A record retention manual for a financial institution is the internal rulebook that tells each department which records to keep, how long to keep them, how to store them securely, and when to destroy them. It exists because federal law imposes different timelines on different record types, and a single blanket policy will either destroy records too early or hoard them past the point of legal and practical usefulness. A workable manual maps each category of record to the statute or regulation that governs it, assigns a departmental owner, defines when the retention clock starts, and builds in procedures for litigation holds and secure destruction.
The stakes are concrete. The Bank Secrecy Act authorizes civil penalties up to $100,000 per willful violation, and the SEC has collected more than $2 billion in fines since 2021 for recordkeeping failures tied to off-channel communications.1Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
Retention Timelines by Record Category
The core of the manual is a schedule pairing each record type with its governing timeline. The federal requirements do not line up neatly, so the schedule has to respect the differences rather than average them.
BSA Filings: CTRs and SARs
Currency Transaction Reports and Suspicious Activity Reports must be retained for at least five years.2FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements The FFIEC uses “at least” deliberately: institutions should not treat five years as a hard expiration date when related investigations or legal proceedings are pending. SARs come with an extra restriction. The institution cannot disclose to any person involved in the transaction that a report was filed, so SAR-related records need especially tight access controls even inside the institution.3Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
The broader BSA baseline at 31 CFR 1010.430 sets a five-year retention period for all BSA-required records and requires that they be stored so they remain accessible within a reasonable time.4eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period
Customer Identification Program Records
CIP records run on two separate clocks. The identifying information collected at account opening — name, date of birth, address, and taxpayer identification number (or passport number for non-U.S. persons) — must be retained for five years after the account is closed. Records of the documents used to verify that identity, along with the methods and results of verification procedures, must be kept for five years after the record is made.5eCFR. 31 CFR 1020.220 – Customer Identification Programs for Banks The distinction matters. An account open for 20 years generates a 25-year total hold on identifying information, while the underlying verification documents could be destroyed much earlier.
Credit Applications and Fair Lending Records
Regulation B requires lenders to retain credit applications and all related evaluation records for 25 months after notifying an applicant of the decision. For business credit, the period is 12 months.6eCFR. 12 CFR 1002.12 – Record Retention Regulators use these files to detect discriminatory lending patterns, and an institution that cannot produce them during a fair lending exam has a serious problem.
Mortgage and Consumer Credit Disclosures
Regulation Z sets three tiers that a single retention line item cannot capture:
- Two years for general consumer credit disclosures, including credit card agreements, home equity line disclosures, and periodic statements.
- Three years for mortgage loan estimates and related documentation, measured from the later of consummation, the disclosure date, or the date an action was required.
- Five years for closing disclosures and supporting documents on residential mortgage loans, measured from consummation.7eCFR. 12 CFR 1026.25 – Record Retention
If the institution sells or transfers the loan and no longer services it, the closing disclosures must be passed to the new owner or servicer, who inherits the remainder of the five-year obligation. Because Regulation B’s 25-month requirement overlaps these timelines, the schedule should flag that fair lending records may need to be held after the Regulation Z clock has run on related disclosures.
Tax Documentation
The IRS baseline is three years from the filing date or two years from the payment date, whichever is later. Several exceptions matter for a financial institution:
- Six years if unreported income exceeds 25 percent of the gross income shown on the return.
- Seven years for claims based on worthless securities or bad debt.
- Four years for employment tax records, measured from when the tax becomes due or is paid.
- Indefinite retention if no return was filed or if a return was fraudulent.8Internal Revenue Service. How Long Should I Keep Records
The IRS itself warns that records should not be discarded solely because the tax retention period has expired. For an institution juggling BSA, ECOA, and TILA timelines simultaneously, tax records should generally be mapped to the longest applicable retention period across all governing regulations.
Permanent Records
Some foundational documents should never be destroyed. Articles of incorporation, bylaws, and board meeting minutes provide the legal history of the institution’s existence, governance, and strategic decisions. No single federal statute mandates permanent retention across the board, but these records are indispensable during regulatory exams, mergers, litigation over fiduciary duties, and charter challenges. Most bank and credit union schedules classify them as permanent by policy, and examiners expect them to be available regardless of age.
The Federal Laws Behind the Timelines
Each line in the schedule should cite the statute or regulation that sets it. That citation is what defends the retention decision during an audit and speeds up annual review when the compliance team needs to check whether a rule has been amended.
Bank Secrecy Act
The BSA declares its purpose as requiring records that are “highly useful” in criminal, tax, and regulatory investigations, and in counterterrorism intelligence.9Office of the Law Revision Counsel. 31 USC 5311 – Declaration of Purpose A single negligent violation can draw a fine of up to $500, and a pattern of negligent violations pushes the ceiling to $50,000. Willful violations carry penalties up to the greater of the transaction amount (capped at $100,000) or $25,000. Violations tied to suspicious activity reporting or special measures under 31 USC 5318 can reach twice the transaction amount, up to $1,000,000.1Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
Gramm-Leach-Bliley Act
The GLBA, codified at 15 U.S.C. §§ 6801–6809, requires financial institutions to protect the security and confidentiality of customers’ nonpublic personal information. The statute frames this as an “affirmative and continuing obligation,” which does not end when a record reaches its retention deadline.10Office of the Law Revision Counsel. 15 USC 6801-6802 – Disclosure of Nonpublic Personal Information Any record containing Social Security numbers, income data, or account details needs enhanced security controls from creation through destruction.
Equal Credit Opportunity Act
Beyond regulatory fines, the ECOA’s civil liability provision lets individual applicants recover punitive damages up to $10,000 on top of actual damages. Class action recovery is capped at the lesser of $500,000 or one percent of the creditor’s net worth.11Office of the Law Revision Counsel. 15 USC 1691e – Civil Liability
Electronic Records, WORM, and Off-Channel Communications
The federal E-SIGN Act treats electronic records as satisfying any legal retention requirement provided the record accurately reflects the original and remains accessible to everyone legally entitled to see it for the entire retention period.12Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity Accessibility is where institutions fail. A PDF sitting in a format that current software cannot open fails the test even though the file still exists. The manual should identify the hardware and software needed to read each type of electronic record and set a process for migrating records when technology changes. Audit trails linking electronic signatures to signer identity should be preserved for the full retention period alongside the signed records.
For broker-dealers, SEC Rule 17a-4 is more prescriptive. Electronic records must be maintained either in a non-rewriteable, non-erasable format (WORM — write once, read many) or on a system that maintains a complete time-stamped audit trail of all modifications and deletions. The SEC amended Rule 17a-4 in 2022 to permit the audit-trail alternative, with compliance required as of May 2023.13Federal Register. Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants
FINRA Rule 4511 requires broker-dealers to preserve books and records consistent with Exchange Act Rule 17a-4, and it sets a six-year default for any record without a specifically designated retention period.14FINRA. FINRA Rule 4511 – General Requirements Business-related emails, instant messages, and texts fall squarely within this. Firms must store “legible, true, accurate and complete copies” and protect record integrity from creation through the end of the retention period.15FINRA. Books and Records
The SEC has charged more than 100 firms since 2021 for failing to capture business-related communications sent through personal text messages, WhatsApp, Signal, and similar platforms, with individual firm penalties ranging from under $50,000 to $50 million. Any institution with securities or investment activities needs a manual section spelling out how off-channel messages are captured, archived, and made searchable. Self-reporting by employees has proven insufficient, and the enforcement wave makes that clear.
What the Manual Itself Has to Contain
Record Ownership by Department
Every record type needs a designated owner responsible for creation, storage, and destruction. Lending owns credit applications and loan files. Operations owns CTRs and wire transfer records. Human resources owns employment tax documents. Without assigned ownership, records fall into gaps between departments, and those gaps surface at the worst possible time — during a regulatory exam or in discovery.
Data Classification
Records should be classified by sensitivity, not just retention period. Files containing nonpublic personal information such as Social Security numbers, account balances, and income data require encryption, restricted access, and the enhanced security controls mandated by the GLBA.10Office of the Law Revision Counsel. 15 USC 6801-6802 – Disclosure of Nonpublic Personal Information Marketing materials and press releases carry no special handling. A general ledger extract and a SAR filing may have similar retention periods but very different security needs, and the classification drives the storage environment.
Trigger Events
Defining when the clock starts is one of the trickiest parts of building the schedule. Some records run from a specific transaction date. Others start counting only after an account is closed or a loan is paid off. CIP records show the complexity: identifying information runs for five years after account closure, while verification documents run for five years after the record is created.5eCFR. 31 CFR 1020.220 – Customer Identification Programs for Banks Documenting trigger events precisely is what prevents premature destruction of records that are still legally required.
Legal Citation Mapping
Every line item should include the specific statute or regulation that governs it. This is not busywork. It is the answer when an examiner asks why records were destroyed after five years rather than seven, and it makes annual reviews faster because compliance can check whether the cited regulation has been amended without re-researching each category from scratch.
Storage and Secure Destruction
Paper records stored off-site typically go to climate-controlled facilities with biometric access controls. Digital records should sit in encrypted systems with redundant backups. Where offshore backups are used, the manual should require review of the foreign provider’s security controls.
When a record reaches the end of its retention period and no litigation hold or ongoing investigation applies, destruction follows a documented process. Physical documents are typically shredded on-site by a bonded vendor. Digital records require overwriting or cryptographic erasure; simple deletion is not enough because the data can be recovered.
Every destruction event should generate a formal certificate recording the date, the method, and an inventory of what was destroyed. Compliance officers update the records management system to reflect the disposition. These certificates create the audit trail proving the institution followed its own policies and did not selectively destroy records. Consistent, scheduled destruction with documentation is far less likely to raise suspicion than ad hoc purging with no paper trail.
Litigation Holds
Every retention schedule becomes temporarily irrelevant the moment the institution reasonably anticipates litigation. At that point, routine destruction must stop and a litigation hold must be issued covering all records potentially relevant to the dispute. The obligation is not optional, and it does not wait for a lawsuit to be filed. Reasonable anticipation is the trigger.
Under Federal Rule of Civil Procedure 37(e), if electronically stored information that should have been preserved is lost, a court can order measures to cure the prejudice, including barring the institution from supporting its own claims or introducing favorable evidence. If the court finds the destruction was intentional, sanctions escalate to presuming the lost information was unfavorable, issuing adverse inference instructions to the jury, or entering a default judgment against the institution.
The manual should include a litigation hold procedure specifying who has authority to issue a hold, how custodians are notified, how compliance is monitored, and how the hold is released when the matter concludes. This is where most recordkeeping failures turn catastrophic. The retention schedule is usually not the problem. Failure to pause it when a lawsuit arrives is.
Keeping the Manual Current
A retention manual is only useful if it reflects current law. Regulations change, new enforcement priorities emerge (off-channel communications being a recent example), and internal systems evolve. Compliance should formally review the manual at least annually and undertake a comprehensive revision every four to five years. Between full revisions, amendments should be made whenever a governing regulation is updated or the institution adopts new technology that affects how records are created or stored.
Internal audits should verify that departments are actually following the schedules. Spot checks — pulling a sample of records from each category and confirming they exist, are accessible, and match the prescribed timeline — catch problems before examiners do. A current manual, a documented audit history, and destruction certificates that match the schedule together demonstrate the kind of institutional discipline that shortens a regulatory exam rather than extending it.