The BSA's recordkeeping requirements are extensive and specific. Here's exactly what records you must maintain, for how long, and what happens when records are missing during an examination.
Most BSA records must be retained for five years from the date of the transaction or record creation
The BSA's recordkeeping requirements are among the most specific and extensive in financial regulation. The regulations specify not just what records must be kept, but how long they must be retained, in what format, and how quickly they must be produced upon request. Recordkeeping failures are among the most common BSA examination findings, and they range from minor technical deficiencies to substantive failures that suggest a program that isn't being actively managed.
Customer identification records must be retained for five years after the account is closed
The five-year retention requirement applies to most BSA records: CTR filings, SAR filings, customer identification records, beneficial ownership records, and records of transactions that triggered monitoring reviews. The five-year clock runs from the date of the transaction or the date the record was created, not from the date of the most recent examination. Records that are more than five years old can generally be destroyed, but records within the five-year window must be retained and available for production.
SAR records must be retained for five years from filing - and SAR existence must be kept confidential
Customer identification records must be retained for five years after the account is closed or the relationship ends. This means that CIP records for customers who closed their accounts in 2018 must still be retained until 2023. For businesses with high customer turnover, maintaining a systematic record retention process is essential - records that are destroyed prematurely create examination findings even if the underlying compliance was adequate.
Records must be maintained in accessible formats - obsolete or damaged records are effectively missing
SAR records require special handling. The SAR itself must be retained for five years from the date of filing. But the underlying documentation that supported the SAR decision - the transaction records, the customer information, the internal review notes - must also be retained. And critically, the existence of a SAR filing must be kept confidential. Disclosing to a customer that a SAR has been filed about them is a federal crime.
Premature destruction of records within the five-year window creates examination findings
The format of retained records matters. Records must be maintained in a format that allows them to be produced quickly and completely upon examiner request. Records stored in formats that are no longer readable - obsolete software, damaged physical media - are effectively missing records from a compliance perspective. Your record retention system must include a process for ensuring that records remain accessible throughout the retention period.
Tags
BSA/AML Principal Consultant · Soflo Consulting
Elena Vargas is a BSA/AML Principal Consultant at Soflo Consulting with over a decade of experience building and auditing compliance programs for regulated businesses across the United States. She specializes in enforcement action remediation, risk assessment development, and examination preparation for money services businesses, mortgage lenders, and fintech companies.
5 sections
Key Takeaways
- 1Most BSA records must be retained for five years from the date of the transaction or record creation
- 2Customer identification records must be retained for five years after the account is closed
- 3SAR records must be retained for five years from filing - and SAR existence must be kept confidential
- 4Records must be maintained in accessible formats - obsolete or damaged records are effectively missing
- 5Premature destruction of records within the five-year window creates examination findings
Need Expert Guidance?
Put these insights into action. Schedule a free consultation with a Soflo Consulting compliance specialist.
Stay Ahead of Compliance
Get FinCEN updates, BSA/AML guidance, and federal compliance news delivered to your inbox - no fluff.
