I do monthly, quarterly and annual risk reviews depending on whether the customer is high, moderate or low risk. Has anyone determined how long these records should be retained? I am not referring to anything dealing with SARs.
On one hand, I am thinking from exam to exam to prove it is being done per bank policy. On the other, since it is BSA/AML related should it be 5 yrs? That could mean storing a lot of paper files.
Thanks for any input.

I would not keep them for 5 years as risk reviews are not part of the regulatory framework - only the pseudo framework created by the regulators. I would recommend at least audit to audit and maybe a little longer as you may need to refer back to them for information when conducting subsequent reviews.