Record keeping review: stages and deadlines
A record keeping review checks whether the files a crypto-asset business holds on customers, transactions and risk decisions are complete, current and retrievable. It runs in fixed stages: scoping, extraction, completeness testing, remediation and sign-off. Each stage carries its own internal deadline. Miss one, and the file moves into escalation rather than closure.
When a review starts
Reviews open on a schedule set by the compliance function, or in response to a trigger: a change in a customer's risk rating, a new product line, or a question raised by a supervisor during an inspection. The trigger fixes the population of files in scope. It does not fix the outcome — that depends on what the files actually show once opened.
What changes once a file is in review
Once a file enters review, the clock runs against internal deadlines, not against a statutory term. A missed internal deadline does not expire a right the way a licence term can lapse mid-term. When the right expires mid-term shows how differently that particular consequence plays out in a licensing context. Here, a missed deadline moves the file to a supervisor or the MLRO — it does not close the file automatically, and it does not end anything by itself.
Documents needed to start
A review cannot open without a defined file. Practically, that means:
- the customer due diligence file, including identification and source-of-funds evidence;
- the transaction history for the period under review;
- the current risk score and the log of any changes to it;
- correspondence with the customer relevant to the risk decision;
- notes from the previous review of the same file, if one exists.
Missing any of these does not stop the review from opening. It becomes the first gap on the remediation list.
Stages and typical deadlines
| Stage | What happens | Typical internal deadline |
|---|---|---|
| Scoping | Compliance defines which files fall into the review population. | Set before extraction starts |
| Extraction | Records are pulled from case management and transaction systems. | Early in the review cycle |
| Completeness check | Each file is tested against the internal checklist. | Fixed by the review calendar |
| Remediation request | Gaps are sent back to the file owner with a response window. | Tracked per file, not per batch |
| Escalation | Files with no response move to the MLRO before the window closes. | On expiry of the response window |
| Sign-off | The MLRO or a delegate closes the file and logs the outcome. | End of the review cycle |
Steps to run a review
- Compliance officer defines the scope and the population of files.
- Analyst extracts records from case management and transaction systems.
- Reviewer tests each file against the internal completeness checklist.
- Reviewer sends a remediation request to the file owner, with a stated response deadline.
- If no response arrives, the reviewer escalates to the MLRO before the deadline lapses.
- MLRO or delegated approver signs off the file and records the outcome.
Who decides, and by when
The MLRO decides whether a file closes, stays open for extended remediation, or triggers an internal report. A comparable structure applies elsewhere in governance: for own funds monitoring, Own funds fall below the threshold authorisation who decides follows the same logic — the person who signs off is fixed in advance, not chosen case by case once a problem appears.
If you're in one of these situations
If the gap is a missing customer document, the remediation request usually resolves inside the standard response window, and the file closes on schedule.
If the gap concerns ownership of something built for a customer, such as a custom tool or an improvement to one, the review may need to pause pending a separate decision. When a customer wants ownership of improvements sets out how that decision point is structured on the contract side.
If a supervisor is already asking about governance in parallel, treat this review as part of that response, not as a separate track running against its own clock.
What this page does not cover
This page does not set retention periods, does not list the documents a specific registration requires you to keep, and does not fix the deadline for reporting a suspicious pattern found during review. Those depend on the register your business holds and on the product line involved, and they are confirmed against your file, not against a general description.
Checked
Last checked: June 2025. This description reflects how a record keeping review is commonly structured inside an obliged entity. It does not cite specific statutory deadlines or provisions, in keeping with the procedural scope of this page; those are confirmed separately, against your registration and your file.
Related reading
Training programme step by step walks through a parallel process for staff training records, built on the same stage-and-deadline structure described above.
Next step
If the review has already surfaced a governance question a supervisor is asking about, start here: What to do first in this situation.
If a gap sits across a border and a foreign court might rule on it first, When a court in another country decides first sets out what that costs to get wrong.
FAQ
How long does record keeping review take in practice?
Duration depends on the number of files and the size of the gaps found. A single-file review often closes within one internal cycle if no remediation is needed. A batch review with several remediation requests can run across two or three cycles before every file signs off.
Which documents are needed to start?
At minimum: the customer due diligence file, the transaction history for the period, the current risk score with its change log, and relevant correspondence. A prior review's notes speed the process but are not required to open a new one.
What happens if the other side does not respond?
If the file owner or the customer does not respond inside the stated window, the reviewer escalates to the MLRO before that window closes. The file does not remain open indefinitely on the strength of an unanswered request; escalation, not silence, is the next step.