Most banks require a business to keep the paper check for 14 to 60 days after a remote deposit, with the exact number set by your Remote Deposit Capture agreement. That window covers the bank’s needs only. The IRS expects you to preserve records supporting your return for at least three years, and a legible digital image satisfies that longer requirement if your storage system meets federal standards. So the practical answer to how long to keep checks after remote deposit has two parts: hold the paper for the window in your deposit agreement, then destroy it — but keep the digital image for years.
The Bank’s Window Comes From Your Deposit Agreement
No federal law fixes a specific number of days. The Check 21 Act made a properly created digital image the legal equivalent of the paper check, but it added no retention requirement for the original.1Federal Reserve Board. Frequently Asked Questions About Check 21
The window instead comes from the RDC contract you signed with your bank. Those agreements typically require you to keep the original for 14 to 60 days after deposit confirmation. Some banks sit at the short end, others want the full two months, and the number can vary by account type at the same institution. Banking regulators expect these contracts to spell out how long customers store deposited items and how they eventually destroy them.2FDIC. Risk Management of Remote Deposit Capture Read your deposit account disclosures for the specific number that applies to you.
Endorse the Check the Moment You Scan It
Before the paper goes anywhere, write a restrictive endorsement on the back: something like “For Mobile Deposit Only at [Bank Name]” with your account number. That marking flags the check as already processed and is the single best protection against duplicate presentment, which federal banking regulators have identified as one of the biggest fraud and operational risks in remote deposit capture. Regulators recommend endorsing, franking, or otherwise marking deposited items to reduce double-processing.3Office of the Comptroller of the Currency. Risk Management of Remote Deposit Capture
If a duplicate ever traces back to your account, your RDC agreement is what the bank will use to collect from you. A restrictive endorsement takes seconds and prevents the entire dispute.
Secure Storage During the Holding Period
While the retention window runs, every scanned check needs to be locked down. These papers carry routing numbers, account numbers, and signatures. A locked filing cabinet or a small safe is the minimum, and access should be limited to employees with financial responsibilities. Federal banking guidance requires institutions to make sure their RDC customers protect deposited items from receipt through destruction.4Federal Financial Institutions Examination Council. Risk Management of Remote Deposit Capture Activities Your bank may audit these controls, and sloppy storage can be grounds for terminating your remote deposit privileges.
The IRS Timeline Runs Much Longer
This is where businesses get tripped up. The bank might only need the paper for 30 or 45 days, but the IRS expects records that support income, deductions, and credits to be kept until the statute of limitations expires. For most businesses, that’s at least three years after filing.5Internal Revenue Service. How Long Should I Keep Records It stretches to six years if you underreport gross income by more than 25%, and to seven years if you claim a bad debt deduction.6Office of the Law Revision Counsel. 26 USC 6501 Limitations on Assessment and Collection If you never file a return, or file a fraudulent one, there’s no time limit at all.
You don’t need the paper for this. The IRS accepts digital images as substitutes for originals when your electronic storage system meets Revenue Procedure 97-22: the scan must be legible, the system must prevent unauthorized alteration or deletion, and you must be able to produce a clear printed copy on demand during an audit.7Internal Revenue Service. Revenue Procedure 97-22 – Requirements for Electronic Storage Systems The images also need to be indexed and cross-referenced to your books to create an audit trail from ledger to source document.
Practically, your remote deposit software should save high-resolution images of every check, front and back, and those images need to remain accessible for years. Confirm the system meets these standards before you destroy any paper. If your scans are blurry or your storage has no backup, an audit could find you unable to support a deduction with no paper original to fall back on.
Destroying Paper Checks Once the Bank Window Closes
Once your deposit agreement’s retention period passes and the digital images are safely stored, destroy the paper right away. Don’t let it accumulate. Every extra day a check sits around gives someone another chance to lift an account number, forge a signature, or attempt a duplicate deposit.
The FACTA Disposal Rule requires any business that handles consumer information to take reasonable steps to prevent unauthorized access during disposal. The standard is that the information cannot be readable or reconstructable after disposal.8eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records The FTC lists burning, pulverizing, or shredding as examples that meet the bar.9Federal Trade Commission. FACTA Disposal Rule Goes Into Effect June 1
Cross-cut shredders are the standard. They reduce paper to small pieces that can’t realistically be reassembled. Strip-cut shredders leave long ribbons with readable account and routing numbers, which doesn’t meet the standard. For higher volumes, a professional mobile shredding service can handle the job on-site and provide a certificate of destruction. Keep the certificates; they document that you followed proper disposal practices if anyone ever questions your process.
A Bounced Check Changes the Timeline
Do not destroy a returned check on the normal schedule. If a deposited check comes back for insufficient funds or is flagged for any other reason, the paper becomes potential evidence. A dishonored check may need to be re-presented to the paying bank, used in a collection effort, or introduced in a small claims case. The Uniform Commercial Code, adopted in some form in every state, governs how dishonored checks are handled during collection.10Cornell Law School Legal Information Institute. Uniform Commercial Code 3-502 – Dishonor Holding the original gives you stronger footing than relying on the image alone if the payer disputes the transaction.
Move any returned check to a separate, secure file and keep it there until the matter is fully resolved. That might be weeks if the payer makes good quickly, or months if you end up in court. Destroy the check only after you’ve recovered the funds or exhausted collection options.
What Noncompliance Costs You
Your RDC agreement almost certainly includes an indemnification clause that puts your business on the hook for losses from premature destruction, unauthorized access, or duplicate presentment. Federal banking regulators direct institutions to include the consequences of noncompliance and the authority to terminate the RDC relationship in their customer contracts.2FDIC. Risk Management of Remote Deposit Capture
If your bank audits your process and finds checks destroyed too early, stored insecurely, or missing when an original is needed for a dispute, the typical response starts with a warning and can move to suspension or termination of your remote deposit privileges.4Federal Financial Institutions Examination Council. Risk Management of Remote Deposit Capture Activities For businesses processing dozens of checks a week, going back to physical bank visits is a real operational hit.
Improper disposal of consumer financial information can also trigger FACTA enforcement. The FTC has authority over businesses that fail to take reasonable disposal measures, and violations can result in federal enforcement actions or state attorney general proceedings.