Cookies on the Gambling Commission website

The Gambling Commission website uses cookies to make the site work better for you. Some of these cookies are essential to how the site functions and others are optional. Optional cookies help us remember your settings, measure your use of the site and personalise how we communicate with you. Any data collected is anonymised and we do not set optional cookies unless you consent.

Set cookie preferences

You've accepted all cookies. You can change your cookie settings at any time.

Skip to main content


The prevention of money laundering and combating the financing of terrorism

Gambling Commission guidance for remote and non-remote casinos: Fifth edition (Revision 3).

  1. Contents
  2. Part 7 - Record keeping
  3. 8 - Retention period

8 - Retention period

Records of identification and verification of customers must be kept for a period of five years after the business relationship with the customer has ended, for example where the customer closes their gambling account with the operator or ceases to visit or use the casino.148

Supporting records must be retained for a period of five years from the date the business relationship ended.149

Upon expiry of the five-year retention period, any personal data must be deleted unless:

  • the casino operator is required to retain records containing personal data by or under any law or the purposes of any court proceedings
  • the subject of the data has agreed to the retention of the data, or
  • the casino operator has reasonable grounds for believing that records containing the personal data need to be retained for the purposes of legal proceedings.150

Records of internal and external reports on suspicious activity should be retained for five years from when the report was made.


148 Regulation 40(3).
149 Regulation 40(3).
150 Regulation 40(5).

Previous section
Supporting records (gaming machines)
Next section
Form in which records are to be kept
Is this page useful?
Back to top