I was wondering what the record retention requirements are for a bank we acquired last year as far as CTR and SAR filings are concerned? I've been able to find numerous entries or posts relating to CIP reliance for mergers/acquisitions. But we are trying to finish up our annual audit, and the record retention request includes "examples of A, B, C for the past five years". The bank we acquired was small and would discreet file their CTRs and SARs. None of their BSA staff has stayed on, and we have no way to provide a copy of a CTR prior to the date of acquisition as they did not keep paper records. Is this acceptable? Do they merge with a "clean slate" and record retention requirements begin from the date of the merger forward? I was not part of the team during the M&A due diligence but I know BSA/AML/OFAC was discussed - all prior audits were clean and no significant weaknesses or issues were cited by their regulator or the outside firm that performed their most recent audit. Any guidance available for this would be great - I'm just not sure if this is a reportable issue?

When you buy a bank you buy it's BSA/AML program as is. If the "other" bank filed a CTR or SAR in the last five years you are legally responsible for being able to reproduce the data. You do not need to have a physical copy of the way the data entry device appeared on the screen, but you must have the data.

Thanks Ken - I was getting an awful lot of push back so wanted to check with the experts before I responded back to them. I'm wondering if their best solution would be to contact FinCEN and see if they could somehow recover the user id/password used by the e-filer of the bank we acquired. I'm still hopeful there is a folder or file cabinet somewhere in their main branch basement that holds the files.
Thanks again!!

Temper your expectations with the answers for Questions 8 - 11.

Perfect! Thanks again!

I know it's a 5 year retention period, but what all documentation needs to be retained? Do you have to save the acknowledgement emails FinCEN sends? Or can you just save the report itself? Question 11 in the FAQ's leads me to believe it's just the report.. but just want to make sure before I make the change

When they talk about "the report" in the CTR Q & A, they are talking about the CTR itself, not FinCEN communications.

As indicated earlier, you are required to be able to recreate a CTR for 5 years.

So do we not need to worry about being able to reproduce FinCEN communications, as long as we can recreate the CTR? There's no requirement to be able to prove you actually filed the CTR and didn't just generate the report and not submit it?

MS, recordkeeping requirements are that copies of the "report" (i.e. what you delivered to FinCEN) be retained for 5 years. Whether you can recreate it or not from Bank data doesn't matter. I think Ken was referring to "reproducing" a report that was sent as a text/batch file, and displaying it to look more like a pdf form.


If someone with admin access to the Bank's E-Filing site can't access 5 years worth of communications from the FinCEN E-Filing site, and you can't find where these electronic copies were saved (or printed to paper) prior to uploading to FinCEN, then you've got a bit of a problem.

That makes sense - thank you both for your help! This will save us quite a bit of paper and filing space

Keep in mind, though, that examiners and auditors will request copies of "communications" since the last audit or exam. Most institutions I know choose to save these communications along with the reports they accompanied, for the same 5 years.

What do you mean by communications? Is that the email that comes after a discrete filling that says "we've accepted your submission" and the one that comes a couple days later and says "We've given it a tracking number"? (I may have those backwards).

Yes. The communications also tell you whether or not the report was successfully submitted, or whether there is an error, and has been rejected. Auditors and examiners will want to see what actions you take after a report is rejected. (Are you correcting and resubmitting? Why is it rejected? Is it a human error or is there something systemically wrong with your submission?, etc.)