Your Sanctions Audit Trail Has to Survive a Ten-Year Lookback

In 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) doubled the retention period for records related to its regulations. Previously, organizations had to keep records of transactions subject to OFAC's regulations for five years, but now they must keep them for ten years. This change was a response to the 21st Century Peace through Strength Act, which extended the limitations period for civil and criminal violations of the Iran Sanctions Act and the Trading with the Enemy Act from five to ten years.

Two important details emerged from this regulation. First, blocked property runs on a separate clock. This means that records must be kept for as long as the property remains blocked, and for ten years after it is unblocked. In some cases, this could mean indefinite retention. Second, when multiple governing rules exist, the longest applicable clock governs. This means that organizations with operations in multiple jurisdictions must comply with the strictest retention requirement.

The challenge of meeting this extended retention period lies not in storing the records, but in reconstructing the decision-making process behind each transaction. OFAC requires that records capture four key elements: what was checked, when the check was performed, what the check returned, and who made the final decision. A simple record that only states "screened, cleared" is insufficient, as it does not provide the necessary context for reconstruction.

Many organizations struggle to meet this requirement due to the limitations of their current systems. Manual processes often rely on spreadsheets that capture only the outcome, discarding the underlying evidence. This leads to fragmented records stored across different systems, making it difficult to reconstruct the decision-making process. When decisions are made in different tools or systems, there is often a lack of continuity and consistency in the documentation.

The solution lies in capturing the decision at the point of screening. By integrating the record-keeping process directly into the compliance tool used for screening, organizations can ensure that all relevant information is captured and retained together with the decision. This eliminates the need for manual record-keeping and reduces the risk of incomplete or inaccurate documentation.

Furthermore, integrating the audit trail with internal systems, such as trade management systems or data warehouses, ensures that the decision is visible to all relevant parties. This allows for seamless collaboration and eliminates duplicate work efforts. When a counterparty is reviewed and cleared, the decision is automatically recorded and linked to the transaction, providing a clear audit trail that can withstand scrutiny by regulators or auditors.

In conclusion, the OFAC's extended retention period of ten years is a significant requirement that organizations must adhere to. Meeting this requirement involves more than just storing records for an extended period. It requires capturing the decision-making process at the point of screening, ensuring that all relevant information is retained and linked together.

By implementing a system that integrates record-keeping directly into the compliance tool used for screening, organizations can simplify their audit trails and ensure compliance with regulatory requirements.