Last Reviewed: May, 2011
The purpose of record retention requirements and a record retention program is to provide a comprehensive and cost-effective way to promote effective member service by providing credit unions access to important member information. It also provides credit unions and their members protection in the event of damage or disaster, and ensures compliance with claims, litigation and/or IRS demands.
State laws provide procedural guidelines, and federal laws mandate record retention time periods. Although neither the National Credit Union Administration (NCUA) nor the Arizona Department of Financial Institutions regulate record retention, both outline provisions related to the practice of retaining records.
What are the NCUA Record Retention Requirements?
Part 749 of the NCUA Rules and Regulations requires all federally insured credit unions to maintain a records preservation program to identify, store and be able to reconstruct vital records in the event that the credit union's records are damaged or destroyed and includes recommendations for restoring vital member services. The regulation provides flexibility as far as the format credit unions may use for maintaining writings, records or information required by other NCUA regulations. Part 749 also provides an appendix, which provides guidance on the appropriate length of time credit unions should retain various types of operational records. For further details on NCUA record retention guidance, please see the Detailed Analysis of the Records Retention section.
How do these requirements affect credit unions?
Federally insured credit unions are required by law to maintain such programs. However, even without regulatory requirement, a records retention program would be imperative. Credit unions have a responsibility to be able to reconstruct their records in order to protect their assets as well as their member's funds in the event of a disaster such as fire, flood, storm or malicious destruction. This is only prudent and sound business practice.
What must credit unions do to comply?
A federally insured credit union is required to establish and maintain a vital records preservation program. The program must be in place, not later than 6 months, after the credit union is insured. The vital records preservation program must:
- Be in writing and contain procedures for storing duplicate vital records at a vital records center;
- Designate the staff member responsible for carrying out the vital records duties;
- Provide a schedule for the storage and destruction of records; and
- Contain a records preservation log detailing for each record stored, its name, storage location, storage date, and name of the person sending the record for storage.
Vital Records Center
A vital records center is a storage facility located far enough from the credit union's offices to avoid the simultaneous loss of both sets of records in the event of disaster. The credit union must maintain any equipment and software necessary to access records. The credit union may contract a third party to maintain this equipment or software for them.
What are the management's and the board of directors' roles?
Management and the board of directors must establish written policies and procedures for the development and maintenance of a record retention program. The documentation provides proof that credit unions are in compliance with the laws and rules regulating record retention, and the maintenance enables credit unions to adapt to changed circumstances and new technological advances.
In developing a vital records preservation program, the board of directors written policies must include the following:
- Specific guidelines and a schedule for the retention/destruction of records
- Classification of records (from inconsequential to vital)
- A schedule for the storage and destruction of records; and
- A records preservation log detailing for each record stored, its name, storage location, storage date, and name of the person sending the record for storage.
It is recommended that credit unions include in these procedures a method for using duplicate records to restore vital member services in the event of a catastrophic act. Credit unions which have some or all of their records maintained by an off-site data processor are considered to be in compliance for storage if the service agreement specifies the data processor safeguards against the simultaneous destruction of production and back-up information. Top |
