How Long Should a Dealer Keep a Credit Application?

The Direct Answer

A dealership should keep every customer credit application, plus any adverse action notice, for at least 25 months after telling the customer the credit decision. That's the Regulation B minimum, whether the customer bought, was declined or walked. Keep it longer when state law, a lender agreement or a pending dispute requires it, then dispose of it securely on a written schedule. Most dealers don't get this wrong by keeping records too long. They get it wrong by losing them.

Which version of Regulation B applies to your store?

Regulation B implements the Equal Credit Opportunity Act (ECOA) in two versions with the same 25-month rule: the CFPB's (12 CFR 1002) and the Federal Reserve's (12 CFR 202).

Dodd-Frank Section 1029 excludes dealers predominantly engaged in selling, servicing or leasing motor vehicles from the CFPB's version, and the Federal Reserve Board keeps the rulemaking authority for them. "Motor vehicle" includes motorcycles, recreational boats and marine equipment, motor homes, recreational vehicle trailers and slide-in campers. So most powersports, marine and RV dealers follow the Fed's Regulation B. The exclusion doesn't cover every store: a dealer that finances deals itself and doesn't routinely sell the contracts to an outside lender (buy-here, pay-here) can fall under the CFPB. Either way, it's 25 months, and the clock usually starts when the customer is notified of the decision, not when the app was taken.

Where do credit apps get lost?

Here's what Param sees most often:

• Paper apps left on someone's desk, or boxed up in a back-room "dead file" nobody can search.
• Paper apps that may or may not be stored securely.
• Apps captured through a third-party website or CRM vendor, where the store doesn't know the vendor's retention policy or how to get records back out securely.
• Apps emailed to individual salespeople or F&I managers. When that person leaves and the mailbox is deleted, the apps go with it.
• Declined and walked-away apps that never make it into a deal jacket.

Two stores show how this plays out. A California dealer's website apps were simply emailed to staff, with no central, secure storage and no easy way to find one later. A Texas store filed handwritten apps only if the customer bought. Declined and walked-away apps were thrown away. "Those are exactly the records Regulation B still expects you to keep," Param says.

Paper and form-fill apps cost time on every deal: someone has to pull them, retype them and route them. Every paper copy is also one more place customer data can be seen, lost or thrown out the wrong way. A manual process is a slow process, and paper is exposure. If your store still takes paper apps, ask what's holding you back: control, habit or trust in digital?

Does the Safeguards Rule's two-year limit conflict with Reg B?

No. The FTC Safeguards Rule requires a dealer that arranges financing to dispose of customer information no later than two years after it was last used, unless it's needed for business operations, another law requires keeping it, or targeted disposal isn't reasonably feasible. Regulation B is that law for 25 months. Digital copies count: Reg B accepts records stored by computer, as long as the store can reproduce the information promptly. When records are thrown away, the FCRA Disposal Rule expects shredding or burning paper and destroying or erasing electronic media, so the information can't practicably be read or reconstructed.

Credit App Retention Checklist

After the retention period, dispose of records securely on a written schedule.

Who sends the notices you have to keep?

When an app goes to several lenders and the customer takes none of the offers, each creditor that declines it must send an adverse action notice, either directly or through a third party. A notice sent on behalf of several creditors must name each one (12 CFR 1002.9(g)). Risk-based pricing notices work differently. The FTC says the initial creditor gives the notice, even if the contract is later sold. Many dealers instead give a credit score disclosure to every customer whose score they pull, which the FTC allows as an alternative. If you're leaving these notices to your lenders, confirm in writing who sends what, and keep copies with the credit app.

Frequently asked questions

How long must a dealership keep a customer's credit application?

At least 25 months after notifying the applicant of the credit decision, under Regulation B. Business credit generally has a 12-month period. State law, a lender agreement or a pending dispute can require longer.

Do I have to keep credit apps from customers who didn't buy?

Yes. The 25 months covers applications that ended in a denial, a walk-away or an incomplete file, not only funded deals.

On an indirect deal, does the lender's copy cover me?

Don't count on it. Regulation B's retention duty applies to each creditor, and a dealer that regularly takes part in credit decisions, including setting the terms, is a creditor. The rule has no exception for apps passed to a lender. When an app goes to several lenders and another lender approves it, the 25 months runs from the date of application.

What to do this week

Param's recommendation: capture every credit app, sold, declined or walked, in one secure system, not in inboxes, on desks or in a dead-file box. Keep it at least 25 months from the date the customer is told the decision. Then dispose of it securely on a schedule. For the rest of the deal jacket, he recommends keeping all sale transaction documents for at least seven years, on a schedule your counsel signs off on.

To see where you stand, pull ten credit apps from about 24 months ago, including at least three that never funded. Try to find each one, and note where it lived. Every app you can't find is a gap. Then name one person who owns the retention schedule.

When this doesn't apply

Don't stop at 25 months when your store has notice of a government investigation, an enforcement action or an ECOA lawsuit, or when state law or a lender agreement requires longer. The 25-month rule covers the credit app and decision records, not the whole deal jacket. This article is not legal advice; have counsel review your schedule. For the wider compliance picture, see why the Safeguards Rule still applies to dealers that arrange financing and what the FTC's pricing enforcement means for your dealership.

Where ODL fits

Retention is easier when there's one place every app lands. Quick Lane captures credit applications digitally and stores them in a secure digital eVault, so sold, declined and walked apps live in the same place instead of in inboxes. Security is backed by SOC 2 Type II and an encrypted eVault. Fast Lane brings the full deal, from desk to F&I, into that same record.

See how Quick Lane keeps every credit app, sold, declined or walked, in one secure place. Book a Demo.

About the author

Param Ramakrishnan is the CEO of One Dealer Lane. He works with powersports, marine, and RV dealers to connect fragmented sales, credit, and F&I workflows into a single deal record. He writes about dealership operations, retail-finance handoffs, data quality, F&I performance, and the practical process changes that help teams move deals forward without losing accuracy or customer context.

Sources

1. 12 CFR 202.12, Record retention (Regulation B, Federal Reserve)
2. 12 CFR 1002.12, Record retention (Regulation B, CFPB) · official interpretations
3. 12 CFR 1002.1 and 1002.2, Scope and definitions (Regulation B, CFPB)
4. 12 CFR 1002.9, Notifications (Regulation B, CFPB)
5. Federal Trade Commission, "Using Consumer Reports for Credit Decisions: What to Know About Adverse Action and Risk-Based Pricing Notices"
6. 12 U.S.C. 5519, Exclusion for auto dealers (Dodd-Frank Section 1029)
7. 16 CFR 314.4, Elements (FTC Safeguards Rule)
8. 16 CFR Part 682, Disposal of Consumer Report Information and Records
9. Federal Trade Commission, "Automobile Dealers and the FTC's Safeguards Rule: Frequently Asked Questions" (June 2025)