pages as under review because of the Data (Use and Access) Act 2025, so the position may change. In practice, set one deletion date for AML records at the end of the Regulations' period and diarise it, so deletion happens as a routine step on that date.

What does the SRA expect on a conveyancing file?

The SRA expects each file to carry a clear, documented account of what you checked and why. In its thematic review of source of funds and source of wealth, published on 5 November 2025, the SRA reviewed 5,873 files across 833 firms and found no source of funds check on 648 of them. The SRA's text gives the base for that count as the 5,026 files that required a check. It also found inadequate scrutiny of source of funds or wealth on 18% of files and, on 8%, a source of funds in the ledger that the evidence didn't support, and it says it found no evidence trail of the enquiries made where fee earners knew the source of funds.

The SRA's expectation is that each matter records what evidence was reviewed, when, what judgement was reached and why, and that the file says why a check wasn't done if it wasn't. The SRA's record form is optional, and file notes or a case management system are acceptable. Firms told the SRA they were unsure when a source of funds check is "necessary" under regulation 28(11)(a), and I found no single SRA page on file documentation, so the review and the regulations are the working sources.

The SRA's client and matter risk assessment template page says a firm must carry out and record a risk assessment for every client and matter within scope. A written assessment may not be needed for every matter where the work is highly repetitive and the client risk assessment covers the risk comprehensively, provided that assessment is regularly reviewed. The page also says firms should document all the steps taken. In the SRA's 2025/26 AML report, the share of files with no or an incomplete client and matter risk assessment fell from 16% in the previous reporting period to 9%.

What does the SRA Code of Conduct for Firms say about records?

Paragraph 2.2 of the Code of Conduct for Firms says: "You keep and maintain records to demonstrate compliance with your obligations under the SRA's regulatory arrangements." Paragraph 2.1 requires effective governance structures, arrangements, systems and controls, and paragraphs 3.2 and 3.3 require a firm to cooperate with the SRA and give full and accurate information and documents on request. That makes the file the firm's main evidence in any SRA inquiry, and a gap in it is hard to fill after the event.

Do suspicious activity reports need their own records?

Yes, suspicious activity reports need their own records, kept separately from the client file. The SRA's guidance on the Proceeds of Crime Act, last updated in September 2023, says the money laundering reporting officer (MLRO) should keep a record of all internal reports made to them and of any suspicious activity reports submitted. It also says it is good practice to record the rationale for any decision, which may help evidence a reasonable excuse for not making a disclosure under sections 327(2)(b), 328(2)(b) and 329(2)(b) of the Proceeds of Crime Act 2002. Where a firm asks the National Crime Agency for consent, the notice period is seven working days under section 335(5). If consent is refused, a 31-day moratorium period starts under section 335(6), which a court can extend.

Because tipping off is an offence, keep a clear line between what the client file shows and what the MLRO holds.

Does an audit trail need a particular format?

No, an audit trail does not need a particular format or software. The Regulations say what the records must contain and are silent on form, provided copies are admissible in evidence. The SRA's record form and risk assessment template are optional, and the ICO mandates no format for records of processing. A file note, a form or a case management entry can each work if it shows what was checked, when, by whom and what was decided. What the supervisor is looking for is evidence a reader who wasn't there could follow.

About the author

Appan Pathmanathan is a solicitor and Chief Operating Officer of Lex Sentinel, which builds AI tools for UK conveyancers. He has worked in UK legal practice since 2001, including litigation involving money laundering and fraud, and conveyancing, and has been managing partner of a law firm. He delivers AML and compliance training. Connect on LinkedIn.

Sources

Checked on 25 October 2026.

Frequently Asked Questions

How long must a conveyancing firm keep AML records?

A firm must keep them for at least five years, running from when it knows or has reasonable grounds to believe the business relationship has ended or the occasional transaction is complete, under regulation 40(3) of the Money Laundering Regulations 2017. Personal data must then be deleted unless an exception applies, such as retention required by law or for legal proceedings.

Does the SRA require a particular form for source of funds records?

No. The SRA's record form is optional, and file notes or a case management system are acceptable. The file should show what evidence was reviewed, when, what you concluded and why.

Do I need a client and matter risk assessment on every file?

Yes, for every client and matter within scope, according to the SRA's template page, with an allowance for highly repetitive work where the client risk assessment covers the risk and is regularly reviewed. The SRA's 2025/26 AML report says the share of files with none or an incomplete one fell from 16% to 9%.

Where should suspicious activity report records be kept?

The money laundering reporting officer keeps them, separately from the client file, according to the SRA's guidance on the Proceeds of Crime Act. Record the rationale for any decision.

Can I keep AML records longer than the Regulations require?

Yes, but only if you have another lawful basis and a reason, because data protection law limits how long personal data is kept. Regulation 40(5) requires deletion at the end of the period unless an exception applies.