Records and retention

CDD Core keeps the evidence of due diligence for as long as the law asks and refuses to delete anything still under retention. Each record carries its own retain-until date, computed once when its clock starts. Every action, signature and sign-in is logged in records nobody can edit.

Who may open it: Compliance Officer, Head of Compliance and Internal Audit (retention screen, read) · Internal Audit and System Admin (sign-in log, read).

What is kept, and for how long

Record	Kept for	Counted from
CDD evidence of a customer	10 years	The day the customer’s last account closed
Filed reports, with the documents, receipt and approval	5 years	The date of submission
Statement delivery log	Never deleted	—

Retention periods are statutory values: the institution reads them; they change only through the platform on the institution’s written request with a board resolution.

How the date is computed

The CDD clock starts on the day the customer’s last account closed. That day comes from one of three places:

Source	Meaning
SOURCE	The closing date sent by the source system
KEYED	The closing date an officer recorded
OBSERVED	When neither exists: the business date of the first source file that reported the account closed — possibly later than the real date, never earlier, so retention is never shorter than it should be

A SOURCE or KEYED date replaces an OBSERVED one. If the account reopens, the start point is cleared and the clock stops. When a date cannot be computed yet, the row says why in words: no account yet, accounts still open, no period set, report not filed.

The retention screen

Figures at the top: records under retention, records whose period has elapsed, records not yet counting, and how many tables refuse deletion out of all tables.
CDD evidence: each customer with start date and source, period, retain-until date, status and days left.
Filed reports: the filing register in the same form.

Delete guards

Data under retention cannot be deleted — by any role or any service of the system. The guard is checked again every time the screen opens.
Customer data, applications that hold evidence, reports, signatures and logs carry guards that refuse deletion, or refuse both change and deletion. The few exceptions — staging areas and rebuilt indexes — are listed with their reasons.
Nothing is deleted automatically when a period ends. The record shows “period elapsed”; destruction is the institution’s decision, carried out by the platform on its written request and logged.

Audit trails

Action log — who did what, when, in which role, with the detail.
Sign-off log — every signature and return, with the reason; it cannot be edited or deleted.
Sign-in log — six events: sign-in, sign-out, automatic sign-out after inactivity, session ended without sign-out, replaced by a new sign-in, and failed sign-in with the reason. The screen opens on the last 7 days.
Run and import logs, and every contact with an outside party or system.

Idle screens sign out after the time the institution sets (15 minutes by default, between 5 and 60), with a one-minute warning and a Stay signed in button. See Security and data.

Abandoned applications

A draft application with no activity for 60 minutes — 72 hours once the applicant’s e-mail is verified — that holds nothing that must be kept is removed — files first, then the rows — so that the personal data of people who never applied is not kept longer than needed. A draft that already holds identity results, a signature, screening results or a decision is kept. A failed liveness check is trimmed to provider, session number, status and time, and each removal is logged without personal data.

What the system does or refuses

A retain-until date is computed once and stored with the period used.
The statement delivery log is never deleted, whatever happens.
The sign-in log is read-only.