Recording and Retention Obligations

(1) The obliged entity shall record and retain
1. the information collected and obtained in the course of fulfilling the due diligence obligations
a) on the contracting parties, on the parties to the intermediated legal transaction under section 11(2), and, where applicable, on the persons acting for the contracting parties or the parties to the intermediated legal transaction, and on the beneficial owners,
b) on business relationships and transactions, in particular transaction records, insofar as they may be required for the investigation of transactions,
2. sufficient information on the conduct and results of the risk assessment under section 10(2), section 14(1) and section 15(3), and on the appropriateness of the measures taken on the basis of those results,
3. the results of the examination under section 15(6), no. 1,
4. evidence submitted by the parties involved under section 16a(2),
5. the grounds and a comprehensible statement of reasons for the assessment of a matter with regard to the reporting obligation under section 43(1), and
6. the decision of a crypto-asset service provider to terminate a cross-border correspondent relationship for reasons of the prevention of money laundering or terrorist financing. The records under the first sentence, no. 1, letter a) include records of the measures taken to establish the beneficial owner, and documentation of the ownership and control structure under section 12(4), first sentence. In respect of persons who are deemed to be beneficial owners under section 3(2), fifth sentence, the measures taken to verify identity under section 11(5) and any difficulties that arose during the verification process shall also be recorded.
(2) To fulfil the obligation under subsection (1), first sentence, no. 1, letter a), in the cases under section 12(1), first sentence, no. 1, the type, number and issuing authority of the document presented to verify identity, or, where this is not apparent, the issuing state, shall also be recorded. Insofar as documents under section 12(1), first sentence, nos. 1, 4 or 5 are presented to verify the identity of a natural person, or documents under section 12(2) are presented to verify the identity of a legal person, or documents determined under a statutory instrument issued under section 12(3) are presented or relied upon, obliged entities have the right and the obligation to make copies of these documents or to capture them by optical digitisation or, in the case of on-site reading under section 18a of the Identity Card Act, section 78(5), second sentence of the Residence Act, or section 13 of the eID Card Act, to record the service- and card-specific identifier and the fact that the data were obtained by way of on-site reading. These are deemed to be records within the meaning of the first sentence. The recording and retention obligation under subsection (1), first sentence, no. 1, letter a) also covers video and audio recordings made for the fulfilment of money-laundering-law due diligence obligations. Where, under section 11(3), first sentence, a fresh identification is dispensed with, the name of the person to be identified and the fact that he or she was identified on a previous occasion shall be recorded. In the case under section 12(1), first sentence, no. 2, instead of the type, number and issuing authority of the document presented to verify identity, the service- and card-specific identifier and the fact that the verification was carried out by means of an electronic proof of identity shall be recorded. Where identity is verified by means of a qualified signature under section 12(1), first sentence, no. 3, its validation shall also be recorded. Where information is obtained by inspecting electronically maintained registers or lists under section 12(2), the making of a printout is deemed to be a record of the information contained therein.
(3) The records may also be stored digitally on a data carrier. Obliged entities must ensure that the stored data
1. correspond to the information and data established,
2. remain available throughout the retention period, and
3. can at any time be made legible within a reasonable period.
(4) The records and other evidence under subsections (1) to (3) shall be retained for five years, unless other statutory provisions on recording and retention obligations provide for a longer period. In any event the records and other evidence shall be destroyed no later than the expiry of ten years. The retention period in the case under section 10(3), first sentence, no. 1 begins at the end of the calendar year in which the business relationship ends. In the remaining cases it begins at the end of the calendar year in which the relevant information was established.
(5) Insofar as documents to be retained must be submitted to a public body, section 147(5) of the Fiscal Code applies correspondingly to making the documents legible.