What are the record retention rules for lock boxes in Illinois, including customer’s statements, logs, and any other type of information related to the lock box? Also, what are the record retention requirements for email, either between bank staff and customers, or internally among bank staff related to a transaction?

Disclaimer: The Electronic Commerce Security Act (ECSA) was repealed and replaced with the Uniform Electronic Transaction Act (UETA), effective June 25, 2021. Please note that this change may affect the continued accuracy of this guidance as it pertains to the ECSA.

We are not aware of any specific legal requirements in Illinois that apply to the retention of lock box statements, logs, or other related documentation. Although the Illinois Banking Act mandates the Commissioner of Banks to promulgate record retention rules, no such rules have been published.

However, the statute of limitations for written contracts in Illinois is ten years. Consequently, we recommend retaining any lock box contracts for ten years after the termination of the contracts. This retention period should also be applied to any document, including email correspondence, that may be relevant to a dispute over a lock box contract.

For other lock box records, the IBA’s Record Retention Manual, last revised in 2014, suggests a retention period of five years. The FinCEN’s Bank Secrecy Act rules also require banks to retain any identifying information required by their Customer Identification Program (CIP) regulations for five years after a lock box account is closed or becomes dormant.

The retention period for transaction-specific email correspondence depends on the content of the message and the parties involved. Under the SEC rules, broker-dealers must retain electronic communications with customers and those that relate to their business for a least three years. In addition, the FinCEN’s Bank Secrecy Act rules require a five-year retention period for copies of requests or instructions (which may be received via email) regarding certain transfers of funds in excess of $10,000 when sent to or from parties outside the United States.

As previously mentioned, due to Illinois’ ten-year statute of limitations on written contracts, we recommend retaining any email correspondence that may be relevant to a dispute over a contract for ten years after the contract’s termination. For other email correspondence, the IBA’s Record Retention Manual generally recommends retaining email correspondence related to a customer deposit or loan account for five years and destroying non-sensitive or inconsequential emails at the bank’s discretion.

Finally, we note that both Illinois and federal law provide that an electronic copy of a document cannot be denied legal effect, validity, or enforceability solely because it is in electronic form (except for certain documents, such as wills and trusts). All of the documents mentioned in our answer may be retained electronically; you are not required to maintain paper copies of such records.

For resources related to our guidance, please see:

Illinois Code of Civil Procedure, 735 ILCS 5/13-206 (Actions on written contracts “shall be commenced within 10 years next after the cause of action accrued; but if any payment or new promise to pay has been made, in writing . . . within or after the period of 10 years, then an action may be commenced thereon at any time within 10 years after the time of such payment or promise to pay.”)

IBA Guide to Bank Record Retention 2013-14 (Lock Box in Safe Deposit, Recommendation: 5 years, 31 CFR 1020.100)

FinCEN Regulations, 31 CFR 1020.220(a)(3)(ii) (“The bank must retain the information in paragraph (a)(3)(i)(A) of this section for five years after the date the account is closed or, in the case of credit card accounts, five years after the account is closed or becomes dormant. The bank must retain the information in paragraphs (a)(3)(i)(B), (C), and (D) of this section for five years after the record is made.”)

FinCEN Regulations, 31 CFR 1020.100(a)(1) (“For purposes § 1020.220: . . . Account means a formal banking relationship established to provide or engage in services, dealings, or other financial transactions including a deposit account, a transaction or asset account, a credit account, or other extension of credit. Account also includes a relationship established to provide a safety deposit box or other safekeeping services, or cash management, custodian, and trust services.”)

SEC Rules, 17 CFR 240.17a-4(b)(4) (“Every member, broker and dealer subject to § 240.17a–3 shall preserve for a period of not less than three years, the first two years in an easily accessible place: . . . Originals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer (including inter-office memoranda and communications) relating to its business as such, including all communications which are subject to rules of a self-regulatory organization of which the member, broker or dealer is a member regarding communications with the public.”)

SEC Rules, 17 CFR 240.17a-3(a) (“Every member of a national securities exchange who transacts a business in securities directly with others than members of a national securities exchange, and every broker or dealer who transacts a business in securities through the medium of any such member, and every broker or dealer registered pursuant to section 15 of the Securities Exchange Act of 1934, as amended, . . . . shall make and keep current the following books and records relating to its business: . . .”)

FinCEN Regulations, 31 CFR 1010.410(b) (“Each financial institution shall retain either the original or a copy or reproduction of each of the following: . . . A record of each advice, request, or instruction received or given regarding any transaction resulting (or intended to result and later canceled if such a record is normally made) in the transfer of currency or other monetary instruments, funds, checks, investment securities, or credit, of more than $10,000 to or from any person, account, or place outside the United States.”)

FinCEN Regulations, 31 CFR 1010.410(c) (“A record of each advice, request, or instruction given to another financial institution or other person located within or without the United States, regarding a transaction intended to result in the transfer of funds, or of currency, other monetary instruments, checks, investment securities, or credit, of more than $10,000 to a person, account or place outside the United States.”)

FinCEN Regulations, 31 CFR 1010.430(d) (“All records that are required to be retained by this chapter shall be retained for a period of five years.”)

IBA Guide to Bank Record Retention 2013-14 (Correspondence Email (regarding customer deposit or loan account): 5 years, Recommendation by Author)

Electronic Commerce Security Act, 5 ILCS 175/5-110 (“Information, records, and signatures shall not be denied legal effect, validity, or enforceability solely on the grounds that they are in electronic form.”)

Financial Institutions Electronic Documents and Digital Signature Act, 205 ILCS 705/10(a) (“If in the regular course of business, a financial institution possesses, records, or generates any document, representation, image, substitute check, reproduction, or combination thereof . . . that accurately reproduces, comprises, or records the agreement, transaction, act, occurrence, or event . . . [it] shall have the same force and effect under the laws of this State as one comprised, recorded, or created on paper or other tangible form by writing, typing, printing, or similar means.”)

Electronic Signatures in Global and National Commerce (ESIGN) Act, 15 USC 7001(a)(1) (“A signature, contract, or other record . . . may not be denied legal effect, validity, or enforceability solely because it is in electronic form.”)