How long a creditor keeps ability-to-repay records

The SAFE MLO exam tests both a time period and the event that starts it. Under 12 CFR §1026.25(c)(3), a creditor retains evidence of compliance with §1026.43, the ability-to-repay provisions, for three years after consummation of a covered consumer credit transaction.

Start the clock at consummation

The three-year period runs from consummation, not the application date, loan estimate date, closing disclosure date, or the date the loan is sold. In a question asking how long ATR evidence must be retained, look for consummation as the triggering event.

Keep evidence that demonstrates compliance

The creditor needs records showing that it complied with the underwriting and verification requirements that applied to the transaction. The CFPB interpretation explains that records should be sufficient to demonstrate compliance with documentation requirements. For example, retaining only a typed income amount may be insufficient if the creditor must be able to reproduce the source document used to verify that income.

Electronic records can qualify

The rule does not necessarily require paper originals. The records may be retained in a format that accurately reproduces them. The practical test is whether the creditor can produce a reliable record of the relevant evidence when needed, not whether it kept a particular physical file format.

Do not mix up the two-year and three-year periods

Regulation Z's general rule in §1026.25(a) is generally two years after disclosures are required or action is required. Section 1026.25(c)(3) sets a special three-year period for evidence of compliance with the ability-to-repay rule. A broader loan file may have other retention obligations under other laws or company policies, but this specific exam rule is three years after consummation.

Example

If a covered mortgage transaction is consummated on October 2, 2026, the §1026.43 evidence must be retained for three years after that date. The file should permit the creditor to demonstrate the underwriting and verification steps required for that transaction.

Exam checkpoints

• Identify that the question concerns evidence of compliance with §1026.43.
• Choose three years, not the general two-year period.
• Start at consummation, not application or disclosure.
• Remember that accurate reproduction can satisfy the record format requirement.
• Retain enough source evidence to demonstrate compliance, not merely a summary where the rule requires underlying support.

Key takeaway

Ability-to-repay records: three years after consummation. The evidence must accurately demonstrate compliance, though paper originals are not always required.

The three-year clock starts at consummation

For evidence of compliance with Regulation Z §1026.43 ability-to-repay requirements, the creditor must retain records for three years after consummation of the covered consumer credit transaction. The event is consummation—not application, credit decision, Loan Estimate, Closing Disclosure, funding request, sale to an investor, or payoff. That date anchor is a common SAFE exam distinction.

This is a specific rule that differs from Regulation Z's general two-year retention period for many other compliance records. If a question asks about ATR/QM evidence, use the three-year rule and the consummation date. If it asks about a different disclosure or record, identify its own subsection instead of applying three years universally.

Evidence must demonstrate compliance

The retained materials should be sufficient to show that the creditor made the required ATR determination. Depending on the file, that may include the application and verified income, assets, employment, credit history, monthly debts, mortgage-related obligations, calculation worksheets, underwriting results, and the terms used for the repayment analysis. The rule requires evidence, not a particular named folder or paper-only format.

Electronic records can satisfy retention when they are accurately reproducible and accessible for examination. A creditor should be able to retrieve a complete, legible file that shows what was considered at origination, including the version of a calculation or policy that applied. A final approval code without supporting data may not demonstrate the actual analysis.

Retention versus other duties

The three-year evidence rule does not mean that every loan record may be destroyed immediately after that period. Other federal laws, state law, investor contracts, litigation holds, servicing rules, or agency requirements may require longer retention. Apply the longest applicable requirement and follow a documented retention schedule.

Conversely, do not assume that selling or transferring a loan ends the creditor's obligation to keep its evidence. The rule applies to the creditor that made the ATR determination; transaction agreements may allocate access or archival responsibilities but do not automatically rewrite the regulatory period.

Exam example and control check

A consumer loan consummates on March 15, 2026. The ATR evidence period runs three years after consummation, through the applicable date in March 2029 under the creditor's retention convention. The exam may ask which date starts the clock; choose consummation. For actual record destruction, confirm internal policy and any legal hold rather than calculating a date from this illustration alone.

A compliance audit should test sample files for completeness, retrieval speed, readable formats, and the ability to connect source documents to the ATR calculation. If a vendor system is being replaced, export and validate required records before migration. Retention is not effective if the archive exists but staff cannot retrieve or interpret it.

Practical review points

Retention is an evidence requirement, so a creditor should be able to reconstruct the underwriting basis after the loan closes. Preserve the application, income and asset verification, debt calculation, payment calculation, product terms, and any exception rationale in a retrievable system. The three-year period for evidence of compliance with §1026.43 is a minimum measured from consummation; litigation holds, investor rules, state law, or other federal requirements may call for longer retention. Do not destroy records just because the general two-year Regulation Z period has elapsed.

Additional application detail

The retention rule does not mean every related business record has the same destruction date. Apply the correct rule to each record category, and preserve a complete audit trail for any ability-to-repay determination or exception. A loan sale does not erase the originating creditor’s retention duty. Make sure servicing and investor transfers preserve access to records needed to answer a regulator or consumer inquiry.