This is based on the Money Laundering Regulations 2007 requiring the retention of records of customer identity and the business relationship for 5 years, with an additional year added to align with the standard period for the limitation of legal action relating to contracts.