It’s been said that, “If you love something, set it free.” OFAC, apparently, does not second that emotion – at least not when it comes to transaction records. Instead, they now require banks to hold onto them for ten years – twice as long as before.
In September 2024, the Office of Foreign Assets Control (OFAC) quietly dropped an interim final rule (found at 89 FR 74832) amending the Reporting, Procedures, and Penalties Regulations (RPPR) under 31 CFR Part 501, and requiring that “certain transaction” records – which were once required to be kept for five years – now be retained for ten years. With an effective date of March 12, 2025, many financial institutions (and other entities subject to OFAC regulations) are now left wondering the full scope of this rule, and which of their records will be affected.
However, the rule itself provides little clarity on exactly what “certain transactions” fall under this requirement. Instead of offering a straightforward or exhaustive list, OFAC relies on reference (bordering on implication) to existing regulatory language – specifically 31 CFR Part 501, Subpart C – to “outline” what falls under the new requirement. Broadly, these would be transactions involving or subject to OFAC regulations, including blocked or sanctioned property, rejected or unexecuted prohibited transactions, transactions requiring OFAC authorization through licenses, and any activities tied to specific sanctions programs. In other words, the implication is that any transaction that falls under OFAC’s oversight now carries a decade-long recordkeeping obligation.
Here’s a high-level breakdown of some of the records now subject to the updated rule. First, documentation related to blocked property and assets (essentially, anything frozen due to U.S. sanctions). This may include bank accounts, securities, real estate, and other holdings belonging to entities on the Specially Designated Nationals (SDN) List – and similar restrictions (31 CFR 501.603). It is important to note here that the 10-year retention period begins after the date of the transaction, which means the actual recordkeeping timeframe may sometimes extend beyond a decade. For blocked property, the clock doesn’t start until the property is unblocked. As a result, in cases where assets remain blocked, the recordkeeping requirement can effectively last indefinitely. Next, records pertaining to rejected or unexecuted transactions – any transaction halted due to OFAC regulations (where there is not an otherwise “blockable” interest). This generally would cover wire transfers, credit card payments, securities trades, and any other financial activity that couldn’t proceed due to sanctions compliance (31 CFR 501.604). Additionally, transactions requiring an OFAC license fall under the expanded rule, even if the license application was denied. Whether seeking authorization for payments, trade, or other restricted dealings, it would appear appropriate to retain all applications and supporting documentation (31 CFR 501.602 and, by reference, 31 CFR 501.801).
Finally, records related to specific sanctions programs look to be encompassed. This could include compliance due diligence, sanctions screening logs, internal risk assessments, and audit reports. (31 CFR 501.601 and A Framework for OFAC Compliance Commitments).
Though the rule doesn’t do much in the way of clarifying the scope of the relevant recordkeeping obligations, it makes no secret as to why this longer retention period is being imposed. OFAC’s decision aligns with the 21st Century Peace Through Strength Act, which, among other things, extended the statute of limitations on civil penalties for sanctions violations from five years to ten years (50 U.S.C. 1705(d) and 4315(d)). In other words, the government now has a decade to enforce penalties for violations, so banks likewise need to hold onto records for the same period to avoid potentially unpleasant consequences. This may be particularly relevant for markedly complex financial cases, where illicit transactions can take years to uncover.
As the rule and the updated retention requirements are currently in effect at the time of this publication, now may likely be the perfect time for a record retention schedule review – to that end, our Record Retention Schedule Cheat Sheet is a useful tool that covers federal record retention requirements. Moreover, banks may want to evaluate (and update) their retention policies to reflect the shift from five-year to ten-year recordkeeping for applicable transactions, as well. As always, if you have any other questions or concerns about it, feel free to contact us on the Compliance Hub Hotline.
After all – though many may not “love” it – setting an OFAC record free too soon could be a costly mistake.