"Five to ten years" is a vendor default, not a rule. Here is how to set a lookback you can defend

EU law fixes the cadence of review, the retention of the record and the treatment of an allegation — never the depth of the search. No instrument states a lookback period for adverse media and no supervisor publishes one. The window is your policy parameter, and the only test that matters is whether you can write down why it is what it is. A defensible default: three years for a standard-risk customer with no control role, and the full life of the relationship with a five-year floor wherever enhanced due diligence applies. For PEPs, the full period in office plus a tail of at least the 12 months Article 45(2) requires. For higher-risk subjects tied to a high-risk third country, no fixed limit. Then handle the three things that break historical searches: link rot, allegations that never became convictions, and the point where a deletion request meets a retention duty.

Regulation (EU) 2024/1624 — the AML Regulation, directly applicable from 10 July 2027 under its Article 90 — never uses the phrase "adverse media". It fixes four adjacent things instead.

Article 40 of Directive (EU) 2015/849 is the predecessor of Article 77 — the Regulation's own Annex VI correlation table says so — and national implementations of it govern until July 2027.

Two further provisions decide how a finding may be handled. Article 76(2)(b) requires that data of this kind originate from reliable sources and be accurate and up to date. Article 76(3)(b) requires procedures that allow "the distinction, in the processing of such data, between allegations, investigations, proceedings and convictions", taking into account the right to a fair trial, the right of defence and the presumption of innocence.

The nearest thing to EU guidance on adverse media itself is the EBA ML/TF Risk Factors Guidelines, EBA/GL/2021/02 of 1 March 2021, read in the consolidated version that includes the 2023 amendments in EBA/GL/2023/03. They list adverse media reports as a customer-reputation risk factor and then say how to weigh them: credibility is determined "on the basis of the quality and independence of the source of the data and the persistence of reporting of these allegations". And, in a sentence worth pinning to the wall: firms should note that the absence of criminal convictions alone may not be sufficient to dismiss allegations of wrongdoing.

Age appears nowhere in that test.

There is one place where EU law does require a public-information reputation check by name, and it is narrow. For cross-border correspondent relationships, Articles 36 and 37 AMLR require the institution to determine the respondent's reputation "from publicly available information" before entering into the relationship. Everywhere else, adverse media is an inference from the risk-based approach rather than a stated obligation — which is exactly why the window has to be argued rather than cited.

"Five to ten years" comes from vendor pages, repeated until it acquired the grammar of a rule. Checked on 4 September 2026, the pages ranking for adverse media historical data carry the range without citing an EU instrument, an EBA guideline or a national supervisor for it. It is not wrong as a starting point. It is unusable as a justification, because a supervisor asking "why ten years?" gets the answer "a vendor's default".

Three inputs, one output, and a sentence you commit to the file.

Input 1 — risk tier, from your own customer risk assessment. Standard; higher risk with enhanced due diligence under Section 4 of Chapter III; PEP, family member or close associate.

Input 2 — entity type, because exposure is not symmetric. A retail customer with no control role; a natural person exercising control (director, authorised signatory, beneficial owner); an operating legal entity; a holding or arrangement whose economic purpose is not obvious from its filings.

Input 3 — jurisdiction of the reporting, not only of the subject. An EU member state with searchable, archived press and published court reporting is not the same information environment as a country where the online record starts in 2015, or one where reporting on certain subjects does not appear at all.

Two rules make the table work. First, the window is a floor on the search, not a cap on the finding: a credible 2009 report that goes to source of wealth does not become irrelevant because your policy says three years. It becomes a finding you record and explain. Second, every branch that narrows the window has to name what it is giving up. "Three years" is a defensible sentence. "Three years" with no reason attached is a default.

The subject below is invented, including the company, the people and the publications. Any resemblance to a real party is coincidental.

A Dutch payment institution is onboarding Nordvent Bulk Chartering B.V. (Rotterdam, incorporated 2019), a dry-bulk charterer applying for a EUR account and a working-capital facility. Sole director and 62% shareholder: Marek Zielarz, 54, Polish national, resident in the Netherlands. Minority shareholder: a Cypriot holding company.

Risk assessment: higher risk, driven by the sector rather than the individual: shipping and chartering, with a third-country holding layer and counterparties in jurisdictions subject to restrictive measures. Enhanced due diligence applies, so Article 26(2)(a) sets an annual review. The framework puts the search at the full life of the relationship with a five-year floor, extended to Zielarz's prior roles because Nordvent itself is only seven years old.

Search run 4 September 2026, Dutch, Polish and English, plus Greek for the Cypriot layer. Five items:

Outcome: onboard with enhanced due diligence, annual review, and a documented watch on the chartering pattern. The adverse media file is four recorded items and one escalation, and the two entries that decide it are the 2017/2019 pair and the 2011 item that cannot be verified.

Link rot, and the delisted article. The 2011 item is the ordinary case, not the unlucky one. Zittrain, Albert and Lessig found in 2014 that more than 70% of URLs cited in the Harvard Law Review and other journals, and 50% of those in US Supreme Court opinions, no longer resolved to the material they were cited for. Legal citations are the careful end of the web. A regional newspaper archive from 2011 is not.

The consequence is procedural, not technical: snapshot at screening time and never re-fetch to reconstruct a past decision. A finding is stored with its text, its source URL, its publication date and its retrieval date, and the stored copy is what a reviewer or an auditor reads afterwards. Re-fetching produces a different file — sometimes emptier, sometimes changed — and quietly rewrites what you knew on the day. This is why our own Adverse Media Check puts a cited source behind each finding and stores the result as a point-in-time snapshot rather than recomputing it later.

Re-running a search is a different act from re-fetching a source. Re-run to find what is new. Re-fetch nothing.

Allegations that were later dismissed. The 2017/2019 pair is the hardest entry in the file, and the temptation runs both ways. Deleting the 2017 item because the investigation closed is wrong: the EBA Guidelines say plainly that the absence of criminal convictions alone may not be sufficient to dismiss allegations of wrongdoing. Leaving the 2017 item to stand alone is also wrong, and from 10 July 2027 it will be unlawful as well: Article 76(3)(b) AMLR requires procedures that distinguish allegations from investigations, proceedings and convictions, with the presumption of innocence in view.

The working rule is: record the state of the matter, not the headline. One record, four fields — what was alleged, what stage it reached, what the outcome was, and the dated source for each. And search deliberately for the outcome, because the follow-up is usually shorter, later and less indexed than the accusation. The 2019 piece in this file is four paragraphs; the 2017 piece was the lead item.

Erasure requests against retention duties. Suppose Zielarz asks, in 2027, for the 2017 material to be erased. Article 17(1) GDPR gives him the right in principle; Article 17(3) removes it where processing is necessary for compliance with a legal obligation under Union or Member State law, or for the establishment, exercise or defence of legal claims. AML record-keeping is such an obligation, so the answer during the relationship is no.

The answer is not "no, forever". Article 77(3) AMLR sets the retention period at five years from the end of the relationship and then says obliged entities shall delete the personal data on expiry, unless a competent authority has required a further period. That period may not exceed five more years and must be justified case by case. So the correct response to an erasure request has three parts: the ground on which you are refusing now, the date on which the obligation ends, and a deletion process that actually runs on that date. A firm that cannot state the second and third is not relying on Article 17(3); it is keeping data because deleting it is inconvenient.

For each finding, six fields, and all six are load-bearing:

1. The finding, in your own words.
2. The source: publisher, title, URL, publication date.
3. The retrieval date, and the stored copy.
4. The stage: allegation, investigation, proceeding, conviction, or outcome.
5. The disposition and who made it.
6. The date the retention obligation for this record ends.

For the search itself, four more: the window applied, the languages and scripts used, the sources that were not reachable, and the reason for the window. A lookback you cannot explain is not a control; it is a setting.