BICUC

Record Retention: How Are Other Institutions Handling This?

Hi everyone—
I’m interested in learning how record retention is structured across different banks and credit unions, particularly from a facilities and operational support perspective. I’d love to hear how your organization approaches the following:

• Ownership:
  Who owns record retention in your organization (Facilities, Compliance, Legal, Risk, Operations, or a shared model)?

• Storage model:
  Do you manage records in‑house, or do you outsource storage and destruction to vendors such as Iron Mountain or another records management provider?
  If hybrid, how do you determine what stays onsite vs. offsite?

• Tracking & destruction:
  How do you track records, retention periods, and destruction dates (e.g., spreadsheets, barcoding, vendor portals, internal systems)?

• Keeping the schedule current:
  How do you ensure your record retention schedule stays up to date with regulatory changes and business needs?
  Is there a formal annual review process, and who is responsible for driving updates?

I’m particularly interested in practical lessons learned—what’s working well, what you’ve changed over time, and any pitfalls to avoid.

Thanks in advance for sharing your experiences.