Loan file retention requirements for bank statements come from several rules at once. Regulation B keeps consumer applications 25 months after the decision, Regulation Z keeps ability to repay evidence three years after closing and the Closing Disclosure five, and state licensing rules can add more. After the longest period ends, the FTC Safeguards Rule expects the data deleted.
Federal loan file retention requirements for statements and analysis
Federal loan file retention requirements set minimums by record type, not one period per file. A single mortgage file can hold records under three different clocks. A lender either keeps each record for its own period or keeps the whole file for the longest one, which on a closed consumer mortgage is the five-year Closing Disclosure period.
The table below lists the common federal periods. The example column shows how a lender might apply them to a bank statement file. It is an example, not legal advice, and it assumes no state rule or investor contract sets a longer period.
| Loan file record | Rule | Federal minimum | Example period applied |
|---|---|---|---|
| Consumer credit application, statements and other information used to evaluate it | Regulation B, 1002.12(b)(1) | 25 months after notice of action taken | Kept with the file for the longest period that applies |
| Adverse action notice and statement of reasons | Regulation B, 1002.12(b)(1) | 25 months after notice | Same as the application |
| Business credit application, business with revenue of $1 million or less | Regulation B, 1002.12(b) | 12 months after notice | 12 months, or longer if a state rule applies |
| Business credit application, business with revenue over $1 million | Regulation B, 1002.12(b)(5) | 60 days, or 12 months if the applicant asks in writing | 12 months, to keep one schedule |
| Other Regulation Z disclosure records | Regulation Z, 1026.25(a) | 2 years | Kept with the rest of the file |
| Loan Estimate and other evidence of compliance with 1026.19(e) and (f) | Regulation Z, 1026.25(c)(1) | 3 years after consummation | 3 years after closing |
| Closing Disclosure | Regulation Z, 1026.25(c)(1)(ii) | 5 years after consummation | 5 years after closing |
| Ability to repay evidence: statements, income worksheet, debt records | Regulation Z, 1026.25(c)(3) | 3 years after consummation | 3 years after closing |
The Regulation B periods come from the CFPB's text of section 1002.12. The Regulation Z periods come from the CFPB's text of section 1026.25.
Analysis output counts as part of the record. Under Regulation B, the file keeps "other information used in evaluating the application," and a statement analysis report showing average deposits and flagged transactions is exactly that. The same goes for supporting letters. A CPA letter on a bank statement loan that confirmed the business or set the expense factor is evidence the income was verified, so it stays as long as the income worksheet.
How long should a declined loan file keep its bank statements?
A declined loan file keeps its bank statements for 25 months after the lender notifies the applicant, when the application was for consumer credit. Regulation B's clock starts at the notice of action taken, or at the notice of incompleteness. A declined business application keeps them 12 months under the general business credit rule.
Declined and withdrawn files are where retention schedules break. The file never reached closing, so it never entered the closed-loan archive. It may sit in an email inbox or a shared drive with no deletion date at all. The fix is to start the retention clock at the decision date, in the same system that holds funded files.
The signed consent the borrower gave to pull or review account data belongs in the file too. The guide to the borrower authorization form for bank statement access covers what that form says and how long it lasts.
Do state licensing rules lengthen loan file retention?
State licensing rules often lengthen loan file retention. Mortgage lender and broker licenses, consumer lending licenses and some commercial financing registrations carry their own record-keeping sections. When a state period is longer than the federal one, the lender keeps the file for the state period.
Each state writes its own period and its own starting point, so a schedule copied from one state can be wrong in the next. A lender licensed in several states should look up each one and build a schedule on the longest period that touches the file. Investor and warehouse contracts can add more time again, and they should go into the same schedule.
Retention holds that freeze the loan file deletion schedule
A retention hold suspends normal deletion for every record tied to a matter. Regulation B section 1002.12 says a creditor that has notice of an investigation or enforcement proceeding, or that has been served with notice of an ECOA lawsuit, keeps the records until final disposition of the matter, unless an agency or court allows earlier disposal.
A hold has to reach every copy, not just the loan file. That includes statements in the upload portal, attachments in the processor's inbox, and exported analysis reports. A hold that only flags the loan origination system leaves the other copies on their normal deletion schedule, and they may be gone before anyone notices.
Lift the hold in writing when the matter closes, then return the records to their schedule.
Deleting bank statement data when the retention period ends
Bank statement data should be deleted when the longest retention period ends. The FTC Safeguards Rule, which covers nonbank lenders and mortgage brokers, requires procedures for secure disposal of customer information in any format, generally no later than two years after the last date the information is used.
The Cornell LII text of 16 CFR 314.4 allows exceptions. Data can be kept longer when it is needed for business operations, when another law requires it, or when targeted disposal is not reasonably feasible because of how the data is stored. The same section requires a periodic review of the retention policy to cut unnecessary retention.
So the two rules work together. The retention rules set how long the statements must stay. The disposal rule says they should not stay much longer than that without a reason.
Disposal is easier when the statements live in one place. Email attachments copy themselves into every reply, while a portal keeps one controlled copy. The case for a secure document upload portal for lenders rests partly on that. In TrueBankFlow, a lending team chooses how long statement files are kept after a report is exported, which turns the schedule into a setting rather than a reminder. Get started with TrueBankFlow.
Keep a log of what was deleted and when. A deletion record with the file number and date proves the schedule was followed, without keeping the statements themselves.