Answer:
Retention is often a state controlled requirement. I quickly scanned the FFIEC IT Handbook and see that retention policies should be in place and monitored, but there was no specific retention requirement stated.
First published on BankersOnline.com 3/20/06