Ask most practices about file retention and you get an answer about storage — where the archive lives, whether it is scanned, what the cloud subscription costs.
That is the easy half. The harder half is that the Code sets two retention obligations that point in opposite directions, and a practice that has never separated them will get one of them wrong. You must hold your records for seven years. You must give the client their own documents back when they ask. Both are true at once, and the resolution is not obvious until you see it written down.
The two clocks
The Code of Conduct draws a line most retention policies do not.
Your records — the file you build as you act — must be kept for seven years after the date of the last action on the file for that client. That is a floor. You must not destroy them earlier.
Documents the client is entitled to — the material they gave you or paid for — must be kept securely and confidentially until the earlier of seven years after the last action, or the point at which you give them to the client or deal with them on the client's written instructions. That is a ceiling. They leave when the client asks.
Read together, the answer is: you keep the record, the client gets their originals back.
A practice that returns a client's passport and birth certificate while retaining a complete copy of the file has satisfied both. A practice that hands the whole file over and keeps nothing has breached the first. A practice that refuses to release a client's own documents because "we have to keep everything for seven years" has breached the second — and has probably breached more than that.
What the record has to contain
Part 6 of the Code is specific, and it is broader than a copy of the application:
- a copy of each client's application
- copies of each written communication between the client and you, between you and any relevant statutory authority, and between you and the Department regarding the client
- file notes of every substantive or material oral communication between the client and you, between you and an official of any relevant statutory authority, and between you and the Department regarding the client
Two things there catch practices out. The written-communication obligation is not limited to formal letters. And the file-note obligation covers oral communications with the Department and other authorities, not only with the client — the call you made chasing a case officer belongs on the file just as much as the call the client made to you.
"Last action on the file" is the date that matters
The seven years does not run from lodgement, from the decision, from your final invoice, or from the end of the financial year. It runs from the last action on the file for the client.
That has a practical consequence worth building into your process: a file you touch again has a new clock. A client returning two years later on a related matter, a request for information you answer in year four, a document you re-issue — each is capable of being a fresh last action, and your retention date moves with it.
Practices that stamp a destruction date at closure and never revisit it are the ones that destroy files too early. Key the schedule to the most recent action rather than to a date fixed at closure.
Documents the client is entitled to
The Code gives a description rather than a closed list. Documents the client is entitled to include, but are not limited to, documents provided by or on behalf of the client and documents paid for by or on behalf of the client — with passports, birth certificates, qualifications, photographs and other personal documents named as examples.
Note the second limb. Something the client paid for is theirs even if it never passed through their hands, which places a report you commissioned on their behalf in a different position from your own internal work product.
Two rules with sharp edges
Passports are never yours to hold
The Code states plainly that Australian passports, and most foreign passports, are the property of the issuing government and must not be withheld.
No fee dispute, unpaid invoice or internal policy makes withholding a passport defensible. If your office has ever held one pending payment, that practice needs to stop today.
A lien needs a practising certificate
The Code prohibits withholding a document belonging to a client as part of a claim of a lien over it — unless the agent holds a current legal practising certificate issued by an Australian body authorised to issue one.
For an RMA who is not also an Australian legal practitioner, that closes the question. The commercial instinct to hold documents against an unpaid bill is not available to you, and acting on it turns a fee dispute into a Code breach.
The seven-day rules
Three obligations run on a seven-day clock, and they are easy to conflate:
- A client may ask, orally or in writing, for the return of any document belonging to them. You must return it within 7 days of being asked.
- Where you terminate the contract and give written notice, then within 7 days of giving that notice you must update the client's file to reflect the current status of each case or application, deliver all documents the client is entitled to — to the client or to an appointed agent — and ensure financial matters have been dealt with as the contract specifies.
- On completion of services, if the client asks, you must give them all documents they gave you and all documents they paid for.
The first is the one that bites, because an oral request counts and rarely gets logged. If a client mentions on a call that they want their documents back, the clock has started, and the only evidence of when will be your file note.
Financial records are a separate set
Retention is not only about the matter file. The Code separately requires records of the clients' account, including:
- the date and amount of each deposit, its purpose, and the client on whose behalf it was made
- the date and amount of each withdrawal for an individual client, and the name of each recipient
- receipts for payments made by the client to you
- statements of services
- copies of invoices or accounts rendered
These must be available for inspection on request by the Authority, alongside records of each account into which client money for fees and disbursements was paid. Our guide to fee disclosure and client agreements covers the front end of that obligation.
Your electronic communications are records
One clause deserves more attention than it gets: an agent must act on the basis that their electronic communications are part of the agent's records and documents.
That is not a footnote about email etiquette. It means the messaging thread, the SMS confirming an instruction, and the message sent from a personal account at 9pm are all part of the file you are obliged to maintain and produce. A retention policy that covers your case management system but not the channels your team actually uses is not covering the record.
Retention is a supervision obligation too
OMARA's practice management guidance frames record keeping as part of the duty to supervise. Among the things an agent must take reasonable steps to ensure, it lists:
- all client contact is recorded on the client file
- records are kept in a secure and confidential manner for the periods set out in the Code
- effective control of client accounts is maintained, so unauthorised staff do not have access to client monies
- receipts are issued to all clients for all payments made
Those obligations apply whether your premises and staff are onshore or offshore. Retention is therefore not something the office manager owns in isolation — it is part of what you answer for as the supervising agent.
Building a schedule you could defend
- Split the policy in two. One rule for records you must retain; a separate rule for client-owned documents you must return. Most non-compliant policies are a single rule trying to do both jobs.
- Key the destruction date to the last action, not to closure, and recalculate whenever a file is touched.
- Record the return. When client documents go back, note what was returned, when, to whom and on whose instruction — then keep a copy for the record.
- Bring messaging into scope. If instructions arrive by SMS or chat, they belong on the file.
- Log oral requests. A verbal request starts a seven-day clock that only your file note will evidence.
- Reconcile the financial records separately, with a per-client ledger you could produce on request.
- Test it. Pull five closed files and ask whether you could produce the complete record — and whether anything the client owns is still sitting in your archive.
Where a system helps
Most retention failures are not decisions. They are gaps that open when a practice runs on memory, a shared drive and an email archive. The controls that close them are unglamorous: contemporaneous file notes captured against the matter, correspondence stored with the file rather than in an inbox, a per-client ledger, and a retention date that moves when the file moves.
If you are auditing your own position first, our OMARA Code of Conduct compliance checklist walks the wider obligations section by section.
Verify before you rely on it
Retention periods, clause numbering and the scope of client entitlements can change, and you are the one accountable for getting them right. Read the current instrument — the Code of Conduct text and the OMARA guidance behind it — before you finalise a destruction schedule or refuse a request for documents.