Guides
Reg B record retention requirements for lenders
What the retention periods are
Under Regulation B (12 CFR Part 1002.12), the standard retention period for consumer credit is 25 months from the date the creditor notifies the applicant of the action taken. For business credit, the standard period is 12 months from the date of the action. The records that must be retained include: the application itself (or a record of the information on which the decision was based), any adverse action notice sent, and any written statements submitted by the applicant in connection with the application.
These are minimums, not maximums. Lenders subject to additional regulatory oversight — including those under state money transmitter licenses or examination by the CFPB — may face longer retention requirements under other rules. Fair lending risk management also argues for retaining records long enough to defend decisions if a discrimination complaint is filed, which can happen years after the decision.
What examiners look for
Examiners conducting fair lending reviews look for a complete, organized record of each application, the decision made, the basis for that decision, and timely adverse action notices where applicable. A common finding is that the record of the 'basis for the decision' is thin — particularly when automated scoring or external data sources were used. If a model score drove the decision, the score, the model's output, and the inputs used should be part of the retained record.
When AI or algorithmic tools are involved, examiners increasingly expect the retained record to support an explanation of the reasons for the outcome. 'The system said no' is not a complete retained record. The lender must be able to reconstruct why the decision was made from the retained materials.
How Hadrian handles retention
Every case event in Hadrian — application intake, document uploads, decision events, notices, and reviewer actions — is written to a tamper-evident audit ledger with an immutable timestamp. Operators can configure retention policies and retrieve the full case record for any application. Because the evidence graph links each decision to the specific documents and inputs reviewed, the record supports the kind of reconstructed decision narrative examiners look for.
Hadrian's infrastructure supports retention; it does not determine the legal sufficiency of the records for any specific lender's regulatory obligations. Operators are responsible for ensuring that the information captured at intake and during the decision process is complete enough to satisfy their specific retention and examination requirements.
FAQ
Reg B record retention requirements — common questions
Does Reg B retention apply to withdrawn or incomplete applications?
Yes. Regulation B requires retention of records for incomplete applications and applications that are withdrawn by the applicant, not just denied applications. The 25-month clock generally runs from the date of the action or the date the creditor provides notice of incompleteness.
Are electronic records acceptable under Reg B?
Yes, the CFPB has confirmed that electronic records satisfy the Reg B retention requirement if they accurately reproduce the original and can be produced for examination. The recordkeeping system should produce legible, complete records and have controls to prevent unauthorized alteration.
The institution around the intelligence
See Hadrian run your case lifecycle — intake to close, every decision audited.
Governance-native case processing for lenders and regulated teams.