The client file — what goes in it and how long to keep it.

What the Act says

An obliged entity keeps, for 5 years counted from the first day of the year following the year in which the business relationship ended or the occasional transaction was carried out:

• copies of documents and information obtained through customer due diligence measures,
• evidence of transactions carried out and transaction records,
• the results of analyses performed under ongoing monitoring (art. 49(1)–(2) of the AML Act).

Before that period ends, the General Inspector of Financial Information may require the records to be kept for a further period of up to 5 years where necessary to counter money laundering (art. 49(3)). After the period, personal data is deleted.

Personal data is processed for AML purposes on the basis of a legal obligation (art. 6(1)(c) GDPR), not the client's consent — so the client cannot effectively demand erasure while the retention duty lasts. The entity's data-protection policy should say so. Full text: isap.sejm.gov.pl.

Contents of the client file

1. Identification data — the client, the representative, the beneficial owner; to the extent set in art. 36.
2. Copies of documents — the KRS or CEIDG extract, the representative's identity document, the power of attorney; every copy with the date obtained.
3. Declarations — on PEP status (with the criminal-liability clause) and on the beneficial owner.
4. Check results — registers, the CRBR, sanctions lists; with date, source, list version and result, including negative ones.
5. Risk assessment — factors, level, reasoning, date, review date.
6. Decision and signature — who decided to enter the relationship and at what level of measures; for a PEP, management approval.
7. Monitoring records — subsequent checks, transaction analyses, data updates; also a dated "no changes" entry.

Organising the file in practice

One file per client — on paper or as a folder in a system — with an index on the first page: the list of documents, date obtained, who added it. Name files so the date and source are visible without opening them, e.g. "2026-03-14KRSextract.pdf" or "2026-03-14AMLA-reportidentifier.pdf". Keep documents that are meant to prove the state on a given day in read-only form; record changes with a new document, not by overwriting the old one.

Decide who has access to the files and who may add to them — an inspection asks about this when assessing the internal procedure (art. 50). When a relationship ends, record the end date and compute the deletion date; the five years run from there. If you keep a register of above-threshold transactions or GIIF notices, keep it separate from the client files but cross-referenced to them.

How the report helps

The complete AMLA dossier is designed as a file component: the PDF carries an identifier and a timestamp, and every finding — register data, owners, sanctions hits, financials — names its source and retrieval date. The document can be confirmed on the verification page by its identifier; that answers the inspector's question "how do we know this document was not altered". The report covers items 1, 2 (the register part) and 4 of the list above and supplies the factors for item 5.

Items 3, 6 and 7 stay with you: the client's declarations, the signed decision and the monitoring records. A report ordered again a year later is a monitoring record — it shows the state as of the new day. The PDF arrives by e-mail and is available online; archive it in your own system like the rest of the file. See also: due diligence, GIIF inspection, counterparty monitoring.

Legal status as of October 2026. Information only, not legal advice.