# Standards and Regulatory References — Financial Records Retention

## Primary Legislation — UK

### Tax and Fiscal
- **Taxes Management Act 1970 s.34** — 6 years for corporation tax enquiry window
- **Taxes Management Act 1970 s.12B** — Record-keeping obligations for income tax self-assessment
- **Income Tax (PAYE) Regulations 2003** — Employer record-keeping: 6 years from end of tax year
- **VAT Regulations 1995 reg.31** — 6 years for VAT records from end of VAT period
- **VAT Act 1994 s.58** — VAT accounting records obligation

### Company Law
- **Companies Act 2006 s.386** — Obligation to keep accounting records
- **Companies Act 2006 s.388** — 6 years for private companies; 6 years for public companies from date of record
- **Companies Act 2006 s.441** — Filing obligations for annual accounts

### Limitation Periods
- **Limitation Act 1980 s.5** — 6 years for breach of contract actions
- **Limitation Act 1980 s.8** — 12 years for specialty contracts (deeds)
- **Limitation Act 1980 s.11** — 3 years for personal injury claims

## Primary Legislation — EU

### EU Accounting Directive 2013/34/EU
- **Article 30** — Member state transposition: retention of annual accounts (5-10 years depending on member state)

### Anti-Money Laundering
- **AMLD5 (Directive (EU) 2018/843) Article 40** — 5 years for CDD records from end of business relationship; 5 years for transaction records from date of transaction
- **UK Money Laundering Regulations 2017 reg.40** — 5 years for CDD and transaction records

### Financial Services
- **MiFID II (Directive 2014/65/EU) Article 16(6)** — Records of services, activities, and transactions: sufficient to enable competent authority to fulfil supervisory tasks; minimum 5 years
- **MiFID II Article 16(7)** — Telephone conversations and electronic communications: 5 years (extendable to 7 by competent authority)
- **Commission Delegated Regulation (EU) 2017/565 Articles 72-76** — Detailed record-keeping requirements under MiFID II
- **EMIR (Regulation (EU) No 648/2012) Article 9(2)** — 5 years following termination of derivatives contracts
- **PSD2 (Directive (EU) 2015/2366)** — Payment services records

## Primary Legislation — US

### SOX (Sarbanes-Oxley Act of 2002)
- **Section 802 (18 U.S.C. §1520)** — 7 years for audit workpapers
- **Section 802 (18 U.S.C. §1519)** — Criminal penalties for knowingly destroying documents to impede investigation

### Securities Regulations
- **SEC Rule 17a-4 (17 CFR §240.17a-4)** — 6 years for broker-dealer records (first 2 years readily accessible)
- **SEC Rule 17a-3 (17 CFR §240.17a-3)** — Records to be made by broker-dealers

### Tax
- **IRC §6501** — 3-year statute of limitations for tax assessments (6 years if >25% understatement; unlimited for fraud)

### AML
- **Bank Secrecy Act / 31 CFR §1010.430** — 5 years for CTRs, SARs, and other BSA records

### Anti-Corruption
- **FCPA (15 U.S.C. §78m)** — Books and records requirements; recommended 10-year retention

## Regulatory Guidance

### FCA (Financial Conduct Authority — UK)
- **SYSC 9** — Record-keeping requirements
- **COBS 9.5** — Suitability reports: record-keeping requirements
- **SUP 10C** — Senior Managers Regime: record-keeping

### HMRC
- **Business Records Checks guidance** — Record-keeping requirements and inspection powers
- **MTD (Making Tax Digital) requirements** — Digital record-keeping from April 2024

## GDPR Interaction
- **Article 5(1)(e)** — Storage limitation: financial data subject to both GDPR and statutory retention
- **Article 17(3)(b)** — Right to erasure exception: legal obligation to retain
- **Article 6(1)(c)** — Legal obligation as lawful basis for processing during statutory retention period