AML/CFT — Record Keeping & Reliance on Third Parties

Concept

FAs must keep the documents and data obtained through CDD, ongoing monitoring, and transactions so that a clear audit trail exists and individual transactions can be reconstructed — generally for at least 5 years (verify current MAS Notice retention period). An FA may rely on an eligible third party to perform elements of CDD, but ultimate responsibility for CDD always remains with the FA — reliance and outsourcing never transfer liability. FAs must also screen customers and beneficial owners against sanctions and terrorist-designation lists and act on matches.

Key rules & facts

• Retention — at least 5 years (verify):

- CDD/account records — retained from the end of the business relationship.

- Transaction records — retained from the date of the transaction.

- (Verify exact anchors and whether any records require longer retention, e.g. where an investigation is ongoing.)

• Reconstruction & production: records must be sufficient to reconstruct each transaction and be produced promptly to MAS and law-enforcement authorities on request.
• Reliance on third parties: an FA may rely on an eligible/regulated intermediary to perform CDD if it: (a) immediately obtains the CDD information; (b) can obtain underlying documents without delay on request; and (c) is satisfied the relied-upon party is appropriately regulated and supervised for AML/CFT and applies adequate measures. Reliance is generally not permitted on parties in higher-risk jurisdictions (verify).
• Ultimate responsibility stays with the FA — even where CDD is relied upon or outsourced. Outsourcing may delegate the *task*, never the *liability*.
• Sanctions/targeted financial sanctions screening: screen customers and beneficial owners against UNSC and MAS designation lists; on a match, freeze without delay, do not deal with the assets, and file the required reports — while observing tipping-off rules.
• Screening timing: at onboarding and on an ongoing basis (including when lists are updated).
• Governance: maintain AML/CFT policies and procedures, an independent compliance function, independent audit, and ongoing staff training.

Key data — record-keeping & reliance

Exam angle

Recall the ≥5-year retention figure and the "responsibility stays with the FA" principle. Situational items test whether reliance/outsourcing shifts liability (it does not) and the correct sanctions-match action (freeze + report, while not tipping off).

Worked example

An FA relies on a regulated bank to perform CDD on a shared client. Two years later MAS requests the underlying identity documents. If the FA cannot obtain them without delay, it has breached the reliance conditions — and remains fully responsible for the CDD regardless of the bank's role.