OFAC Recordkeeping Requirements for Screening Evidence
October 11, 2026
OFAC recordkeeping requirements come down to one idea. If a transaction is subject to U.S. sanctions rules, you keep a full and accurate record of it, and you keep that record long enough for OFAC to look at it years later. Since March 2025 that period is 10 years, not 5. For a screening program, this means every check, every match and every decision has to be reconstructable long after the analyst who made it has moved on.
This guide covers what the rule says, what a useful screening record contains, which reports you have to file, and how a clean evidence trail helps when an examiner or auditor starts asking questions.
What 31 CFR 501.601 requires
The general recordkeeping rule sits in the Reporting, Procedures and Penalties Regulations at 31 CFR 501.601. Anyone engaging in a transaction subject to OFAC's regulations has to keep a full and accurate record of each such transaction, and make it available for examination on request. Where property is blocked, the record has to cover the blocked property for as long as it stays blocked and for the retention period after it's unblocked.
The rule doesn't hand you a form. It doesn't list fields. It tells you the outcome you need: someone reviewing your file later should be able to see what happened and why.
Retention moved from 5 years to 10 years
In April 2024 the 21st Century Peace through Strength Act extended the statute of limitations for civil and criminal violations of IEEPA and TWEA from 5 years to 10 years. OFAC then amended its recordkeeping rule to match, with the 10 year period taking effect in March 2025. The logic is simple. If OFAC can bring an enforcement case for conduct up to 10 years old, your records have to cover the same window.
Two practical points follow. First, review any retention schedule, archive policy or vendor contract that still says 5 years. Second, think about deletion jobs. A system that purges screening logs after 60 months now deletes evidence you're expected to keep. If you aren't sure how the change applies to a specific record type, read the current text of 501.601 and ask counsel. The rule itself is short.
What evidence of a screening to keep
A screening record is only useful if it answers the questions an examiner actually asks. Who did you check, against what, what came back, and what did you decide. The table below is a practical checklist.
| Field | What to store | Why it matters |
|---|---|---|
| Input screened | The exact name, date of birth, country, address or other identifiers as submitted | Shows what the system actually saw, including typos |
| Lists and version | Which lists were searched and the publication date or version of each | Proves you screened against the list that was current at that moment |
| Timestamp | Date and time of the check, with time zone | Ties the result to a specific list state and transaction |
| Matching settings | Threshold, fuzzy matching rules, alias and transliteration handling | Explains why a name did or didn't produce an alert |
| Potential matches | Every candidate entry returned, with its list ID and score | Shows the full picture, not only the hit you chose to review |
| Decision | Cleared as false positive, escalated, confirmed match, blocked or rejected | The outcome an examiner will test |
| Reviewer | The named person who made the decision, and any approver | Accountability and four eyes evidence |
| Rationale | The specific reason, such as a different date of birth or nationality | A decision without a reason is hard to defend |
| Change history | Every edit to the case, by whom and when | Shows the record wasn't rewritten after the fact |
The rationale field is where many files fall short. "Not a match" tells an examiner nothing. "Customer born 1984, SDN entry born 1961, different nationality" tells them the analyst compared identifiers and reached a reasoned view. Our guide on what an OFAC check involves covers how to compare identifiers before you clear an alert.
Reports of blocked and rejected transactions
Recordkeeping sits next to reporting obligations, and the two feed each other.
- Blocked property reports (31 CFR 501.603). When you block property, you report it to OFAC within 10 business days. Holders of blocked property also file an annual report of blocked property held as of June 30, due by September 30.
- Rejected transaction reports (31 CFR 501.604). When you reject a transaction that isn't blocked but would violate sanctions rules if processed, such as certain payments touching a comprehensively sanctioned jurisdiction, you report it within 10 business days.
- Your own copies. Keep the report you filed, the confirmation, and the underlying screening record together. An examiner will want to trace the report back to the alert that triggered it.
Reports are often where gaps show up. If your report says the payment was stopped on a given date but the screening log shows a different list version or no reviewer, the inconsistency becomes the question. For payments in particular, a record that links the message, the screening result and the decision saves a lot of reconstruction. See how payment screening keeps that link in one place.
How an evidence record and audit log help in an exam
Examiners and independent auditors usually test a sample. They pick alerts, cleared cases and blocked items and ask you to walk them through each one. A program with good records answers in minutes. A program with scattered spreadsheets, emails and screenshots spends days rebuilding files and still can't prove which list was used.
A structured evidence record helps in three ways.
- Completeness. Every check produces the same fields automatically, so nothing depends on an analyst remembering to save a screenshot.
- Integrity. An append only audit log shows who changed what and when. That's the difference between a record and a story told after the fact.
- Retrieval. You can pull every decision for one customer, one reviewer or one date range, and export it in a form an examiner can read.
This is the core of what OFAC compliance software should give you beyond a name search. Each screening in OfacScanner produces an evidence record with the input, list versions, candidates, scores, decision, reviewer and rationale, and case changes are written to the audit trail. Retention, access control and data handling are described on our security page.
Ongoing monitoring needs records too
Screening at onboarding isn't the end of the file. When a list update produces a new alert on an existing customer, that review is a fresh decision that needs the same evidence. If you rescreen after each list update, keep the record of each rescreen, not only the ones that alerted. It shows the customer was covered continuously. More on that in ongoing sanctions monitoring.
A short recordkeeping checklist
- Retention policy says 10 years for OFAC related records, and deletion jobs respect it.
- Every screening stores the exact input, lists, list versions and timestamp.
- All candidate matches are kept with scores, not only the reviewed one.
- Every decision has a named reviewer and a specific written rationale.
- Case edits are logged and can't be silently overwritten.
- Blocked and rejected transaction reports are stored with the screening record behind them.
- You can export a full case file for a sample request without manual rebuilding.
- Access to records is restricted and reviewed, as described in your compliance software setup and security controls.
Common questions
Does the 10 year period apply to records created before March 2025
Records still held when the new rule took effect fall under the longer period, so you shouldn't delete them at the old 5 year mark. Check the exact transition language with counsel if you have older archives scheduled for deletion.
Do I need to keep cleared false positives
Yes, in practice. A cleared alert is a decision, and the rationale for clearing it is exactly what an examiner tests. Keeping only confirmed matches leaves no evidence that the rest were reviewed properly.
Is a screenshot of the search result enough
Usually not. A screenshot rarely shows the list version, the matching settings or every candidate, and it can't show who reviewed it or why. A structured record is far easier to defend.
Who decides whether a match is real
You do. Screening results support a compliance decision, and the decision belongs to your team. OfacScanner isn't affiliated with OFAC or the U.S. Treasury. Questions about the product go to [email protected].
Want to see a result before anything else? Screen one name now with the OFAC search on our home page and look at the matches, scores and list date it returns.