How long do I need to keep KYC records?

Ten years as a general rule. Under Art. 25.1 Ley 10/2010 the period runs from the end of the business relationship or the execution of the occasional transaction; once it expires, the documentation must be deleted.

Two limits are often overlooked in practice:

1. Access restriction after five years: After five years, ordinary internal access to the retained documentation is limited to the brokerage's control bodies — including any technical prevention unit — and, where applicable, those instructed with legal defence (Art. 25.1). The access and disclosure powers of SEPBLAC and other competent authorities are unaffected.
2. Requirements on the archive: The law does not prescribe any particular software or file format. Art. 25.2 does, in substance, require the archiving system to ensure integrity, correct legibility, protection against tampering, and proper management of the documentation — including timely provision to the competent authorities.

From 10 July 2027, Art. 77 AMLR applies a shorter five-year period as a general rule; a competent authority may require at most five further years in an individual case. How Spain will structure the transition from today's ten years to the future five is still open.

Legal basis: Ley 10/2010, Art. 25; AMLR (EU 2024/1624), Art. 77

Practical tip: The period runs from the end of the business relationship, not from the notary appointment — for mandates that drag on for years or end without a completion, those are two different dates. Record in each file when the business relationship actually ended; without that date, neither retention nor deletion can be justified later.