The record-keeping obligation is the requirement that a regulated business retains, for a defined minimum period (commonly five years, sometimes longer), the records needed to demonstrate its compliance: customer due-diligence documents and verification evidence, the customer risk assessment and its basis, transaction records, monitoring alerts and their resolution, internal and external suspicious activity reports, staff training logs, and the business risk assessment.
Definition
The record-keeping obligation is the requirement that a regulated business retains, for a defined minimum period (commonly five years, sometimes longer), the records needed to demonstrate its compliance: customer due-diligence documents and verification evidence, the customer risk assessment and its basis, transaction records, monitoring alerts and their resolution, internal and external suspicious activity reports, staff training logs, and the business risk assessment. The records must be retrievable and provided to the regulator or law enforcement on request.
For gambling operators, this extends to game and betting records (round recall), responsible-gambling tool usage, marketing consent and suppression logs, and self-exclusion records — the evidence base for both AML and player-protection compliance.
In context
For affiliates, the record-keeping obligation is background but it explains why operators retain so much player data and why data-protection and retention terms matter: the operator is legally required to keep due-diligence, transaction, monitoring and player-protection records for years, which is a lawful basis for retention but also a large, sensitive data holding that needs security and governance. It is why an operator cannot simply delete everything on request — some records must be kept to meet the legal obligation even if a player asks for erasure.
For affiliates that receive or handle any player-level data from operators, or that run their own consented marketing lists, the same principle applies in miniature: keep the records that evidence consent, suppression and compliance, for as long as needed and no longer, with proper security. For affiliates doing operator due diligence, an operator's ability to produce records — a clear game history, an activity statement, evidence of a self-exclusion being honoured — is a practical sign its compliance is real.
For affiliate-facing content, the framing is that the record-keeping obligation requires operators to retain due-diligence, transaction, monitoring and player-protection records for a defined minimum period, that this is the lawful basis for a lot of data retention and a reason some records survive an erasure request, that it underpins the evidence used to resolve disputes, and that affiliates handling player data or marketing consent should apply the same keep-what-you-must, securely principle.
Worked example
An affiliate's data explainer notes that a licensed operator must keep due-diligence, transaction, monitoring and self-exclusion records for years, which is why it cannot delete everything on an erasure request and why it can produce a game history or proof a self-exclusion was honoured when a dispute arises. The affiliate applies the same principle to its own marketing-consent and suppression logs.
Related terms
Frequently asked questions
Browse the full iGaming & affiliate glossary — hundreds of EN/RU terms with examples.
← Back to glossary