§ 1235.4 Minimum requirements of a record retention program.

(a) General minimum requirements. The record retention program established and maintained by each regulated entity and the Office of Finance under § 1235.3 shall: (1) Assure that retained records are complete and accurate; (2) Assure that the form of retained records and the retention period— (i) Are appropriate to support administrative, business, external and internal audit functions, and litigation of the regulated entity or the Office of Finance; and (ii) Comply with requirements of applicable laws and regulations, including this part; (3) Assign in writing the authorities and responsibilities for record retention activities for employees, including line managers and corporate management; (4) Include policies and procedures concerning record holds, consistent with § 1235.5, and, as appropriate, integrate them with policies and procedures throughout the organization; (5) Include an accurate, current, and comprehensive record retention schedule that lists records by major categories, subcategories, record type, and retention period, which retention period is appropriate to the specific record and consistent with applicable legal, regulatory, fiscal, operational, and business requirements; (6) Include appropriate security and internal controls to protect records from unauthorized access and data alteration; (7) Provide for appropriate back-up and recovery of electronic records to ensure the same accuracy as the primary records; (8) Provide for a periodic testing of the ability to access records; and (9) Provide for the proper disposition of records. (b) Minimum storage requirements for electronic records. Electronic records, preferably searchable, must be maintained on immutable, non-rewritable storage in a manner that provides for both ready access by any person who is entitled to access the records, including staff of FHFA, and accurate reproduction for later reference by transmission, printing or other means. (c) Communication and training—(1) The record retention program established and maintained by each regulated entity and the Office of Finance under § 1235.3 shall provide for periodic training and communication throughout the organization. (2) The record retention program shall: (i) Provide for communication throughout the organization on record retention policies, procedures, and record retention schedule updates; and (ii) Provide for training of and notice to all employees on a periodic basis on their record retention responsibilities, including instruction regarding penalties provided by law for the unlawful removal or destruction of records. The record retention program also shall provide for training for the agents or independent contractors of a regulated entity or the Office of Finance, as appropriate, consistent with their respective roles and responsibilities to the regulated entity or the Office of Finance.