Record Retention

You are required to retain records evidencing your compliance with Regulation CC for a period of two years. [12 CFR 229.21(g)(1)] This means that for a period of two years following any particular action you take in compliance with Regulation CC (such as giving initial disclosures when opening an account or giving a depositor notice that you have invoked a safeguard exception), you must have records that prove that you complied. In the case of disclosures and notices, you are not required to have records that prove delivery of the disclosure or notice to a particular depositor but, rather, you must be able to demonstrate that you had procedures that would reasonably ensure depositors received the required disclosures or notices. [Commentary, §229.21(g)-1] However, you are required to retain a copy of the notice you give the depositor when you invoke the “reasonable cause” safeguard exception, and you also must retain a brief description of the reason you invoked that exception. (The notice itself may or may not list the reason; recall that if the reason is confidential, you are not required to list it on the notice. If the reason is not on the notice, you will have to document it separately and retain that record for two years).

You may, in some circumstances, be required to retain records of compliance for more than two years. If you have actual notice that you are being investigated or are subject to an enforcement proceeding by your regulatory agency, or if you have been served with notice of a lawsuit filed under Regulation CC, you must retain records relating to the proceeding until the outcome is determined, unless the agency or the court permits otherwise. [12 CFR 229.21(g)(2)]