Ask most practices about file retention and you get an answer about storage — where the archive lives, whether it is scanned, what it costs.
That is the easy half. The harder half is that the Code sets two obligations pointing in opposite directions, and a practice that has never separated them will get one of them wrong. You must keep the client file for seven years. You must give the client their own documents back when they ask.
First, check which Code you are reading
This matters more than it sounds, because the superseded document is still in circulation and still on OMARA's website.
The Code in force commenced on 1 March 2022, prescribed by the Migration (Migration Agents Code of Conduct) Regulations 2021, and is numbered by section, 1 to 61. The one many practices still work from is the former Code — current from 18 April 2017, organised into Parts and clauses such as 6.1, 7.4 and 10.2, and published by OMARA alongside the current one under exactly that label.
If your retention policy cites Part 6, it is describing a repealed instrument, and several of the rules below are among those that changed.
Two duties, pointing opposite ways
The Code of Conduct draws a line most retention policies do not.
The client file — the record you build as you act — must be kept, taking all reasonable steps, for seven years after the last action on the file for that client. That is a floor. You must not destroy it earlier.
Documents the client is entitled to — the material they gave you or paid for — carry two separate duties: keep them securely, with no time limit stated, and return them within 14 days of a written request from the client, a former client, or a new registered agent.
Read together: you keep the record, the client gets their originals back.
Return a client's passport and birth certificate while retaining a complete copy of the file and you have satisfied both. Hand the whole file over and keep nothing, and you have breached the first. Refuse to release a client's own documents because "we have to keep everything for seven years" and you have breached the second — and probably more than that.
What the client file has to contain
Section 56(2) is specific, and it is broader than a copy of the application:
- a copy of the client's application or other immigration matter
- copies of all service agreements and any variations to them
- copies of all written communications, expressly including electronic ones, between you and the client, and between you and any other person or organisation to the extent the communication relates to the client
- the contemporaneous written records of oral communications with the client that section 55 requires separately
- records of material oral communications with third parties about the client
- copies of all invoices and receipts you gave relating to the client
- copies of all personal documents relating to the client that were given to you
- evidence of the safe return of any original documents belonging to the client
Three of these catch practices out. Naming electronic communications explicitly closes the argument that a messaging thread sits outside the file. The third-party oral record covers the call chasing a case officer, not only calls with the client. And the last item is an event record rather than a document — returning the passport is not enough; the file has to show that you did.
The file may be kept in written or electronic form, or partly both, and one file may cover two or more clients in the same family unit unless one of them asks for their own.
"Last action on the file" is the date that matters
The seven years does not run from lodgement, the decision, your final invoice, or the end of the financial year. It runs from the last action on the file for the client.
A file you touch again therefore has a new clock. A client returning two years later, a request for information you answer in year four, a document you re-issue — each can be a fresh last action, and the retention date moves with it. Practices that stamp a destruction date at closure and never revisit it are the ones that destroy files too early.
Transferring the file does not end the obligation. You may transfer possession to another migration agent, but the receiving agent then carries the same seven years plus a confidentiality duty over everything in it — sitting alongside yours rather than replacing them.
Documents the client is entitled to
Section 54(3) gives a description rather than a closed list: documents given to you, or to a member of your business, by or on behalf of the client, and documents paid for by or on behalf of the client. The accompanying note names passports, birth certificates, qualifications, photographs and business financial statements as common examples.
Note the second limb: something the client paid for is theirs even if it never passed through their hands, which puts a report you commissioned on their behalf in a different position from your own work product.
A lien is not realistically available to you
Section 54(2) says an agent is not entitled to claim a lien on documents a client or former client is entitled to unless the agent is a restricted legal practitioner who is eligible.
That exception is narrower than it looks. A person cannot be registered as a migration agent at all if they are an unrestricted legal practitioner, or a restricted legal practitioner who is not eligible. For the overwhelming majority of RMAs the question is simply closed: the commercial instinct to hold documents against an unpaid bill is not available to you, and acting on it turns a fee dispute into a Code breach.
The former Code also stated that Australian and most foreign passports are the property of the issuing government and must not be withheld. That express statement did not survive — but nothing about the position improved. A passport is a document the client gave you, so section 54 requires its return on request, and no lien is available to justify keeping it.
The fourteen-day rules
If your procedures say a client's documents must go back within seven days, they are quoting the former Code. The period is now 14 days, and it runs from a written request — from the client, a former client, or a new registered agent acting for them.
Both halves changed. Under the former Code an oral request started a seven-day clock. That is now easier to evidence, but it does not mean you can ignore a client who asks on the phone: the sensible response is to ask them to put it in writing, and to record that you did.
The same 14 days governs several neighbouring obligations — the termination notice where an agreement ends abruptly, notice to the Department where a matter is pending, and payment of any refund once it becomes payable — so it is worth setting as the practice's default turnaround rather than tracking four separate ones.
Money records live on the file
The former Code carried a separate list of clients'-account records. That list is gone; two provisions do the work instead.
Copies of every invoice and receipt you gave the client are part of the client file itself, so they fall under the same seven years. And section 50(2) requires you to demonstrate compliance with the client-money rules on request — which presumes records showing conduct over time, not a balance today. Our guide to fee disclosure and client agreements covers the front end of that obligation.
The Code is not the only clock in your practice
This is where most retention schedules quietly fall apart. A migration practice is subject to at least three regimes with different periods and — more awkwardly — different starting points.
Tax: five years, from a different event
The ATO's record-keeping rules for business require most records to be kept for five years, generally running from when you prepared or obtained the record, or completed the transaction it relates to, whichever is later.
Note what that is not: the last action on a client file. A receipt issued in year one of a matter still open in year four has a tax clock that started in year one and a Code clock that has not started at all. One schedule off a single trigger will breach one of them.
The ATO also flags longer periods in some situations, requires records to be in English or readily convertible, and notes that ASIC requires companies to keep records for seven years — so an incorporated practice has a fourth period to track.
Privacy: an obligation to destroy
The one people miss entirely, because it points the other way.
Under Australian Privacy Principle 11, an entity must take reasonable steps to destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed. The OAIC's APP 11 guidance sets that out, with the exception that matters here: it does not apply where the entity is required by or under an Australian law, or a court or tribunal order, to retain the information.
So during the Code's seven years you are required by law to retain, and the destruction duty does not bite. After it, once the information is genuinely no longer needed, it does.
Indefinite retention is therefore not the safe option people assume. "We keep everything forever, just in case" is not caution — it is an unmanaged exposure sitting on the oldest and least-protected data in your practice.
Note also that APP 11 applies to information an entity holds, and holding extends beyond physical possession to any record it has the right or power to deal with. Cloud storage and offshore access sit inside that definition.
Building a schedule you could defend
One framing to carry into this. OMARA's practice management guidance treats record keeping as part of the duty to ensure the quality of work done by others, and says those duties apply whether your staff are onshore or offshore. Retention is not the office manager's problem in isolation.
- Split the policy in two. One rule for the file you must retain, another for client-owned documents you must return. Most non-compliant policies are a single rule doing both jobs badly.
- Key the destruction date to the last action, not to closure, and recalculate whenever a file is touched. Run the tax clock separately — it starts on a different event and expires earlier.
- Set an end, not just a beginning. Once the obligations lapse, the Privacy Act expects destruction or de-identification, so the schedule needs a disposal step and a record of it.
- Bring messaging into scope and map where the data actually lives — cloud, backups, offshore access — because you hold all of it.
The five-file test
Take five closed matters and answer each of these without hunting:
- Could you produce the complete file — application, agreements and variations, written communications, records of oral communications with the client and with third parties?
- Is anything the client owns still sitting in your archive, and is there evidence of the safe return of what is not?
- Does each file have a retention date keyed to the last action rather than to closure?
- Are the invoices, receipts and messaging threads for that matter on the file itself?
- If the file is past every retention period, is there a disposal record showing what happened to it?
Where a system helps
Most retention failures are not decisions. They are gaps that open when a practice runs on memory, a shared drive and an email archive. The controls that close them are unglamorous: records of calls captured as they happen, correspondence stored with the file rather than an inbox, invoices and receipts on the matter, a retention date that recalculates when the file moves, and a disposal log so the end of the schedule is evidenced rather than assumed.
LodgeHQ is built so the compliant action is the default action. Start a free trial, or audit your position first with our OMARA Code of Conduct compliance checklist and our guide to file note requirements.
Verify before you rely on it
Retention periods, section numbering and the scope of client entitlements can change, and you are accountable for getting them right. Before you finalise a destruction schedule or refuse a request for documents, read the current sources: the Code of Conduct as prescribed and the Regulations on the Federal Register. Take particular care that anything you rely on describes the Code current from 1 March 2022, not its predecessor.
This is general information for migration practices, not legal or tax advice. Where a specific file raises a question — a disputed lien, a client demanding documents mid-matter, a decision to destroy — get advice on that file.