How Long Must Lenders Retain Credit Application Records?

Lenders must retain credit application records for at least 25 months for consumer credit and at least 12 months for business credit, measured from the date the applicant is notified of the action taken or told the application is incomplete.¹ Those are the floors set by Regulation B under the Equal Credit Opportunity Act. Other federal laws stack additional obligations on top, and the practical retention window most compliance officers use is longer than either minimum.

Consumer Credit Applications: 25 Months

After notifying a consumer applicant of the action taken on an application, or notifying them the application is incomplete, the lender must keep the records for 25 months. The clock starts on the notification date. Not the date the application came in, and not the date of the internal decision.

The same 25-month period applies when a lender takes adverse action on an existing account, such as reducing a credit limit or closing a line of credit. In that scenario, the lender must retain any written or recorded information about the adverse action and any written complaint from the account holder alleging a violation of ECOA or Regulation B.²

Business Credit Applications: 12 Months, With an Exception

Business credit applications carry a shorter default of 12 months from the notification date.¹

A shorter 60-day period applies when the business applicant had gross revenues exceeding $1 million in its previous fiscal year, or when the credit involves trade credit, factoring, or similar arrangements. Two triggers pull the retention period back up to the full 12 months: the applicant asks for the reasons behind an adverse decision, or the applicant asks the lender to keep the records. Either request has to arrive within the 60-day window.² Smaller businesses at or below $1 million in revenue get the full 12 months automatically, no request required.

Which Records Are Covered

Regulation B applies the retention duty to several categories of documents. The list is the same for consumer and business credit; only the length differs.

The application itself and any written or recorded information used to evaluate it, unless the document was returned to the applicant at their request.¹
Copies of the notification of action taken (approval, denial, or counteroffer) and any statement of specific reasons for adverse action.
Any written statement from an applicant alleging a violation of ECOA or Regulation B.
The text of any prescreened credit offer, the criteria used to select recipients, and any related complaint correspondence. Retention runs 25 months from the offer for consumer credit, 12 months for business credit.²
All written or recorded information about any self-test the lender ran to evaluate its own fair lending compliance, retained for 25 months after the test is completed.

When the Clock Stops

The standard timelines pause once the lender learns of an investigation or lawsuit. If the lender has actual notice that the Attorney General, the CFPB, or another enforcement agency is investigating an alleged ECOA or Regulation B violation, the lender must keep all relevant records until the matter reaches final disposition. The same rule applies once the lender has been served with notice of a private lawsuit.² A court or agency can authorize earlier destruction by order. Otherwise, the records stay.

The hold covers every record category, including self-test documentation and prescreened solicitation files. A lender that receives any regulatory inquiry, even one that looks routine, should treat it as a trigger for a litigation hold on all credit application records.

Longer Periods Under Other Federal Laws

Regulation B is only the starting point. Lenders that handle multiple credit products need to track each overlapping requirement separately.

Truth in Lending Act and Regulation Z

For general TILA compliance evidence, lenders keep records for two years after the date disclosures are required or action is taken.³ Mortgage records run longer. Integrated mortgage disclosures must be kept for three years after the later of consummation, the required disclosure date, or the required action date. Closing Disclosures and all related documents run five years after consummation. Loan originator compensation records run three years after each payment, covering both what the creditor paid and what any loan originator organization received or distributed.

Home Mortgage Disclosure Act and Regulation C

Lenders covered by HMDA must keep a copy of their annual loan/application register for at least three years after submission.⁴

Bank Secrecy Act

The Bank Secrecy Act requires financial institutions to retain records mandated under its regulations for five years.⁵ That covers records of credit extensions exceeding $10,000 other than those secured by real property, including the borrower’s name and address, the amount, the purpose, and the date. Records must be stored for reasonable-time retrieval. Any credit record that falls under both BSA and Regulation B effectively lives on the five-year timeline.

Why the Regulatory Minimum Is Usually Too Short

Under ECOA, a private applicant can file a discrimination lawsuit up to five years after the alleged violation.⁶ A lender that destroys its files at 25 months and then gets sued in year three has nothing left to defend with. Many compliance programs therefore use five years as the practical floor, even though Regulation B does not require it.

The exposure is more than statutory damages. A successful ECOA claim can produce actual damages, punitive damages of up to $10,000 in an individual case, and larger awards in class actions.⁶ Missing records make the underlying claim harder to rebut. Courts and regulators can draw negative inferences from a lender’s inability to produce basic application files, and examinations that surface recordkeeping gaps can result in consent orders and monitoring obligations that outlast any fine.

Electronic Storage Is Allowed

Regulation B does not require paper. Records can be stored as photocopies, microfilm, or digital files produced by any accurate retrieval system, including computer-stored documents.⁷ A lender using a computerized system does not need to keep a paper copy of a document like an adverse action notice, provided it can regenerate the relevant information in a timely manner for an examination.

Lenders that make credit decisions mechanically from data entered into an automated system can satisfy retention by keeping the entered data alone, without storing the original paper application. Demographic data collected for monitoring purposes, such as race, ethnicity, and sex, must still be entered and retained regardless of how the credit decision was made.⁷

Disposing of Records Once the Period Ends

Old files cannot simply go into the recycling bin. Credit applications contain consumer report information, and federal law requires businesses that hold such information to dispose of it using reasonable measures against unauthorized access. The FTC’s Disposal Rule under the Fair and Accurate Credit Transactions Act governs the process.⁸

For paper, reasonable disposal means burning, pulverizing, or shredding documents so the information cannot practicably be read or reconstructed. For electronic records, the data must be destroyed or erased so it is equally unrecoverable.⁹ Deleting a file or reformatting a drive is generally not enough, because forensic tools can recover the data. A lender that outsources disposal to a third-party vendor remains responsible for confirming the vendor meets these standards.

1
eCFR. 12 CFR 1002.12 – Record Retention
2
eCFR. 12 CFR 1002.12 – Record Retention
3
eCFR. 12 CFR 1026.25 – Record Retention
4
eCFR. 12 CFR 1003.5 – Disclosure and Reporting
5
eCFR. 31 CFR 1010.430 – Retention of Records
6
Office of the Law Revision Counsel. 15 USC 1691e – Civil Liability
7
Consumer Financial Protection Bureau. Regulation B: Record Retention
8
Federal Trade Commission. Disposal of Consumer Report Information and Records
9
eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information