Under Regulation B, lenders must retain consumer credit application records for at least 25 months and business credit application records for at least 12 months, measured from the date the applicant is notified of the decision or told the application is incomplete. Those are floors. How long lenders must retain credit application records in practice is usually longer, because the Truth in Lending Act, the Home Mortgage Disclosure Act, the Bank Secrecy Act, and the five-year ECOA lawsuit window all pull the real number up.
The 25-Month Rule for Consumer Applications
Regulation B, which implements the Equal Credit Opportunity Act, sets the consumer baseline at 25 months.1eCFR. 12 CFR 1002.12 – Record Retention The clock starts on the date the lender notifies the applicant of the action taken, or notifies them that the application is incomplete. It does not start on the application date or on the date the lender made its internal decision.
The same 25 months applies when a lender takes adverse action on an existing account, such as lowering a credit limit or closing a line of credit. The lender must keep any written or recorded information about that action, along with any written complaint from the account holder alleging a violation.2eCFR. 12 CFR 1002.12 – Record Retention
Business Credit Applications
Business credit applications carry a shorter default of 12 months from the notification date.1eCFR. 12 CFR 1002.12 – Record Retention There is an exception for larger businesses. Where the applicant had gross revenues over $1 million in its previous fiscal year, or the credit involves trade credit, factoring, or similar arrangements, retention drops to 60 days after notification.
The 60-day window is conditional. If the applicant asks for the reasons behind an adverse decision, or asks the lender to keep the records, within that 60 days, the retention period reverts to the full 12 months.2eCFR. 12 CFR 1002.12 – Record Retention Smaller businesses with revenues at or below $1 million get the full 12 months automatically.
What Counts as a Retained Record
Regulation B identifies several categories that must be kept during the retention period, for both consumer and business credit:1eCFR. 12 CFR 1002.12 – Record Retention
- The application itself and any written or recorded information used to evaluate it, unless returned to the applicant at their request.
- Copies of the notification of the action taken and any statement of specific reasons for adverse action.
- Any written statement from an applicant alleging a violation of ECOA or Regulation B.
- The text of any prescreened credit offer, the criteria used to select recipients, and any related complaint correspondence. Retention runs 25 months from the offer for consumer credit and 12 months for business credit.
- All written or recorded information about any self-test the lender conducted to evaluate its own fair lending compliance, kept 25 months after the test is completed.
When Retention Extends Automatically
The standard timelines stop applying once a lender has actual notice that the Attorney General, the CFPB, or another enforcement agency is investigating an alleged ECOA or Regulation B violation. The same is true once the lender has been served with a private lawsuit. In either case, all relevant records must be kept until the matter reaches final disposition, unless a court or agency permits earlier destruction.2eCFR. 12 CFR 1002.12 – Record Retention
The extension reaches every record category, including self-test files and prescreened solicitation materials. Any regulatory inquiry, even one that looks routine, is a signal to put a litigation hold on the full set of application records.
Longer Periods Under Other Federal Laws
Regulation B is the starting point. Several other federal laws impose their own retention obligations, and where they overlap with Regulation B, the longer period controls.
Truth in Lending Act and Regulation Z
For general TILA compliance evidence, records must be kept two years after the date disclosures are required or action is taken.3eCFR. 12 CFR 1026.25 – Record Retention Mortgage records run longer:
- Integrated mortgage disclosures: three years after the later of consummation, required disclosure date, or required action date.
- Closing Disclosures and all related documents: five years after consummation.
- Loan originator compensation records: three years after the date of each payment, covering both what the creditor paid and what any loan originator organization received or distributed.
Home Mortgage Disclosure Act
Lenders covered by HMDA must keep a copy of their annual loan/application register for at least three years after submission.4eCFR. 12 CFR 1003.5 – Disclosure and Reporting
Bank Secrecy Act
The Bank Secrecy Act requires financial institutions to retain records mandated under its regulations for five years.5eCFR. 31 CFR 1010.430 – Retention of Records The rule covers records of credit extensions over $10,000 that are not secured by real property, including the borrower’s name and address, the amount, the purpose, and the date. Records must be stored so they can be produced within a reasonable time. Because five years exceeds Regulation B’s 25 months, any credit record that falls under both effectively must be kept for five years.
Why the 25-Month Minimum Is Often Too Short
Under ECOA, a private applicant can bring a discrimination lawsuit up to five years after the alleged violation.6Office of the Law Revision Counsel. 15 USC 1691e – Civil Liability A lender that destroys files at 25 months and then gets sued at year three has nothing to defend itself with. Many compliance programs treat five years as the practical floor for consumer credit records, even though Regulation B does not require it.
Electronic Records
Regulation B does not require paper. Records can be kept as photocopies, microfilm, or digital files produced by any accurate retrieval system, including computer-stored documents.7Consumer Financial Protection Bureau. Regulation B: Record Retention A lender using a computerized system does not need a paper copy of a document like an adverse action notice, as long as the relevant information can be regenerated in time for an examination.
There is an added accommodation for automated underwriting. If a lender enters information from a written application into a computerized system and makes the credit decision mechanically based only on the entered data, retention obligations are satisfied by keeping the entered data alone. The original paper application does not have to be stored, and not every field has to be entered. Demographic data collected for monitoring purposes, such as race, ethnicity, and sex, is the exception: it must be entered and retained regardless of how the credit decision was made.7Consumer Financial Protection Bureau. Regulation B: Record Retention
Disposing of Records After the Period Ends
Once retention runs out, credit application files cannot simply be dropped in the recycling. They contain consumer report information, and the FTC’s Disposal Rule under the Fair and Accurate Credit Transactions Act requires businesses to use reasonable measures to prevent unauthorized access during disposal.8Federal Trade Commission. Disposal of Consumer Report Information and Records
For paper, that means burning, pulverizing, or shredding so the information cannot practicably be read or reconstructed. For electronic records, the data must be destroyed or erased so it is equally unrecoverable.9eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information Deleting a file or reformatting a drive is generally not enough, because forensic tools can recover the data. Lenders that outsource disposal remain responsible for the vendor’s practices.
Penalties for Failing to Retain Records
Under ECOA, an applicant who proves discrimination can recover actual damages. A court can add punitive damages of up to $10,000 in an individual lawsuit. In a class action, the total punitive award is capped at the lesser of $500,000 or 1% of the creditor’s net worth.6Office of the Law Revision Counsel. 15 USC 1691e – Civil Liability Courts weigh the frequency of the violations, the creditor’s resources, and whether the noncompliance was intentional.
The evidentiary risk often outweighs the statutory penalties. A lender that destroys records too early and then faces a discrimination claim has no documentation to show its decision rested on legitimate creditworthiness factors. Courts and regulators can draw negative inferences from missing records, and consent orders that follow examinations can require process overhauls and monitoring that cost more than any direct fine.