BSA record retention is five years, not seven and not ten. The general rule, 31 CFR 1010.430(d), sets five years for every record the Bank Secrecy Act regulations require, and the specific rules for CTRs, SARs, customer identification, beneficial ownership, wire transfers and monetary instrument sales all say five years too. What differs is when the clock starts: the date a report is filed, the date a record is made, or the date an account closes. Ten years is a real figure, but it belongs to OFAC, whose sanctions recordkeeping rule moved to ten years in March 2025. Seven years appears nowhere in the BSA rules for banks. A bank may keep records longer, for another law or its own policy, but that is a choice, not the BSA. Staff ask this question often, and Botminds' BSA/AML Manual Search answers it with the section cited beside the institution's own retention procedure.
Rule text is quoted from the eCFR as of October 22, 2026. Product examples come from a fictional sample credit union, Norrell Federal Credit Union.
Six things people believe about BSA record retention, and what the rule says
Common belief: BSA records are kept seven years.
What the rule says: Five. "Seven years" does not appear anywhere in 31 CFR parts 1010 or 1020.
Common belief: The BSA moved to ten years.
What the rule says: OFAC did, for sanctions records, from March 12, 2025 (31 CFR 501.601). The BSA rules still say five.
Common belief: Five years from the transaction.
What the rule says: It depends on the record: from the report date for a CTR, from filing for a SAR, from account closing for identity information.
Common belief: Once the SAR is filed, the working papers can go.
What the rule says: Supporting documentation is kept five years from filing and "deemed to have been filed with the SAR."
Common belief: Congress set five years.
What the rule says: The statute lets Treasury set periods up to six years, or longer if necessary; five is the regulation's choice.
Common belief: Any archive will do.
What the rule says: Records must be "accessible within a reasonable period of time."
Is BSA record retention 7 years? No, and the rule never says it
No. The Bank Secrecy Act regulations for banks set five years, and the phrase "seven years" does not occur in them. We searched the full eCFR text of 31 CFR part 1010, the general rules, and part 1020, the rules for banks, as of October 22, 2026: "seven years" and "7 years" appear zero times. "Ten years" appears once, as a prison term in the criminal penalty section.
How often each period appears in the BSA rules for banks
Seven years at a bank comes from somewhere else: a records schedule that rounds several rules up to one number, another law that governs a particular record, or practice carried over from tax and audit work. None of those is wrong, as long as everyone knows the BSA is not the reason. The question to ask the policy owner is which rule each period serves.
How long must BSA records be kept? Every period in the rule
Five years, for every record the BSA rules require. The general rule reads: "All records that are required to be retained by this chapter shall be retained for a period of five years" (31 CFR 1010.430(d)). The specific sections repeat the period and fix the starting point, which is where the real answers to most retention questions lie.
BSA retention for banks, record by record: always five years, from different starting points
| Record | Section | Period | The clock starts |
|---|---|---|---|
| Copy of each CTR filed | 1010.306(a)(2) | Five years | The date of the report |
| Copy of each SAR and its supporting documentation | 1020.320(d) | Five years | The date of filing |
| Customer identifying information (CIP) | 1020.220(a)(3)(ii) | Five years | The date the account closes; for credit cards, closes or becomes dormant |
| CIP verification records | 1020.220(a)(3)(ii) | Five years | The date the record is made |
| Beneficial owner identification | 1010.230(i)(2) | Five years | The date the account closes |
| Beneficial owner verification | 1010.230(i)(2) | Five years | The date the record is made |
| Funds transfers of $3,000 or more | 1020.410(a), with 1010.430(d) | Five years | The record |
| Cash sales of monetary instruments, $3,000 to $10,000 | 1010.415(c) | Five years | The record |
| Every other record the chapter requires | 1010.430(d) | Five years | The record, unless a section says otherwise |
How long must SAR supporting documentation be retained?
Five years from the date the SAR is filed. The rule is short and strict: "A bank shall maintain a copy of any SAR filed and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR. Supporting documentation shall be identified, and maintained by the bank as such, and shall be deemed to have been filed with the SAR" (31 CFR 1020.320(d)).
"Deemed to have been filed" has two consequences. The documentation must be identified as supporting documentation, so the file needs a clear boundary, not a shared folder. And it carries the SAR's confidentiality: the same section bars disclosing a SAR or anything that would reveal one, and the bank must make the documentation available on request to FinCEN, law enforcement and the regulators that examine it. A continuing SAR starts its own five years; the original's clock does not reset.
How long do you keep CTR records?
Five years from the date of the report. Under 31 CFR 1010.306(a)(2), a copy of each report filed under the CTR and exemption rules "shall be retained by the financial institution for a period of five years from the date of the report" (31 CFR 1010.306). The same section requires the CTR itself within 15 days of the transaction.
Exemptions follow the same period. A designation of exempt person filed on FinCEN Form 110 is a report under 1020.315, so the copy is kept five years from its date, and the annual eligibility reviews that keep a Phase II exemption alive are records the chapter requires, kept five years under 1010.430(d).
When does the BSA retention period start?
It starts at one of three events, depending on the record: the filing or report date for CTRs and SARs, the date the record is made for most transaction and verification records, and the date the account closes for customer identifying information and beneficial owner identification. The last one is the trap. For a customer who keeps an account for twenty years, the identity records from account opening are kept for twenty-five.
One customer, three records, three clocks: the five years start at different times
- Account open, 2020 to 20242020–24
- Five years after closing2025–29
- Before filing2020–22
- Five years from filing2022–27
- Before the report2020–21
- Five years from the report2021–26
The practical consequence is that retention runs on events, not on a calendar. A records system that deletes everything five years after it was created will destroy identity records for open accounts, and one that keeps everything forever keeps SAR files, which carry confidentiality duties, far longer than any rule requires. Each record type needs its own trigger.
Is BSA record retention 10 years? The OFAC change behind the question
No, but sanctions record retention is, and that is where the question comes from. In April 2024 Congress extended the statute of limitations for violations of sanctions laws such as IEEPA and the Trading with the Enemy Act from five years to ten. To match it, OFAC issued an interim final rule on September 13, 2024 "extending recordkeeping requirements for certain transactions from five to 10 years," effective March 12, 2025 (OFAC, 89 FR 74832).
The rule now requires a full and accurate record of each transaction subject to OFAC's regulations to be "available for examination for at least 10 years after the date of such transaction," and blocked property records for ten years after unblocking (31 CFR 501.601). A wire to a sanctioned party, a rejected transaction and a blocked account are OFAC records. The same wire's BSA funds transfer record is still a five-year record under the BSA. A bank that keeps one copy for both purposes keeps it ten years, because the longer rule governs the shared record, not because the BSA changed.
Where the statute leaves room: up to six years, or longer if necessary
Five years is Treasury's choice, not Congress's. The Bank Secrecy Act's recordkeeping statute lets the Secretary set periods by type of record, and caps them: "Any period so prescribed shall not exceed six years unless the Secretary determines, having regard for the purposes of this section, that a longer period is necessary in the case of a particular type of record or evidence" (12 U.S.C. 1829b(g)).
That leaves Treasury room to lengthen a period by regulation, and it has done so in no BSA rule for banks through October 2026. FinCEN's April 2026 proposal to rewrite the AML program rule does not change the retention section; how that proposal and the year's other changes sort into final and proposed is set out in Bank Secrecy Act changes in 2026.
Accessible within a reasonable period, and a few records the rule does not list
Retention is not only how long but how reachable. Records "shall be filed or stored in such a way as to be accessible within a reasonable period of time, taking into consideration the nature of the record, and the amount of time expired since the record was made" (31 CFR 1010.430(d)). An archive that takes weeks to search fails the rule's purpose in a 314(a) search or an exam.
Some records sit outside the list. When law enforcement asks a bank to keep an account open, FinCEN's guidance recommends keeping the request on file for at least five years after it expires (FIN-2007-G002), a recommendation rather than a regulation. Training records, alert dispositions and committee minutes are not named in Chapter X at all; their periods come from the institution's own policy, and five years, matching the examination evidence they support, is a common anchor. Who needs which training, and what an examiner looks for in the file, is in BSA training requirements.
Retention for answers about the rules: BSA/AML Manual Search
Answers given to staff are not records the BSA requires, but they are the evidence of what staff were told. BSA/AML Manual Search keeps every answer, referral and step on the audit trail for five years, a setting the institution chooses to match the BSA period, with legal holds set by the BSA officer. Each answer is kept with the sources as they stood that day: the sample credit union's answer on a cash question shows each section of 31 CFR, the FFIEC manual section and its date, the SAR FAQ relied on, and the procedures with their versions.
An answer in BSA/AML Manual Search, kept with the sources it rested on and the date of each
The same trail answers the examiner's version of the retention question: what was the institution's position on a rule on a given day, and who changed it? The sample credit union's export for its examiner covers every answer in a period with the source versions behind it, referrals by date and author only, and procedure changes with maker and checker. It never says whether a referral led to a SAR, which is the confidentiality rule of 1020.320(e) applied to the export itself.
The examiner export: answers, referrals and procedure changes, never a SAR outcome
Questions people ask
What is the BSA record retention requirement in one sentence?
Keep every record the BSA regulations require for five years, accessible within a reasonable period, under 31 CFR 1010.430(d). The start of the five years depends on the record: the filing date for SARs and CTRs, account closing for identity information, and the date the record is made for most others.
Is BSA record retention 10 years for SARs?
No. SAR copies and supporting documentation are kept five years from filing under 31 CFR 1020.320(d). Ten years applies to records of transactions subject to OFAC's sanctions regulations, under 31 CFR 501.601 since March 12, 2025.
Can a bank keep BSA records longer than five years?
Yes. Five years is a minimum, and a bank may keep records longer for another law, litigation, a legal hold or its own policy. Records tied to SARs keep their confidentiality for as long as they are kept, so longer retention means a longer duty to protect them.
Does the five-year rule apply to electronic records?
Yes. Under 1010.430(b), the records may be those made in the ordinary course of business, and nothing in the section requires paper. They must be kept for the full period and be accessible within a reasonable time; for checks and similar instruments, both sides must be kept unless the back is blank or standard.
What are BSA AML record retention requirements for credit unions?
The same as for banks. Credit unions are "banks" under 31 CFR 1010.100(d), so CTRs, SARs, CIP records and wire records are all kept five years from the same starting points. Federally insured credit unions also answer to the NCUA's program rule at 12 CFR 748.2.