How Long to Keep Payroll Records: IRS, FLSA, and State Rules

Keep payroll records for at least four years after the related employment tax is due or paid, whichever comes later. That is the IRS floor, and for most quarterly returns, W-2s, deposit confirmations, and withholding forms it is the number to plan around. But payroll files touch several federal agencies at once, and whenever two rules apply to the same document, the longer one controls. Depending on what sits in the folder, the real retention period for a given record can be three years, four, six, or forever.

The IRS Four-Year Baseline

The IRS tells employers to keep all employment tax records for at least four years after the date the tax becomes due or is paid, whichever is later.1Internal Revenue Service. How Long Should I Keep Records The authority behind that instruction is Internal Revenue Code Section 6001, which requires every person liable for tax to maintain the records the IRS prescribes.2Office of the Law Revision Counsel. 26 U.S. Code 6001 – Notice or Regulations Requiring Records, Statements, and Special Returns

The four-year rule covers the full range of employment tax documents:

  • Quarterly and annual returns, including Form 941 and Form 940
  • Copies of all W-2s issued to employees and the corresponding W-3 transmittal
  • Deposit records, including EFTPS dates, amounts, and acknowledgment numbers3Internal Revenue Service. Employment Tax Recordkeeping
  • Supporting data used to determine employment tax liability: pay rates, hours worked, tip allocations, and taxable fringe benefit calculations

Each Form W-4 belongs in the same category. The IRS requires every W-4 to be kept at least four years.4Internal Revenue Service. Topic No. 753, Form W-4, Employees Withholding Certificate When an employee submits a replacement, keep both the old and new versions until four years have passed for every return the old form affected. Tossing a superseded W-4 early leaves you unable to explain a mid-year change in withholding if the IRS asks.

The same four-year window applies to independent contractor paperwork. Keep the W-9 collected from each contractor, copies of Form 1099-NEC, and the supporting documentation behind each payment. If a contractor is later reclassified as an employee, the contract, invoices, and evidence of how the work was performed are what you have to defend the original classification.

When the Four-Year Clock Starts

The starting date matters, because getting it wrong by a quarter can mean destroying records before the retention period has actually run. The clock begins on the later of two dates: the due date of the return the records relate to, or the date the tax was actually paid.1Internal Revenue Service. How Long Should I Keep Records

A Form 941 for the first quarter of 2026, due April 30, 2026, generally means records can be destroyed after April 30, 2030. But if the tax was paid late, on June 15, 2026, the four-year period restarts from that payment date, pushing the retention deadline to June 15, 2030. Late payments quietly extend your recordkeeping obligations.

When Four Years Isn’t Enough

The four-year rule assumes a normal filing history. Three situations push past it.

If you never filed an employment tax return for a period, keep those records indefinitely. There is no statute of limitations where no return exists, so the IRS can assess the tax at any time.1Internal Revenue Service. How Long Should I Keep Records The same unlimited period applies to any return filed with the intent to evade tax.5Office of the Law Revision Counsel. 26 U.S. Code 6501 – Limitations on Assessment and Collection Records tied to either situation should be kept permanently.

The third situation is substantial underreporting. When a taxpayer omits more than 25% of gross income from a return, the IRS has six years instead of the normal assessment window to pursue the shortfall.5Office of the Law Revision Counsel. 26 U.S. Code 6501 – Limitations on Assessment and Collection If there is any chance of a significant understatement, six years is the safer floor.

Department of Labor Rules Under the FLSA

The Fair Labor Standards Act imposes its own timelines, and because wage and hour data usually lives in the same files as tax records, both rule sets apply to the same folder.

Basic payroll records must be preserved for at least three years from the last date of entry.6eCFR. 29 CFR 516.5 – Records to Be Preserved 3 Years That category includes employee names, addresses, occupations, sex, date of birth if under 19, pay rates, total wages paid each pay period, and payment dates.7eCFR. 29 CFR 552.110 It also covers collective bargaining agreements, employment contracts relied on for FLSA exemptions, and written agreements on overtime or tip calculations, with the three-year clock running from the last effective date rather than the last entry date. Records explaining pay differences between men and women doing the same work fall under the same three-year rule to support Equal Pay Act enforcement.8eCFR. 29 CFR 1620.32

A shorter two-year period applies to the working documents behind wage calculations: time cards, work schedules, wage rate tables, and records showing additions to or deductions from wages.9U.S. Department of Labor. Fact Sheet 21: Recordkeeping Requirements Under the Fair Labor Standards Act (FLSA) Two years passes quickly, and when an overtime complaint lands and the time cards are gone, DOL investigators tend to credit the employee’s version.

Wage garnishment records, including court-ordered child support and IRS tax levies, sit in the basic payroll category and follow the three-year FLSA rule.9U.S. Department of Labor. Fact Sheet 21: Recordkeeping Requirements Under the Fair Labor Standards Act (FLSA) When the garnishment stems from an IRS levy, the four-year employment tax rule applies to the tax-related portion.

Documents With Their Own Clocks

Several papers that sit in a typical employee file take their retention periods from neither the IRS nor the FLSA, and these often set the longest deadline in the folder.

Form I-9

The Form I-9 follows a dual-trigger rule: keep it for three years after the date of hire or one year after employment ends, whichever is later.10USCIS. 10.0 Retaining Form I-9 For an employee hired January 1, 2025, and terminated June 30, 2026, three years from hire is January 1, 2028, and one year from termination is July 1, 2027. The later date, January 1, 2028, controls. For short-tenured employees, the three-year-from-hire date almost always wins.

ERISA Benefit Plan Records

If you sponsor a retirement or welfare benefit plan, ERISA requires records supporting plan filings to be kept at least six years after the filing date. That covers Form 5500 filings, nondiscrimination test results, financial reports, employee communications, and fidelity bond documentation. Plan documents themselves, including adoption agreements, amendments, summary plan descriptions, and determination letters, must be maintained as long as they remain relevant to determining benefits that are or may become due to employees.11DOL.gov. Recordkeeping in the Electronic Age Carrier Written Statement This six-year window often becomes the controlling period for the entire benefits section of a file.

State Rules Can Require More

Federal rules set the floor, not the ceiling. Many states require payroll records to be kept for five or six years, exceeding both the IRS four-year and FLSA three-year periods. Those longer windows typically align with state statutes of limitations for wage claims.

State retention obligations generally cover state income tax withholding records, state unemployment insurance filings, and documentation for state-mandated leave programs like paid sick leave or family leave. A W-2 is a federal form, but if your state requires six years of wage records, the W-2 stays in the file for six years. Employers with workers in multiple states are usually better off picking the longest period that applies anywhere and using it across the board, rather than running parallel retention schedules.

What Happens If You Don’t Keep Them

There is no single IRS fine labeled “failure to keep records.” The pain comes indirectly. Without records, you can’t substantiate your filings, and the IRS treats that the same as not filing or paying correctly. The reconstruction the agency does on its own rarely favors the employer.

The downstream penalties include:

Willful failure to keep required records is a federal misdemeanor punishable by a fine of up to $25,000 ($100,000 for a corporation), up to one year in prison, or both.14Office of the Law Revision Counsel. 26 U.S. Code 7203 – Willful Failure to File Return, Supply Information, or Pay Tax Criminal prosecution for recordkeeping alone is rare, but the statute is on the books and the IRS uses it when the failures look deliberate.

On the DOL side, repeated or willful violations of minimum wage or overtime rules carry civil penalties of up to $2,515 per violation.15eCFR. Part 579 – Child Labor Violations – Civil Money Penalties When an employer can’t produce time records to disprove a wage claim, the investigation effectively begins with the assumption that the employee is right.

Storing and Destroying Records

Both the IRS and DOL accept electronic storage. The IRS set out the specifications in Revenue Procedure 97-22: the system must accurately transfer records to electronic media, index and retrieve them, prevent unauthorized changes or deletion, include a quality assurance program, and produce legible hard copies on demand.16IRS.gov. Revenue Procedure 97-22 The DOL’s standard is less prescriptive but requires that electronic records be available for inspection, copying, and transcription on request.17eCFR. 29 CFR 825.500 – Recordkeeping Requirements A PDF saved somewhere is not enough; the system has to be searchable, controlled, and open to inspection.

Once a record has passed every applicable retention deadline, it still can’t go in a recycling bin. Payroll files contain Social Security numbers, addresses, bank account details, and wage information. Federal rules require reasonable measures to protect against unauthorized access during disposal, which generally means shredding or pulverizing paper so it can’t be reconstructed and destroying or erasing electronic media so the data can’t be recovered. If you use a destruction vendor, check references, review their security policies, or require certification from a recognized trade association.18eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information

Before destroying anything, confirm that no litigation hold, pending audit, or open investigation requires continued preservation. A record past its regulatory deadline can still be discoverable in a lawsuit, and destroying it after a hold has been issued creates a bigger problem than keeping the file another year would have.