Nobody opens a business because they are excited about record retention. It sits somewhere below choosing a new office chair on the list of things a finance team looks forward to, and it stays there right up until the afternoon when somebody asks a question about a payment made eighteen months ago.
That question can arrive from several directions. A bank reviewing an incoming transfer, a payment provider running a periodic review, a tax authority conducting an audit, a customer disputing that they ever ordered anything, or your own auditors wanting to tie a figure back to something real.
In every one of those situations, the business that can produce a complete file within an afternoon has a very different experience from the business still searching a former employee’s inbox three weeks later.
A bank statement proves almost nothing on its own
This is the misunderstanding that causes most of the trouble. A statement line shows that a sum of money moved between two accounts on a particular date, which is genuinely useful, and it demonstrates nothing whatsoever about why.
It does not show what was purchased, whether it was delivered, what was agreed, who authorised it, or whether the counterparty is who they claimed to be. When a reviewer asks you to substantiate a payment, they are asking for the commercial story around that line, and a screenshot of the transaction answers a question nobody asked.
Treat the statement as the index rather than the evidence, because everything that makes the payment defensible sits in other documents entirely.
What a complete record actually contains
For each significant transaction, you want the commercial agreement underneath it, meaning the contract, purchase order or signed quote that established what was being bought. You want the invoice, with the counterparty’s full legal name and banking details as they appeared at the time.
You want evidence that the thing was actually delivered or received, whether that is a delivery note, a timesheet, a shipping document or a signed acceptance.
You want the payment confirmation from your provider, including the reference and the date value was given. Where currency was converted, you want the rate and the fees applied, because reconstructing that later from memory is close to impossible.
You also want the authorisation trail, meaning who approved the payment and on what basis. If your process runs on someone saying yes in a meeting, you have no authorization trail at all, which becomes uncomfortable if a payment is later questioned internally.
Finally, keep whatever you gathered about the counterparty when you started dealing with them, including company registration details, verification of their bank account, and any due diligence you performed.
How long you are actually obliged to keep it
Retention periods come from more than one place, which is why businesses often get this wrong by keeping things for the shortest applicable period rather than the longest.
Anti-money laundering rules across most major jurisdictions require records of transactions and customer due diligence to be kept for a minimum of five years, generally measured from the date of the transaction or from the end of the business relationship, and some regimes allow or require longer.
Tax authorities commonly require supporting records for six years or more, and the clock may run from the filing date rather than the transaction date. Contract and limitation periods can extend well beyond both, depending on where you operate and what you agreed.
Because these overlap awkwardly, the practical approach most businesses land on is to set a single retention period that satisfies the longest obligation that applies to them, then apply it consistently rather than making case-by-case decisions nobody will remember.
Check the specific requirements for your jurisdiction and sector rather than assuming, since this is one area where the details genuinely vary.
The records that live in one person’s inbox
Here is the failure that catches otherwise well-organised companies. The contract was negotiated over email by someone in sales, the delivery confirmation went to operations, the invoice arrived in accounts, and the payment confirmation sits inside a provider portal that only two people can log into.
Nothing has been lost, exactly, but nothing is retrievable either, and when that salesperson leaves and their mailbox is deprovisioned, part of your evidence goes with them. Business email is not a filing system, and treating it as one works perfectly until the day it matters.
The fix is to decide where transaction records live, make sure it is a shared location rather than an individual’s account, and build the habit of filing as you go rather than reconstructing under pressure.
What happens when you change providers
Businesses switch payment providers reasonably often, chasing better rates, wider coverage or simply better service, and the records question rarely comes up during that decision.
Once you close an account, your access to historical transaction data may end sooner than you expect, and retrieving statements from a provider you no longer use ranges from mildly irritating to genuinely difficult.
Before you leave, export everything, meaning full statements, transaction details, payment confirmations, fee breakdowns and FX records, in a format you can still read in five years.
It is also worth checking, before you sign up anywhere, how easily you can get your own data out, and whether the provider publishes its regulatory registrations and compliance approach openly, since a provider that is transparent about how it is regulated is usually also straightforward about giving you access to your own records.
Building something you can actually retrieve from
Retention only helps if retrieval is possible, and a folder containing nine thousand undifferentiated PDFs technically satisfies the rule while being useless in practice.
A workable structure is simpler than people expect. File by counterparty, then by year, with a consistent naming convention that includes the date, the counterparty and the document type. Keep the payment reference in the file name where you can, because that reference is what a reviewer will quote when they ask.
Store it somewhere with proper access control and a backup, review once a year to confirm that what should have been deleted has been and what should have been kept still exists, and test the whole thing occasionally by picking a random payment from two years ago and seeing how long it takes to assemble the full file.
If that exercise takes more than an afternoon, you have found your weakness before anyone else does.
Final thoughts
Record-keeping is unglamorous work that pays off entirely in moments you cannot schedule. The reviewer’s question, the audit, the dispute and the compliance check all arrive without warning, and by the time they do, the only thing that matters is whether the evidence exists and whether you can find it.
Decide what a complete record looks like for your business, set a retention period that covers your longest obligation, keep everything somewhere shared rather than personal, export before you switch providers, and structure it so retrieval takes minutes.
None of it is difficult, and all of it is considerably easier than explaining why you cannot produce a document somebody has a legal right to see.
#RecordKeeping #Compliance #BusinessPayments #AuditReady #FinanceOperations #AML #CruisePayFinance
Recent Comments