Letter to OFAC on the Request for Guidance Regarding the Final Rule on Reporting, Procedures and Penalties Regulations

Dear Acting Director Palluconi:

The American Bankers Association  commends Treasury's Office of Foreign Assets Control (OFAC's) decision to delay the effective date of OFAC’s new ten-year recordkeeping requirement for six months.  As noted in our May 10, 2024 letter to OFAC, bank policies, procedures, and operations were all developed in reliance on OFAC’s five-year requirement; therefore banks welcomed OFAC's decision to delay the effective date to March 12, 2025. However, since OFAC has finalized its revised recordkeeping rule,  it has become increasingly clear that additional implementation guidance would help clarify OFAC’s new requirements and expectations for all stakeholders, because for the first time, banks must keep records for ten years exclusively for the purpose of complying with new sanctions recordkeeping requirements. OFAC has a history of providing helpful guidance to the private sector; for example, OFAC previously issued a Framework for OFAC Compliance Commitments  so that organizations could better understand OFAC’s compliance expectations.

There may be some question as to why new recordkeeping guidance is necessary, particularly because banks have a long history of successfully complying with OFAC recordkeeping requirements. As a technical matter, the changes to the text of OFAC's recordkeeping rule are minimal. OFAC's recordkeeping rule has consistently required the maintenance of "full and accurate record" of "any transaction subject to the provisions of this chapter." OFAC’s interim final rule published last September, and final rule issued in March require that such records be kept for “10 years” after the date of such transaction instead of "5 years." The nature of the covered records has not changed.

However, under OFAC’s new requirement, banks now must keep records for ten years specifically to comply with OFAC's revised rule. In other words, for the first time, OFAC's novel requirement deviates from, and is longer than, existing bank recordkeeping requirements, practices, and record retention schedules. Banks already retain a significant number of records for five years in order to comply with various regulatory requirements, including Bank Secrecy Act (BSA) recordkeeping rules. In certain cases, those rules may limit recordkeeping to a five-year period. When OFAC's requirement matched other regulatory requirements, banks did not need to specifically conclude that various retained records were also being kept for sanctions compliance purposes. Those determinations will now be necessary.

For example, banks are required to retain records of the beneficial ownership information of their legal entity customers for a period of five years in order to comply with FinCEN's customer due diligence (CDD) rule requirements.  The entire corpus of beneficial ownership records necessary to comply with the CDD rule is retained within the bank’s holdings for a five-year period. Prior to OFAC's new rule, it was unnecessary and duplicative for a bank to assess whether there were ever instances when retaining a subset of those already-retained beneficial ownership information records was also desirable or appropriate for sanctions compliance purposes.

As banks adjust their records retention schedules, guidance regarding OFAC’s new expectations would assist banks, their sanctions compliance professionals, their bank examiners and primary regulators, and other important stakeholders understand the new recordkeeping requirements. 

Download the letter to read the full text.