How long does a financial institution have to retain the original source file or printed copies of an ACH Origination file? Does the retention period apply to third-party vendors or correspondent relationships?
The 2002 ACH Rules Book (OR 1- Subsection 1.5.1) published by NACHA states the following regarding Record Retention:Each Participating DFI (Depository Financial Institution) must retain records of all entries, including return and adjustment entries, transmitted from or to an ACH Operator. These records must be retained for six years from the date the entry was transmitted. The Participating DFI must, if requested by its customer, or any other Participating DFI or ACH Operator which originated, transmitted, or received the entry, provide the requester with a printout or reproduction of the information relating to the entry. A Participating DFI may impose a reasonable charge for the provision of such information.
The Record Retention rule does not appear to apply to a DFI's correspondent or core data processing relationship even if they have been authorized the by the DFI to be a receiving or sending agent for their ACH transactions. Data retention may be a service that a correspondent or core data processor offers to its clients; however, it is the DFI's responsibility to retain their own information. Other miscellaneous third-party service providers such as software vendors, would be exempt from the rule.