On September 11, 2024, the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) issued an Interim Final Rule amending its Reporting, Procedures, and Penalties Regulations under 31 C.F.R. Part 501. This rule extends the recordkeeping requirements for certain transactions from 5 to 10 years and will take rolling effect starting on March 12, 2025. This amendment mirrors the recently increased statute of limitations for violations of sanctions, which was extended from 5 years to 10 years following the enactment of the 21st Century Peace through Strength Act (Public Law No. 118-50) on April 24, 2024.
Public Comment Period
Because this is an Interim Final Rule, OFAC is accepting public comments until October 15, 2024.
Implications for Compliance
For entities subject to OFAC regulations, this extension has significant compliance implications. While the additional record retention burden may be minimal for many organizations, it will require adjustments to internal processes, and data storage and destruction protocols. Businesses must ensure that their recordkeeping systems are adjusted to accommodate the longer retention period, especially for transactions that may be subject to future OFAC enforcement actions. To be sure, businesses will not have to reconstruct records that are 5 years or older; they will only have to retain current records for the new ten (10) year retention period. We typically advise our clients, unless there are other reasons for a longer retention, to promptly destroy records following mandatory retention periods.
With longer retention periods comes increased data security stresses, especially in light of increasing cybersecurity threats. Businesses will need to ensure that sensitive data is securely stored for a decade, without compromising its integrity or accessibility, particularly for audit and investigations. Knowing that violations may be pursued for up to 10 years could lead companies to avoid higher-risk transactions or invest more heavily in pre-transaction due diligence to ensure compliance with sanctions laws.
OFAC’s extension of the recordkeeping requirements and the expanded statute of limitations underscore the importance of maintaining current and robust U.S. sanctions compliance programs. Businesses and financial institutions should promptly review their sanctions compliance programs including record retention policies to ensure compliance with the new 10-year retention period. Additionally, stakeholders are encouraged to participate in the public comment process to address any practical concerns related to the implementation of the Interim Final Rule.
