MSB Recordkeeping Requirements: What Every MSB Must Maintain

The Bank Secrecy Act does not just require MSBs to file reports with FinCEN — it also requires them to maintain specific records. These recordkeeping requirements are a critical part of BSA compliance, and failures to maintain required records are a common examination finding that can result in civil money penalties.

This article covers exactly what records MSBs must maintain, for how long, and how to structure your recordkeeping program to be examination-ready.

The Core Principle: Five-Year Retention

The BSA's general recordkeeping requirement for most covered financial institutions — including MSBs — is a five-year minimum retention period. Most BSA records must be retained for five years from the date of the record or the date the account was closed.

This five-year period applies from the date the record was created — not from the date the transaction occurred or the date a report was filed. Plan your record retention systems and document management policies around this five-year timeline.

Transaction Records MSBs Must Maintain

Funds Transfers

For funds transfers of $3,000 or more, MSBs must retain records including the name and address of the person requesting the transfer, the amount of the transfer, the date of the transfer, any instructions or identifying information provided by the requestor, and the name of the recipient and the recipient's financial institution.

Currency Purchases and Sales

Records of purchases and sales of monetary instruments — including currency exchanges — must be retained when the transaction involves $1,000 or more in currency.

Monetary Instrument Sales

For sales of money orders, traveler's checks, or stored value instruments above $3,000, records must be maintained including the purchaser's identity verification information, the amount of the purchase, and the serial numbers of instruments sold.

SAR Documentation

Every Suspicious Activity Report filed must be retained along with all supporting investigation documentation for five years from the date of filing. This includes monitoring alerts that triggered the investigation, account history reviewed during the investigation, investigation notes and analysis, communications related to the filing decision, and the filed SAR itself.

Documentation for alerts that were reviewed and cleared without a SAR filing must also be retained — your reasoning for not filing is as important as your reasoning for filing in an examination context.

CTR Records

If your MSB handles cash transactions, Currency Transaction Report records — including the filed CTR and the underlying transaction information — must be retained for five years.

Customer Identification Records

Records documenting your Customer Identification Program procedures must be retained for five years after the date the account is closed or the customer relationship ends. These records include the information collected at onboarding, the verification steps taken, and the results of those verification steps.

AML Program Documentation

Your written AML program, risk assessment, policies, and procedures must be retained and kept current. While the BSA does not specify a retention period for program documents that have been superseded, best practice is to retain prior versions of policies and risk assessments for at least five years to demonstrate program evolution over time.

Making Records Retrievable

Maintaining records is only half the requirement — records must also be retrievable on reasonable notice for examination or law enforcement requests. This means your record management system must allow you to locate and produce specific records quickly when requested.

Practical requirements for retrieval include organizing records by customer, by transaction date, and by record type. Having a searchable, indexed document management system rather than unorganized file storage. Testing retrieval processes periodically to confirm records can be found when needed.

Frequently Asked Questions

Can records be maintained electronically?

Yes. BSA regulations allow records to be maintained in electronic form provided they can be reproduced legibly and can be retrieved by FinCEN or law enforcement on reasonable request. Electronic records should be backed up and stored in a system that ensures data integrity over the required retention period.

What happens if required records cannot be produced during an examination?

Failure to produce required records during a FinCEN examination or law enforcement inquiry is a serious finding. It can result in civil money penalties and can significantly worsen other examination findings. Record retrieval capability should be tested regularly — not just assumed to be working.

Do recordkeeping requirements apply to declined transactions?

Records of transactions that were declined because of OFAC hits or other compliance reasons should generally be retained. Blocked transaction records must be reported to OFAC within 10 business days and records retained consistent with OFAC requirements.

How ComplyOne Helps

ComplyOne helps MSBs design and implement recordkeeping programs that satisfy BSA requirements and hold up under examination — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.