On March 20, 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) published a final rule extending the recordkeeping requirements for certain transactions from five to ten years. This extension accords with legislative changes that lengthened the statute of limitations for violations under key sanctions laws, reflecting a broader effort to enhance enforcement capabilities and compliance within the U.S. sanctions framework.
Legislative Changes Leading to the Extension
The impulse for extending the recordkeeping requirements rises from the enactment of the 21st Century Peace through Strength Act on April 24, 2024. This legislation extended the statute of limitations for civil and criminal violations of the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA) from five to ten years. The extension aimed to provide enforcement agencies with a greater and broader timeframe to investigate and prosecute violations, thereby safeguarding and strengthening the overall enforcement of U.S. sanctions programs.
Provisionary Final Rule and Public Commentary
In response to the legislative changes, OFAC issued an provisional final rule on September 13, 2024, proposing to alter its Reporting, Procedures, and Penalties Regulations to extend the recordkeeping period to ten years. The interim rule invited public comments to address potential concerns and implications of the extended record retention period.
Public Feedback and OFAC’s Response
During the public comment period, OFAC received several submissions addressing various aspects of the proposed extension. Some commenters expressed support for the alignment of recordkeeping requirements with the extended statute of limitations, acknowledging the necessity for consistency in enforcement practices. On the other hand, various others raised concerns about the practical issues associated with the longer retention period, including increased storage expenditure and potential conflicts with international data protection regulations. OFAC considered these comments but proceeded with the final rule without amends, emphasizing the importance of aligning recordkeeping requirements with the extended statute of limitations to ensure effective enforcement.
Implications for Compliance Programs
The extension of the recordkeeping period necessitates that entities subject to OFAC regulations adjust their compliance programs accordingly. This includes refurbishing internal policies to guarantee that records of transactions subject to OFAC sanctions are maintained for at least ten years. Entities must assess and analyze their data management systems to accommodate the extended retention period, considering factors such as data storage capacity, security measures, and accessibility for audits or investigations.
Considerations and Problems
While the extended recordkeeping requirement bolsters enforcement capabilities, it also presents challenges for compliance. Organizations must navigate multiplied operational costs associated with data storage and management over a longer period. Additionally, entities operating globally may face conflicts between U.S. record retention requirements and foreign data protection laws, particularly in jurisdictions with robust data privacy regulations. OFAC acknowledges these challenges and has indicated that potential conflicts of law will be considered in enforcement audits and assessments.
The finalization of the rule extending OFAC’s recordkeeping requirements from five to ten years represents a major development in U.S. sanctions enforcement. By aligning and increasing record retention periods with the extended statute of limitations, OFAC aspires to magnify and enhance its ability to investigate and prosecute sanctions violations effectively. Entities subject to OFAC regulations must proactively adapt their compliance programs to meet the new requirements, balancing the need for stringent recordkeeping with the practical challenges of extended data retention.
To read more on this, click here.
