Recordkeeping and Retention
Retention isn't a backup policy. It's a regulator-facing duty, with a defined period, defined access, and defined disposal.
In finance, retention is a regulatory duty, not a backup practice. You must keep certain records for defined periods. You must make them available to regulators on demand. And once the period ends, you must delete them carefully. Cheap storage is not a reason to keep them indefinitely.
Under the PML (Maintenance of Records) Rules, you must generally keep these records for five years after the relevant date:
- Transaction records
- Customer identification documents
- Related correspondence
The exact retention trigger and any recent amendments should be confirmed against the primary source.
Am I a Data Fiduciary?
Regulator-facing retention duties layer on top of DPDP's own storage-limitation principle — confirm your DPDP status first with the self-check.
Run it nowSo a firm cannot outsource retention thinking to its infrastructure team. At design time, product owners must decide:
- Which records are regulator-facing
- Where those records live
- Who can read them
- How to dispose of them when the clock runs out
This page summarises finance and fintech expectations for orientation. For binding rulings on your product, consult qualified counsel and the primary source below.
FIU-IND — AML legislation (PML Rules and amendments)
FIU-IND's index of the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005 and their amendments. Cited as the authoritative index rather than a single amendment file, so the link survives document moves.