---
kind: "section"
citation: "12 C.F.R. § 1033.441"
title: "12"
number: "1033.441"
heading: "Policies and procedures for third party record retention."
url: "https://uscodex.org/cfr/12/1033.441"
---

# §1033.441. Policies and procedures for third party record retention.

- (a) **General requirement.** A third party that is a covered person or service provider, as defined in 12 U.S.C. [5481(6)](/usc/12/5481.md?p=6) and [(26)](/usc/12/5481.md?p=26), must establish and maintain written policies and procedures that are reasonably designed to ensure retention of records that are evidence of compliance with the requirements of [subpart D](/cfr/12/subpartD.md) of this part.
- (b) **Retention period.** Records required under [paragraph (a)](#a) of this section must be retained for a reasonable period of time, not less than three years after a third party obtains the consumer's most recent authorization under [§ 1033.401(a)](/cfr/12/1033.401.md?p=a).
- (c) **Flexibility.** A third party covered under [paragraph (a)](#a) of this section has flexibility to determine its policies and procedures in light of the size, nature, and complexity of its activities.
- (d) **Periodic review.** A third party covered under [paragraph (a)](#a) of this section must periodically review its policies and procedures and update them as appropriate to ensure their continued effectiveness to evidence compliance with the requirements of [subpart D](/cfr/12/subpartD.md) of this part.
- (e) **Certain records retained pursuant to policies and procedures.** Records retained pursuant to policies and procedures required under this section must include, without limitation:
  - (1) A copy of the authorization disclosure that is signed by the consumer electronically or in writing and reflects the date of the consumer's signature and a record of actions taken by the consumer, including actions taken through a data provider or another third party, to revoke the third party's authorization; and
  - (2) With respect to a data aggregator covered under [paragraph (a)](#a) of this section, a copy of any data aggregator certification statement that was provided to the consumer pursuant to [§ 1033.431(c)(2)](/cfr/12/1033.431.md?p=c-2).

## Notes

### Authority

Authority: 12 U.S.C. 5512; 12 U.S.C. 5514; 12 U.S.C. 5533.

### Source

Source: 89 FR 90989, Nov. 18, 2024, unless otherwise noted.