On March 20, 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) issued a final rule extending the recordkeeping requirements under OFAC's regulations from five years to 10 years. This change aligns with the extension of the statute of limitations from five years to 10 years for violations of the International Emergency Economic Powers Act and the Trading with the Enemy Act, as provided by the 21st Century Peace through Strength Act, signed into law in April 2024. The final rule adopts, without change, the interim final rule published by OFAC on September 13, 2024.
One notable aspect of the final rule is OFAC's warning to financial institutions subject to EU regulations on anti-money laundering and counter-terrorism financing that OFAC's regulations must be complied with when applicable, even though there may be conflicts with EU laws governing data retention (e.g., Article 40 of EU Directive 2015/849, which provides that records of transactions must be deleted five years after the end of a business relationship with regular clients, or after the transaction for occasional clients, because this data is considered "personal" by EU authorities). OFAC considered a comment on this potential conflict of laws, and essentially indicated that they may (but would not be bound to) consider such a conflict as a mitigating factor in an enforcement action — cold comfort for a regulated financial institution facing a conflict between OFAC's requirements and EU law.
OFAC's recordkeeping requirements are very broad, as set out in the Reporting, Procedures and Penalties Regulations (RPPR) and the Cuban Assets Control Regulations (CACR). In essence, any person engaging in a transaction subject to OFAC's regulations must maintain a full and accurate record of each such transaction. These records must be available for examination for at least 10 years after the date of the transaction. Additionally, individuals holding property blocked pursuant to OFAC's regulations are required to keep comprehensive records of such property for the duration it remains blocked and for at least 10 years after it is unblocked. With this in mind, the records must in many cases be kept for longer than 10 years.
Not all company records are subject to this 10-year retention requirement. The rule specifically targets records of transactions under OFAC's jurisdiction and records of blocked property. Records under OFAC's jurisdiction refer to documentation related to transactions, property, or activities subject to U.S. economic sanctions. This includes transactions involving sanctioned persons or entities, or sanctioned territories, and records of blocked or rejected transactions.
Separately, as a protective measure, businesses should retain documentation demonstrating compliance with OFAC's regulations, including due diligence and screening results, and other internal compliance measures.
The extension of the recordkeeping period calls for companies to revise their compliance policies and practices to reflect and implement the 10-year retention requirement. Additionally, employees involved in transactions subject to OFAC's regulations should be informed about the updated recordkeeping requirements.
