Loading…
Loading…
The final rule amends 31 CFR Part 501 (Reporting, Procedures and Penalties Regulations) and 31 CFR 515.572 (Cuban Assets Control Regulations) to extend the period during which any U.S. person, or any person engaging in a transaction subject to OFAC's regulations, must retain a full and accurate record of each such transaction. The retention period moves from five years from the date of the transaction to ten years.
The statutory predicate is the 21st Century Peace through Strength Act, signed 24 April 2024 as Division F of P.L. 118-50 (the foreign-aid supplemental package that included Ukraine/Israel/Indo-Pacific funding and the REPO Act). Section 3111 of that Act extended the statute of limitations for civil and criminal violations of the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA) from 5 years to 10 years. OFAC then issued the interim final rule on 13 September 2024 conforming the recordkeeping requirements to the new statute of limitations. That IFR took effect on 12 March 2025 (180 days after publication). The 21 March 2025 final rule adopted the IFR text without change, after considering one comment received.
The extended retention obligation applies to all OFAC sanctions programs, not just country-specific ones — Russia, Iran, DPRK, Cuba, Syria, Venezuela, China-related (NS-CMIC), counter-narcotics (SDNTK/Kingpin), counter-terrorism (SDGT), human-rights (Magnitsky), ransomware/cyber (CYBER2), and the catch-all transactional perimeters under EOs implementing IEEPA. The records that must be kept for 10 years are the ones already required under 31 CFR 501.601 — i.e., records demonstrating compliance with blocking, rejecting, and reporting obligations, including transactions involving SDN-listed parties, Crimea and other comprehensively sanctioned regions, and any transaction made under the authority of an OFAC general or specific licence.
The doubling of the retention window forces an across-the-board refresh of OFAC-screening transaction-archive systems at banks, money-services businesses, broker-dealers, investment advisers, payments processors, virtual-currency exchanges, and consumer-tech distributors with cross-border flows. Particularly costly for fintech / virtual-currency-exchange platforms whose transaction volumes dwarf legacy correspondent-banking flows.
combined with 10-year mandatory record retention means OFAC can now bring civil-penalty actions for conduct as old as 2015 (counted from 2025). This compounds with the 2024 Binance precedent (1,667,153 apparent violations going back to 2017) and the 2025-06-12 GVA Capital case (2018-21 conduct, charged in 2025): both relied on long-look-back transactional records, and both pre-dated the formal recordkeeping extension.
bringing investment advisers under the Bank Secrecy Act AML framework (effective 1 January 2026, since delayed by FinCEN to 2028) sits adjacent to this rule. Together they create a 10-year records environment across the U.S. asset-management industry that did not exist at the time of GVA Capital's 2018-21 conduct.
OFAC to clarify whether records can be retained in the form they originally existed (e.g., legacy core-banking exports) or whether they must be migrated to current systems with full searchability. ABA's April 2025 letter to OFAC raised this and other operational questions; the final rule did not address them, and OFAC has not yet issued FAQ guidance.
destroyed under the prior 5-year retention rule before the extension took effect — i.e., whether records destroyed in 2024 for 2019 transactions create exposure if those transactions are later investigated under the 10-year statute.
EU GDPR data-minimisation requirements for U.S. multinationals with European customer records subject to OFAC retention.
the 10-year window or, in conjunction with broader sanctions-program rollbacks, narrow recordkeeping back to the pre-2024 framework.