Compliance Blog

Written by Brandy Bruyere, Director of Regulatory Compliance

It has been a while since we blogged about a frequently asked question how long do certain records need to be retained? As with most things involving the law, the answer is it depends.

First, for federally-insured credit unions, Part 749 of NCUA's regulations contains guidance that is not terribly prescriptive. In fact, Appendix A to Part 749 notes the importance of state law in determining how long to keep particular records:

1. What Are the Recommended Minimum Retention Times?

Record destruction may impact the credit union's legal standing to collect on loans or defend itself in court. Since each state can impose its own rules, it is prudent for a credit union to consider consulting with local counsel when setting minimum retention periods. A record pertaining to a member's account that is not considered a vital record may be destroyed once it is verified by the supervisory committee. Individual Share and Loan Ledgers should be retained permanently. Records, for a particular period, should not be destroyed until both a comprehensive annual audit by the supervisory committee and a supervisory examination by the NCUA have been made for that period. (Emphasis added.)

For example, states set statutes of limitations that determine how long a person has to bring a civil suit against another party. These time periods vary by state, and even vary by type of claim/lawsuit so this is one way a state may impose its own rules that impacts a credit union's recordkeeping. Power of attorney recordkeeping requirements are another example.

That being said, the NCUA guidance also notes that certain records should be retained permanently, including:

• The FCU's charter, bylaws and amendments to these documents
• Minutes of membership meetings and meetings of the board, credit committee and supervisory committee
• Copies of the FCU's call report (NCUA Form 5300 or 5310) and the Credit Union Profile Report (NCUA Form 4501) or its equivalent
• One copy of each supervisory committee annual audit report and attachments
• Supervisory committee records of account verification
• Journal and cash record
• General ledger
• Copies of periodic statements or the individual share and loan ledger (meaning, a complete record of the account should be kept permanently)
• Bank reconcilements
• Listing of records destroyed

Part 749 also addresses vital records preservation and can be helpful when reviewing recordkeeping policies and procedures.

From a federal regulatory perspective, specific rules often have their own record retention provisions. Here are some examples:

Regulation Z addresses record retention in section 1026.25. The rule contains a general 2 year record retention requirement, with some longer retention periods for other specific documents. For example, there is a three year record retention requirement for information relating to loan originator compensation and the ability to repay/qualified mortgage rule. For loans subject to TRID, credit unions must retain evidence of compliance for three years, but all Closing Disclosures, including revised Closing Disclosures, must be retained for five years post-consummation.

Regulation B has a particular records retention rule found in 1002.12 and a requirement to keep in the application file a copy of any written notice that was required to be mailed under the regulation. There are more specific requirements relating to business credit, keeping records longer if the credit union knows it is under investigation by a regulator or state's attorney general, and requires credit unions to keep records relating to prescreened offers of credit for 25 months so it may be worth reviewing in full. The rule's commentary discusses keeping computerized records of notice.

Bank Secrecy Act. The BSA/AML examination manual contains an appendix on record retention requirements. Some records must be kept for 5 years, such as purchases of monetary instruments or funds transfers of $3,000 or more (although there are some exceptions here). Records under the credit union's customer identification program (CIP) must be retained for five years after the account is closed.  Other BSA provisions are not subject to a specific record retention timeframe. However, to ease compliance, many credit unions keep all BSA-related records for 5 years rather than having to sort out which items are specifically required to be kept for 5 years and which are not.

Other federal rules. Here are a few other federal regulations with specific recordkeeping provisions:

• Regulation E, section 1005.13(b) (generally, two years from the time of providing disclosures)
• Truth in Savings, section 707.9(c) (generally, two years from the time of providing disclosures)
• Regulation X contains a few recordkeeping requirements. One example relates to mortgage servicing under RESPA, located at section 1024.38(c) (generally, until one year after the date a mortgage is discharged or servicing is transferred to another servicer). Other provisions have a five year retention period.
• Regulation C, section 1003.5(d) (modified register must be available to the public for 3 years, and the disclosure statement for 5 years
• Regulation CC, funds availability, section 229.21(g) (generally, at least two years)
• Fair Credit Reporting Act/Regulation V  Section 615(d)(3) requires credit unions to retain records relating to prescreened offers of credit for three years. Additionally, Appendix E of Regulation V contains guidelines on the accuracy and integrity of data reported to consumer reporting agencies (Maintaining records for a reasonable period of time, not less than any applicable recordkeeping requirement, in order to substantiate the accuracy of any information about consumers it furnishes that is subject to a direct dispute)
• Flood insurance (record of receipt of the notice of special flood hazards and availability of flood insurance must be kept for as long as the credit union owns the loan)
• IRS Form 1099 (generally 3 years from the reporting due date, but four years for federal withholding information and filings under Form 1099-C for cancellation of debts, see p. 13 of this guide). The IRS generally requires that employment tax records are kept for four years.

Final thoughts. Again, this is not an exhaustive list, and besides federal regulatory requirements, there can be many good reasons to keep records for longer. Records can be key to success in litigation should the credit union be involved in a legal action such as enforcing a debt or defending against a civil suit. Records can also help demonstrate the credit union's typical practices or how a credit union generally addresses an issue. Records often contain institutional knowledge, helping explain past decisions or provide context to existing policies and procedures. This does not mean everything needs to be retained forever though record retention is a balance and outside specific regulatory requirements, this process often involves some decision making as well.