A closed mortgage file can carry three federal retention deadlines at once, and each one starts counting from a different date. Add state law and the bank’s own board policy, and the right disposal date for a single file depends on math most banks still do by hand. When that math slips, a bank either destroys a record an examiner later asks for or keeps one its own policy says should be gone.
This guide breaks down the bank record retention requirements FDIC-supervised banks track most often and how automation applies the right clock to each document the moment it enters the system.
READ MORE: How to Prepare for FDIC Exams (& 5 Reasons Document Management Makes It Easy)
How Long Do Banks Need to Keep Records?
No single federal schedule covers every bank record. Bank record retention requirements come from individual regulations, each with its own minimum period and trigger date. Federal minimums range from 25 months under Reg B to five years under the Bank Secrecy Act, and banks typically apply the longest period that touches a record.
Who Enforces Retention Requirements for Banks?
For FDIC-supervised banks with $10 billion or less in assets, FDIC examiners review compliance with every rule below, including the consumer regulations the CFPB writes. For banks with more than $10 billion in assets, the CFPB examines the consumer rules directly. The FDIC Consumer Compliance Examination Manual explains how those reviews work.
What Are the Federal Retention Periods for Banks?
| Rule | Records covered | Keep for | Clock starts |
|---|---|---|---|
| BSA/AML (31 CFR 1010.430) | Account, transaction, and filing records | 5 years | Varies by record, often the transaction date |
| CIP (31 CFR 1020.220) | Customer identifying information | 5 years | Date the account is closed |
| SAR rule (12 CFR 353.3) | SARs and supporting documentation | 5 years | Date of filing |
| Reg B (12 CFR 1002.12) | Consumer credit applications and notices | 25 months | Date of notice of action taken |
| Reg E (12 CFR 1005.13) | Electronic fund transfer and error resolution records | 2 years | Date disclosures or action were required |
| Reg Z (12 CFR 1026.25) | Evidence of truth in lending compliance | 2 years | Date disclosures or action were required |
| Reg Z, mortgage | Loan Estimates and ability-to-repay evidence | 3 years | Consummation |
| Reg Z, mortgage | Closing Disclosures | 5 years | Consummation |
Do State Law and Board Policy Change the Retention Period?
Yes. Federal rules set the floor, and many states add their own periods for certain bank records. A board-approved policy can extend any period further, and when more than one rule applies, the longest period governs, counted from its own trigger date. Check the current rule text, and confirm your final schedule with counsel.
Why Is Bank Record Retention So Hard to Track Manually?
Trigger dates are what make it hard. A single file can hold documents on several clocks, each counting from a different event, and every document type the bank holds adds its own set of dates.
How Do Different Trigger Dates Affect a Single File?
One closed mortgage file can carry three disposal dates under federal rules alone:
| Document | Rule | Keep for | Clock starts |
|---|---|---|---|
| Application and notice of action taken | Reg B | 25 months | Notice of action taken |
| Loan Estimate and ability-to-repay evidence | Reg Z | 3 years | Consummation |
| Closing Disclosure | Reg Z | 5 years | Consummation |
What Happens When a Retention Date Is Missed?
Mistakes cut both ways. A record purged early can’t be produced when an examiner asks for it. A record held past its window means the bank’s practice no longer matches its board-approved policy, and examiners compare the two directly.
Most community banks still track these dates with spreadsheets and calendar reminders. That works until a trigger date gets entered wrong or never gets entered at all.
How Does Automated Document Retention Work?
Automated retention moves the schedule out of spreadsheets and into the document management system. Each bank record retention requirement above attaches to a document type and its trigger date, and the system tracks every clock from there.
What Does a Document Management System Automate?
A document management system covers the full retention cycle, from setting the rules to proving the bank followed them.
| Retention step | What gets automated |
|---|---|
| Set the rules | Your compliance team configures retention rules for each document category |
| Apply the schedule | The correct clock attaches by document type as each document enters the repository |
| Dispose on time | Disposal follows the schedule, with a record of what happened and when |
| Report | Compliance reports show how closely the bank follows its retention policy |
How Does Core Integration Affect Retention?
Core integration lets retention start the day a document is captured. Identifi connects to major core systems, including Jack Henry, Fiserv, FIS, Corelation, and COCC. It pulls customer and account data to index each document as it comes in, so the file lands in the right place with its retention rules attached from the start.
What Do Examiners See When Retention Is Automated?
Examiners can receive read-only access to organized folders with complete audit trails. Retention reports show which schedule the bank followed, so nobody has to rebuild disposal history by hand during an exam.
READ MORE: Getting Ready for a Bank Exam? Here Are 6 Ways the Right DMS Can Help
How Can a Bank Get Started With Automated Retention?
Automation is only as accurate as the schedule behind it, so the work starts with mapping every document type to the rules that govern it.
What Should a Bank Map Before Automating Retention?
Most banks work through five steps:
- List every document type the bank holds after closing.
- Map each type to the federal rules, state law, and board policy that apply.
- Record the trigger event and governing period for each type.
- Decide how legal holds will pause disposal when litigation or an investigation is pending.
- Have the board approve the schedule, then load it into the system.
Why Does Board Approval Matter for Automated Retention?
Examiners compare what the written policy says with what the bank does. When the system applies the board-approved schedule, the two match by default, and every disposal record backs that up.
Conclusion
Most banks treat retention as a storage question, focused on where records live and how long they stay there. In practice, the harder problem is the calendar math behind it.
Each rule in the tables above is clear on its own, but applying several of them from different start dates, across thousands of documents, is where retention errors tend to start. A system that calculates those dates as each document arrives removes that step, along with the errors that come with it.
Identifi is a document management and workflow automation engine built for banks and credit unions. It connects directly to your core and applies your board-approved retention schedule to every document from the moment it’s captured. Still tracking retention dates in a spreadsheet? Contact our team to see how your document types map to automated retention rules.