12 C.F.R. § 1002.12

(a) Retention of prohibited information. A creditor may retain in its files information that is prohibited by the Act or this part for use in evaluating applications, without violating the Act or this part, if the information was obtained:

(1) From any source prior to March 23, 1977;

(2) From consumer reporting agencies, an applicant, or others without the specific request of the creditor; or

(3) As required to monitor compliance with the Act and this part or other Federal or state statutes or regulations.

(b) Preservation of records— (1) Applications. For 25 months (12 months for business credit, except as provided in paragraph (b)(5) of this section or otherwise provided for in subpart B of this part) after the date that a creditor notifies an applicant of action taken on an application or of incompleteness, the creditor shall retain in original form or a copy thereof:

(i) Any application that it receives, any information required to be obtained concerning characteristics of the applicant to monitor compliance with the Act and this part or other similar law, any information obtained pursuant to § 1002.5(a)(4), and any other written or recorded information used in evaluating the application and not returned to the applicant at the applicant's request.

(ii) A copy of the following documents if furnished to the applicant in written form (or, if furnished orally, any notation or memorandum made by the creditor):

(A) The notification of action taken; and

(B) The statement of specific reasons for adverse action; and

(iii) Any written statement submitted by the applicant alleging a violation of the Act or this part.

(2) Existing accounts. For 25 months (12 months for business credit, except as provided in paragraph (b)(5) of this section or otherwise provided for in subpart B of this part) after the date that a creditor notifies an applicant of adverse action regarding an existing account, the creditor shall retain as to that account, in original form or a copy thereof:

(i) Any written or recorded information concerning the adverse action; and

(ii) Any written statement submitted by the applicant alleging a violation of the Act or this part.

(3) Other applications. For 25 months (12 months for business credit, except as provided in paragraph (b)(5) of this section or otherwise provided for in subpart B of this part) after the date that a creditor receives an application for which the creditor is not required to comply with the notification requirements of § 1002.9, the creditor shall retain all written or recorded information in its possession concerning the applicant, including any notation of action taken.

(4) Enforcement proceedings and investigations. A creditor shall retain the information beyond 25 months (12 months for business credit, except as provided in paragraph (b)(5) of this section or otherwise provided for in subpart B) if the creditor has actual notice that it is under investigation or is subject to an enforcement proceeding for an alleged violation of the Act or this part, by the Attorney General of the United States or by an enforcement agency charged with monitoring that creditor's compliance with the Act and this part, or if it has been served with notice of an action filed pursuant to section 706 of the Act and § 1002.16 of this part. The creditor shall retain the information until final disposition of the matter, unless an earlier time is allowed by order of the agency or court.

(5) Special rule for certain business credit applications. With regard to a business that had gross revenues in excess of $1 million in its preceding fiscal year, or an extension of trade credit, credit incident to a factoring agreement, or other similar types of business credit, the creditor shall retain records for at least 60 days, except as otherwise provided for in subpart B, after notifying the applicant of the action taken. If within that time period the applicant requests in writing the reasons for adverse action or that records be retained, the creditor shall retain records for 12 months.

(6) Self-tests. For 25 months after a self-test (as defined in § 1002.15) has been completed, the creditor shall retain all written or recorded information about the self-test. A creditor shall retain information beyond 25 months if it has actual notice that it is under investigation or is subject to an enforcement proceeding for an alleged violation, or if it has been served with notice of a civil action. In such cases, the creditor shall retain the information until final disposition of the matter, unless an earlier time is allowed by the appropriate agency or court order.

(7) Prescreened solicitations. For 25 months after the date on which an offer of credit is made to potential customers (12 months for business credit, except as provided in paragraph (b)(5) of this section or otherwise provided for in subpart B), the creditor shall retain in original form or a copy thereof:

(i) The text of any prescreened solicitation;

(ii) The list of criteria the creditor used to select potential recipients of the solicitation; and

(iii) Any correspondence related to complaints (formal or informal) about the solicitation.