Compliance Record Retention: A Forwarder's Guide

When CBP sends an audit notification, the first thing they request is documentation. Not explanations, not process narratives — records. The freight forwarders that navigate audits without significant penalties share one trait: a compliance record retention system that produces the right documents, in the right format, within the required timeframe.

That sounds straightforward. In practice, most forwarders discover their gaps only when someone asks for records they assumed they had. With audit activity accelerating and enforcement agencies looking back five to ten years, the difference between a manageable review and a six-figure penalty often comes down to documentation you kept — or didn’t.

This guide covers what records you must retain, how long each regulatory agency requires you to keep them, and how to structure your compliance documentation so an audit is an inconvenience — not a crisis.

Retention Periods: What Each Agency Requires

Freight forwarders operating in international trade answer to multiple regulatory bodies, each with its own retention rules. The challenge is that a single shipment can fall under several of them simultaneously — and the retention clocks don’t align.

CBP: Five Years from Entry

Under 19 CFR § 163.4, importers and their agents must retain entry records for five years from the date of entry. For freight forwarders acting as customs brokers, this includes:

Entry summaries (CBP Form 7501)
Commercial invoices
Packing lists
Bills of lading (master and house)
Certificates of origin
Powers of attorney
Correspondence related to customs transactions

The five-year window is measured from the date of entry, not the date the document was created. A shipment that entered in January 2024 carries a retention obligation through January 2029 — regardless of when you filed the entry summary or received the final invoice.

What catches forwarders off guard: CBP doesn’t just want the documents. Under 19 CFR § 163.5, you must produce them in a “usable” format — organized, legible, and retrievable. A storage room of unsorted boxes technically contains the records but doesn’t satisfy the requirement.

BIS: Five Years from Export

The Bureau of Industry and Security requires exporters and their agents to retain export records for five years from the date of export, re-export, or transfer under 15 CFR § 762.6. This covers:

Export licenses and license exceptions
Electronic Export Information (EEI) filings
Correspondence with BIS
Records of denied party screening results
End-use certificates and end-user statements

For freight forwarders handling exports, the obligation applies even if you’re not the exporter of record. If you arranged the logistics, your screening records and export documentation fall under this requirement.

OFAC: Ten Years

The Office of Foreign Assets Control imposes the longest retention requirement at ten years under 31 CFR § 501.601. This covers all records related to transactions with sanctioned parties, blocked property, and compliance screening.

For forwarders, this means your denied party screening logs — every screening result for every shipment — must be retained for a full decade. If you screened a consignee in 2024 and an OFAC investigation reaches back to that shipment in 2033, you need the documentation showing you performed the screening and what the result was.

FMC: Three to Five Years

Licensed Ocean Transportation Intermediaries (OTIs) — including NVOCCs and ocean freight brokers — must retain records under 46 CFR § 515.31. The FMC requires retention of tariff records, service contracts, bills of lading, and financial records related to ocean transportation.

The Overlap Problem

A single ocean import shipment can trigger retention obligations under CBP (you handled customs entry), OFAC (you screened the parties), and FMC (you’re a licensed OTI). Each agency’s clock starts on a different date — entry date, transaction date, export date — and runs for a different period.

The practical rule: retain everything associated with a shipment for the longest applicable period. For most forwarders handling both imports and exports with any screening obligation, that means ten years — OFAC’s window — is the de facto minimum.

Which Documents Must a Freight Forwarder Retain?

The regulatory citations above define the floor. A defensible compliance file goes further. Here’s what belongs in a complete shipment compliance record:

Transaction documents:

Master and house bills of lading
Commercial invoices (all versions, including amendments)
Packing lists
Certificates of origin and preferential trade documentation
Entry summaries and customs declarations
Export declarations (EEI)
Arrival notices and delivery orders

Compliance-specific records:

Denied party screening results — with timestamp, parties screened, lists checked, and match/no-match outcome
HS code classification decisions and supporting rationale
Customs valuation calculations and supporting documentation
Export license determinations (NLR, license exception, or license number)
End-use and end-user verification records

Process documentation:

Client powers of attorney and authorization letters
Correspondence with customs authorities, carriers, and clients
Amendment and correction records — every change, who requested it, when, and why
Internal review and approval records
Pre-alert documentation and filing confirmations

What most forwarders miss: correction and amendment trails. If a commercial invoice was revised after initial filing, you need both versions plus the correspondence explaining the change. A correction without context looks like an attempt to cover a mistake — exactly the kind of pattern that elevates a negligence finding to gross negligence during an audit.

Where Forwarder Liability Diverges from Importer Liability

Freight forwarders aren’t importers of record. But that distinction doesn’t shield you from record-keeping obligations — it creates a separate set of them.

Licensed customs brokers operate under 19 CFR Part 111, which imposes specific record-keeping duties beyond the general import requirements. Section 111.23 requires brokers to retain records of each customs transaction for five years, including all correspondence, powers of attorney, and records of financial transactions. Failure to maintain these records can result in suspension or revocation of your broker license — a business-ending consequence that goes well beyond financial penalties.

NVOCCs and ocean freight brokers licensed by the FMC face their own obligations. A licensed OTI must keep records sufficient to demonstrate compliance with tariff filing and financial responsibility requirements. When the FMC audits a forwarder’s operations, they examine your records, not your client’s.

The reasonable care standard is where documentation matters most. CBP evaluates whether an importer or their agent exercised “reasonable care” in making entry. Your documentation is the evidence that you did. If a classification turns out to be wrong, the question becomes: what steps did you take to get it right? What records demonstrate those steps?

A forwarder who can produce the classification decision file — showing who made the determination, what references they consulted, and when it was last reviewed — demonstrates reasonable care. A forwarder who can only produce the classification itself, with no supporting trail, has a much harder case to make.

When a client’s audit reaches your files. If CBP audits your client and finds issues with entries you handled, their next step is often to request records from the broker or forwarder. Your retention system needs to produce those records on the same timeline — regardless of when the shipment moved.

Five Record-Keeping Failures That Create Exposure

Based on enforcement patterns and audit outcomes, these are the record-keeping gaps that most frequently escalate penalties:

1. Records exist but can’t be retrieved. CBP auditors don’t wait indefinitely. If you need weeks to locate documents that should be at your fingertips, it signals a compliance program that isn’t functioning. Under 19 USC § 1509, failure to produce requested records can result in monetary penalties and adverse inferences — meaning CBP may assume the missing records would have shown non-compliance.

2. Missing amendment and correction trails. Every entry goes through corrections. The problem arises when you can produce the final version of a document but not the original — or the correspondence that explains why it changed. During an audit, unexplained changes look worse than the original error.

3. No documentation of screening results. You performed denied party screening on every shipment. But if you didn’t log the results — which lists you checked, when, what names were screened, and the outcome — you can’t prove it happened. Under OFAC enforcement, the burden of demonstrating compliance falls on you, not on the regulator.

4. Email as the document management system. Many forwarders store critical compliance documents — rate confirmations, amendment requests, classification discussions — exclusively in email. Email is searchable when the person who handled the transaction still works for you. When they leave, those records become effectively inaccessible, even if they technically still exist on a server somewhere.

5. Assuming the client’s records substitute for yours. Your client has a complete file. That’s their file, not yours. If your customs broker license comes under review, or if you’re named in an enforcement action, you need your own independent records. “The importer has it” is not a compliance position.

How to Build a Compliance Record Retention System

A retention system doesn’t need to be complex. It needs to be consistent, retrievable, and aligned with the longest applicable retention period.

Organize by shipment reference with regulatory cross-indexing. Every document should be findable by shipment number, entry number, and bill of lading number. When CBP requests all records related to a specific entry, your system should produce the complete file — not require someone to search across multiple folders, drives, or platforms.

Default to the longest retention period. If you handle exports subject to BIS oversight and perform OFAC screening, your baseline retention period is ten years. Don’t create separate schedules for different document types unless you’re certain about which documents fall under which agency. A single conservative retention period eliminates the risk of destroying records too early.

Define the document lifecycle. Every record should follow a clear path:

Intake — how documents are captured and filed at time of shipment
Active retention — where documents live during the shipment lifecycle
Archive — where they move after shipment completion, and in what format
Disposition — when and how records are destroyed after the retention period expires

Automate what you can. Retention period tracking, archive reminders, and completeness checks shouldn’t depend on someone remembering to run a manual review. An integrated system that ties document storage to shipment records closes the gap between “we have the document somewhere” and “here it is.”

Run quarterly completeness audits. Pick 10–15 shipments at random each quarter and verify the compliance file is complete. This serves two purposes: it identifies gaps before an auditor does, and it creates a documented pattern of self-monitoring — exactly the evidence that supports a “reasonable care” defense if your records are ever challenged.

Frequently Asked Questions

How long must freight forwarders retain customs records?

The retention period depends on which regulatory agencies have jurisdiction over your activities. CBP requires five years from the date of entry under 19 CFR § 163.4. BIS requires five years from the date of export under 15 CFR § 762.6. OFAC requires ten years for screening and sanctions-related records under 31 CFR § 501.601. Most forwarders handling both imports and exports should default to whichever period is longest — typically OFAC’s ten years.

What happens if you can’t produce records during a CBP audit?

Failure to produce requested records can result in penalties under 19 USC § 1509, including monetary fines and adverse inferences — meaning CBP may assume the missing records would have shown non-compliance. For licensed customs brokers, repeated failures to maintain records can lead to license suspension or revocation under 19 CFR Part 111.

Do digital records satisfy CBP retention requirements?

Yes. CBP accepts electronic records under 19 CFR § 163.5 as long as they are complete, legible, and retrievable within a reasonable timeframe. Records must be maintained in the format in which they were originally created or in a format that accurately reproduces the original. Paper-to-digital conversion is acceptable if the digital version preserves all information from the original document.

What is a CBP Focused Assessment?

A Focused Assessment is CBP’s primary audit methodology for evaluating an importer’s internal controls and compliance systems. It begins with a risk assessment of your entry data, followed by detailed examination of your processes, records, and controls. The audit team requests specific records within defined timeframes and evaluates whether your compliance program functions as documented — not just whether it exists on paper.

How does OFAC’s 10-year retention differ from CBP’s 5-year rule?

OFAC’s requirement under 31 CFR § 501.601 covers all records related to sanctions compliance — including denied party screening results, blocked property reports, and transactions involving sanctioned parties or jurisdictions. The ten-year window means screening logs from a routine shipment may need to be retained five years after the corresponding customs records have passed their CBP-mandated retention period. Managing both timelines requires either tracking each separately or defaulting to the longer period.

How Tier2 Cargo Centralizes Compliance Documentation

The record-keeping challenges described above share a root cause: compliance documents live in too many places. Bills of lading in one system, screening logs in another, correspondence in email, classification decisions in someone’s head.

Tier2 Cargo ties compliance documentation to the shipment lifecycle. When a shipment moves through the system — from quote to customs clearance to settlement — the associated documents are captured and indexed against the shipment record. Classification decisions, screening results, and correspondence stay with the shipment file, not scattered across disconnected platforms.

The system’s AI document extraction captures data from bills of lading, invoices, and other trade documents automatically, creating a structured record that’s searchable by any reference number — shipment, entry, or B/L. For forwarders managing compliance across import, export, and NVOCC operations, a single system of record reduces the gap between “we did the compliance work” and “here’s the documentation that proves it.”

See how it works or book a walkthrough.

What Your Records Say About Your Program

Compliance record retention isn’t a filing exercise. It’s the evidence trail that tells regulators whether your compliance program actually functions — or just exists on paper. Every screening log, every classification rationale, every corrected invoice tells part of that story. With enforcement activity at current levels, the question isn’t whether you’ll need to produce these records. It’s when. Build the system now, and that question answers itself.