Your Sanctions Audit Trail Has to Survive a Ten-Year Lookback

At a Glance

• OFAC doubled its retention requirement from five to ten years, effective March 12, 2025, and stated that conflicting obligations elsewhere do not excuse compliance.
• The four major sanctions regimes set different clocks, and the longest applicable one governs any organization exposed to more than one.
• Retention is the easy part, while the requirement is reconstruction, showing what was known, what was decided, and on what basis, years after the fact.
• Spreadsheet-based records fail at the specific moment they are needed, because they capture the outcome and lose the evidence.
• Recording the decision inside the screening tool, or writing it into internal systems by API, means the record is created at the moment of the decision rather than assembled afterward.

OFAC Doubled the Retention Period in 2025

On March 12, 2025, OFAC’s extended recordkeeping requirement took effect, doubling the retention period for records of transactions subject to its regulations from five years to ten. The final rule followed an interim rule published in September 2024 and adopted it without change.

The driver was the statute of limitations. The 21st Century Peace through Strength Act, signed in April 2024, extended the limitations period for civil and criminal violations of IEEPA and TWEA from five years to ten. Records now have to survive as long as the exposure does.

Two details matter more than the headline number.

Blocked property runs on a separate clock. Records must be kept for as long as the property remains blocked and for ten years after it is unblocked, which in practice means indefinitely for some holdings.

OFAC addressed the conflict directly. When commenters raised the difficulty for institutions subject to EU rules built around shorter retention, OFAC made no revisions in response. A conflicting obligation elsewhere does not excuse compliance with this one.

Four Regulators, Four Different Clocks

*For general information only. Retention periods should be confirmed against the regulations and licences that apply to your own activity and against your own regulator’s requirements. Anti-Money Laundering (AML) record-keeping rules run alongside sanctions obligations in both the UK and the EU, and for many firms those rules determine how long the underlying records are held. Correct as of September 14, 2026.

Two things fall out of the comparison.

The first is that the longest applicable clock governs. An organization with U.S. nexus, EU entities, and UK licence reliance does not get to average these. It has to satisfy the strictest requirement that touches any given record.

The second is that only OFAC gives you a single timeframe. Everywhere else, the obligation is assembled from AML rules, licence conditions, and national implementing law, which means the practical answer depends on which record it is and where it sits.

The Requirement Is Reconstruction, Not Storage

Retention periods get the attention because they are quantified. They are also the easier half of the problem.

Storing a file for ten years is a technical question with a technical answer. What a regulator or auditor actually asks is different. How was this counterparty screened? What did you know at the time? Who decided to proceed? What was that decision based on?

Answering that requires the record to hold four things:

1. What was checked, meaning the counterparty, the vessel, the ownership structure, and the lists or risk models applied. 
2. When it was checked, to a date that ties to the transaction. 
3. What the check returned, including the hits that were reviewed and cleared, not only the final verdict. 
4. Who made the call, with the reasoning attached.

A record that says “screened, cleared, 14 March” tells you a decision happened. It cannot show what was known at the time or why a reasonable person acted on it, which is what reconstruction actually requires.

Spreadsheets Fail at the Moment They Are Needed

Most teams know their manual process is fragile. What is less obvious is the specific way it breaks.

A spreadsheet captures the outcome and discards the evidence. Someone runs a screening, reads the result, forms a judgment, and types “cleared” into a cell. The underlying data, the hits reviewed, the ownership structure examined, and the reasoning all stay in the tool or in the analyst’s head. Six months later, the cell is all that remains.

The gaps compound from there.

Records fragment across systems, with screening in one platform, the decision in a spreadsheet, supporting documents in email, and the transaction in the trade or freight system. Nothing links them, so reconstruction becomes a manual archaeology exercise across four sources.

Entries drift as offices apply different conventions to the same field, which is why the same vessel can appear cleared in one region and pending in another.

Clears are logged more thinly than escalations. An escalated case accumulates a file because several people touch it. A vessel reviewed and passed in two minutes leaves a line in a spreadsheet, which is the record that has to answer for it years later.

And the record decays. Ten years is long enough for the spreadsheet owner to leave, the file structure to be reorganized, and the tool that produced the original screening to be replaced.

None of this is a discipline problem. It is what happens when the audit trail is a separate task performed after the decision rather than a product of the decision itself.

Two Ways to Capture the Record at the Point of Decision

The fix in both cases is to stop treating documentation as a step.

Record the Decision Where the Screening Happens

When the analyst clears or escalates a counterparty inside the compliance tool, the decision is captured alongside the data that informed it. Risk scores, sanctions status, ownership structure, behavioral indicators, and the reviewer’s rationale are all attached to the same record, timestamped, and retained together. No one has to remember to write it down, because writing it down is the act of deciding.

Pipe it Into Internal Systems By API

Where the decision needs to live in a compliance platform, trade management system, or internal data warehouse, an API writes the screening result and the reasoning into that system automatically. This matters when the audit trail has to sit alongside the transaction record rather than in a separate compliance tool, and when internal reporting or retention policy runs on your own infrastructure.

Many organizations end up doing both. High-volume frontline screening flows into internal systems automatically. The cases that need human review are decided and documented in the compliance tool, with the reasoning captured in place.

The Duplicate Work Problem Solves Itself

There is a second benefit that has nothing to do with regulators.

When decisions live in the screening tool, the next person to look at that counterparty can see it was already reviewed, when, by whom, and what was concluded. The London desk does not redo the work the Singapore desk finished last week. A vessel rejected for a fixture in March is visible as rejected when it comes back in May, with the basis attached.

Manual records cannot do this, because a spreadsheet someone else maintains is not something you consult before starting work. It is something you discover afterward.

The compliance case for a defensible audit trail is about the regulator. The operational case is about not paying twice for the same screening.

Build the Record Where the Decision Happens

The retention period is the visible requirement, and it is the one that will be quoted to you. It is also the part your IT function can solve.

The part that decides whether an audit goes well is whether the record can still explain a decision after the people who made it have moved on. That is a question about where and to what level of detail the record is created, not how long it is kept.

Windward captures the screening decision alongside the risk data that informed it, so the reasoning, the sanctions and behavioral indicators, and the reviewer are held as one timestamped, immutable record. Where that record needs to sit in your own systems, the Windward API writes it there directly.

Written by Maya Romi, Windward Maritime Intelligence Content Specialist. Reviewed by Angela Freeth, Product Marketing Manager, Commercial.