On March 20, 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) published a final rule (Final Rule) extending the recordkeeping requirement for compliance with U.S. economic sanctions regulations from five to 10 years. This change aligns with the April 2024 legislation (Pub. L. 118-50) that increased the statute of limitations for economic sanctions violations under the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1705, and the Trading with the Enemy Act (TWEA), 50 U.S.C. § 4315 to 10 years. The Final Rule took effect March 21, 2025.
10-Year Recordkeeping Requirement for Sanctions Compliance
The April 2024 legislation doubled the statute of limitations for civil and criminal violations of IEEPA and TWEA. Subsequently, OFAC issued an interim final rule (89 Fed. Reg. 74832) in September 2024 to amend its recordkeeping requirements, consistent with the revised statute of limitations. After reviewing public comments, OFAC finalized the rule, officially codifying the 10-year recordkeeping requirement at 31 C.F.R. 501.601 and requiring that:
Additionally, individuals or entities holding blocked property must keep a full and accurate record of that property for at least 10 years after the date of unblocking.
Implications for Financial Institutions
Financial institutions – including banks, casinos, and money services businesses – subject to the Bank Secrecy Act (BSA) must implement risk-based measures to address compliance risks related to money laundering and terrorist financing.
Previously, the BSA’s recordkeeping requirements aligned with OFAC’s five-year retention period. With the Final Rule’s extension, financial institutions must reassess their record retention policies and update internal frameworks to comply with the new 10-year requirement. Regulatory agencies will expect institutions to revise policies, procedures, and controls to reflect this change.
Key Takeaways
- The extended recordkeeping requirement applies only to sanctions compliance and does not affect the five-year retention requirements for the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR).
- Companies should review their existing recordkeeping and record retention policies to determine updates or adjustments to be made to align with the new 10-year OFAC period, as well as evaluate potential conflicts with other regulatory record retention periods to be reconciled. Companies should also evaluate from an operational standpoint whether their systems, resources, and technologies can support the longer retention period, including assessing potential impacts on data management, storage costs, access controls, and cybersecurity.
- Compliance measures should include updating record-retention policies, enhancing automated systems, and conducting organization-wide training to ensure adherence to the new rules.
This change carries significant operational and compliance implications, particularly for financial institutions, which must ensure readiness to meet the extended requirements while maintaining secure and accessible records for regulatory purposes.