OFAC recordkeeping: plan retention and retrieve screening evidence

Match the legal duty to the record you need

OFAC's March 2025 rule extended certain recordkeeping requirements from five to ten years. Ask the responsible legal and records team which records, period and starting event apply to your activity. Do not assume that every name search starts the same legal clock.

SanctionsKit retention settings control product records. They do not decide the legal requirement or preserve original files kept in another service. Plan those records together before relying on a later export.

Choose retention before submitting the screening

Dashboard, batch and monitoring workflows use standard retention. API clients use retention: standard when the result must support dashboard review. Check your actual workspace settings; older records may have different retained terms.

Minimal retention is a limited option for single-subject API screenings. It omits the subject, keeps reduced evidence for 24 hours and does not create a case. It is not suitable when the team needs to replay a full review. See the retention reference. 

Record the event that starts the configured period

A policy can start its retention clock at review completion, relationship end or another business event. Open Evidence retention and holds to see the trigger and deadline saved for the record. An admin records any required event with its date and reason.

Where policy requires both case closure and a business event, the later date starts the period. For example, closing a review does not also prove that the customer relationship ended. An open review can protect evidence still held by the system. It cannot bring back an expired record.

Keep original documents and holds in the right place

Add your approved file store in Settings → Organization documents. Upload originals there, then link the file and version in the case. Say where it came from and how it was checked. SanctionsKit saves the reference; it does not fetch, copy or verify the original.

An owner or admin can use Add retention hold. Give the reason and end date, or use a hold without an end date where appropriate. This protects case evidence that is still available. Apply any needed hold in the external file service too.

Retrieve the complete evidence package

Use Screening history, GET /api/v1/results/{id} or GET /api/v1/results/{id}/evidence for retained results. A case audit packet may have more than one archive segment. Download every segment until complete=true.

Check that the right reviewers can still open the linked files. An export helps explain what was checked and decided; it is not a signed, tamper-proof certificate or proof that every legal duty was met.

Plan exports before records expire

An expired result can return 410. A later hold cannot restore it. Stopping a monitor, closing a case and deleting evidence are different actions, so check the actual retention state before assuming a record is protected.

Before account closure or migration, export required evidence while available and verify it in approved storage. Keep result, case and external document IDs connected so the next reviewer can follow the work.

Frequently asked questions