DPDP Insights › Questions › How long must we keep KYC and transaction records, and what

Question · Banking, financial services and insurance

How long must we keep KYC and transaction records, and what happens after?

Short answer: At least five years after the relationship ends; then erase

Under PMLA and RBI's KYC Master Direction, keep identity records for at least five years after the relationship ends, and transaction records for at least five years from the transaction. During that time, keep them only for that legal purpose. After it, erase or anonymise unless another law requires more.

What the law says

Section 8(7) allows retention where a law requires it. PMLA and RBI's KYC rules are such laws.

Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.

Steps

List KYC and transaction record types.
Set the start date: end of relationship or date of transaction.
Restrict access to closed-account records.
Erase or anonymise after the period.
Explain this in erasure replies.

Evidence to keep

Retention schedule
Access restrictions on closed accounts
Deletion logs

Common mistakes

Keeping everything for ever
Deleting before the legal period
Using closed-account data for marketing

From each seat

DPO / Privacy lead: Use this to explain refusals to erase in plain words.
CIO / IT head: Build an archive tier for closed accounts with restricted access.
Legal & compliance: Keep the list of retention laws current.
Customer service department: Explain retention politely when customers ask to delete.

What a good answer from management sounds like

“Closed-account records are locked and kept only for the legal period, then erased.” Effort and time: Medium · 8 to 12 weeks.