My understanding is that there is no record retention requirements for adverse action notices provided when we deny a deposit product/service to a customer due to a ChexSystems report. I'm just curious if there is a "rule of thumb" that everyone follows? I'm trying to figure out how long we need to keep them.

Thanks!

There are no record retention requirements in the FCRA. Civil liability is limited to two years (Section 617) unless it is willful non-compliance. But even then they have to prove actual damages. Most banks just prove the deliver through procedures.

Thanks for the help Randy. I may just tell them to keep them for 12 months and then destroy.