S.L. 386.34 Art. 5Duties of the Registrar. Data retention period.

(1) It shall be the sole duty of the Registrar, in accordance with article 401(1) of the Act to establish, manage, operate, and maintain the repository in accordance with these regulations. The Registrar shall exercise all such powers and perform all duties as may be necessary to ensure the proper functioning of the repository.

(2) Any personal data contained in the repository shall be retained for a period of five (5) years following the closure of the account of the user or the termination of the repository, as may be applicable:

Provided that the period of five (5) years may be further extended by the Registrar, up to a maximum retention period of ten

(10) years, where such extension is necessary for the purposes of the prevention, detection, analysis, investigation or prosecution of money laundering, associated predicate offences, funding of terrorism or any other serious criminal offence, or any other obligation imposed by law requiring the Registrar to process such personal data.