Record keeping requirements for cross-border and virtual currency transfers: what to keep and for how long

Record keeping requirements for cross-border and virtual currency transfers oblige an MSB or bank to retain, for each transfer, the identity of the parties, the details of the transaction, the screening and approval evidence and the settlement proof, and to keep those records for at least five years in a form that can be produced to a regulator on request. In the United States the FinCEN recordkeeping and travel rules apply from USD 3,000; in Canada the FINTRAC record keeping rules for electronic funds transfers and virtual currency transfers apply from CAD 1,000 with additional obligations at higher thresholds. This article sets out what to keep, for how long, in what form, how the transaction hash and the ISO 20022 message fit together, and how to produce records when asked.

Which records must an MSB or bank keep for a cross-border transfer?

The core record for any cross-border transfer is the funds transfer record. Under the FinCEN recordkeeping rule, for a transmittal of funds of USD 3,000 or more, the transmittor's institution must retain the name and address of the transmittor, the amount, the execution date, any payment instructions, the identity of the recipient's institution and, where received, the recipient's name, address and account number. The recipient's institution keeps the equivalent from its side. The travel rule then requires that this information travel with the payment to the next institution. In Canada, an MSB that sends an electronic funds transfer of CAD 1,000 or more must keep a record that includes the requester's name, address, date of birth and occupation or business, the amount and currency, the beneficiary details and the exchange rate applied, and there are equivalent records for transfers received.

Beyond the transfer itself, the file must contain the identification record for the customer, including how identity was verified and when, the beneficial ownership record for an entity customer, the risk assessment, and any report filed in connection with the transaction, whether a large transaction report, a Travel Rule record, a currency transaction report or a suspicious report. An examiner asking for a sample transaction expects to see all of these produced together, not the payment record alone.

What additional records apply to virtual currency transfers?

Canada's regime is the more prescriptive of the two. Since June 2021 a reporting entity that exchanges, transfers or receives virtual currency of CAD 1,000 or more must keep a virtual currency transaction record and a virtual currency transfer record. Those records include the date and amount of the transfer, the type of virtual currency, the exchange rate used to convert to Canadian dollars and its source, the sending and receiving addresses, the names and addresses of the requester and beneficiary, and the reference or transaction identifier. Where an amount of CAD 10,000 or more is received, a large virtual currency transaction report is filed and a copy of that report is kept. In the United States, FinCEN treats convertible virtual currency transfers by money transmitters as transmittals of funds subject to the same recordkeeping and travel rules as fiat, and expects the virtual currency address and transaction identifier to be retained as the equivalent of an account number and reference.

• Keep the transaction hash for every on-chain leg, together with the block identifier or timestamp and the network on which it settled, because the same token exists on multiple chains.
• Keep both wallet addresses and record which party controls each, including whether an address was hosted at a VASP or self-hosted, since that determination drives the Travel Rule treatment.
• Keep the wallet screening result at the time of the transfer, including the tool, the risk category and the date, because address risk changes later and the record must show what was known when the decision was made.
• Keep the fiat equivalent, the exchange rate and the source of the rate for each transfer, since both FINTRAC reporting and internal reconciliation depend on it.
• Keep the Travel Rule payload sent or received in IVMS101 form, or a record of why it was not required, so that the counterparty exchange can be demonstrated.
• Keep the customer-facing confirmation and any pacs.002 status report or pacs.004 return associated with the transfer, so that the full lifecycle is reconstructable.

How long must records be retained, and from when?

Five years is the baseline that both major regimes share, but the start date differs by record type and the institution should hedge by jurisdiction. Under the US Bank Secrecy Act, funds transfer records are retained for five years from the date of the transaction, and SAR filings and their supporting documentation for five years from the date of filing. Under Canada's regulations, most transaction records are retained for at least five years from the date the record was created, identification records for at least five years from the date the last business transaction was conducted or the account was closed, and copies of reports for five years from the date the report was made. Some other jurisdictions apply longer periods, and where an institution operates in several it should adopt the longest applicable period as its default rather than manage a schedule per record type.

A practical detail examiners test is the deletion policy. A retention policy of at least five years is compliant; a retention policy of exactly five years followed by automatic deletion may destroy a record that a later investigation or litigation hold required. The institution should record the retention decision per record class, apply legal holds that suspend deletion, and keep a log of what was deleted and when.

In what form should records be kept?

Both regimes accept electronic records provided they are readable, retrievable and can be produced in a usable form. Canada's regulations allow records to be kept in machine-readable or electronic form if a paper copy can be readily produced. The FinCEN rules similarly accept electronic storage provided the record can be retrieved and reproduced. The question that matters operationally is not the medium but the integrity: can the institution show that the record has not been altered since it was created? A database row that any administrator can edit is a weak record. A record with a timestamp, a hash of its contents and an append-only log of changes is a strong one.

A record that exists but cannot be found in 30 days is, for the examiner's purposes, a record that does not exist.

Format also affects usability. Records held as free text inside an old MT103 field 70 or 72 are hard to search and prone to truncation. Structured data in ISO 20022 elements, with the debtor, creditor, purpose code and remittance information in named fields, can be indexed and queried directly. An institution that stores the full pacs.008 as received, plus the pacs.002 and any pacs.004, has a record whose structure matches what the regulator will ask about. The same logic applies to the Travel Rule payload: store the IVMS101 message as sent, not a reconstruction of it.

How do the transaction hash and the ISO 20022 message fit together?

On a stablecoin settlement the record has two halves. The ISO 20022 message is the instruction: who is paying whom, how much, for what, and through which agents. The pacs.008 carries the debtor and creditor names and identifiers, the instructed and settlement amounts, the charge bearer, the purpose code and the remittance information, and the head.001 envelope carries the sender, receiver and message identifiers. The UETR is the thread that links every message about the same payment. The transaction hash is the proof: it identifies the on-chain transfer that discharged the obligation, and it is verifiable by anyone with access to the public ledger.

The record keeping discipline is to store the hash against the UETR, so that an examiner or an auditor can move from the payment instruction to the settlement and back. A pacs.002 status report with an accepted settlement completed status should carry a reference that resolves to the hash, and a pacs.004 return, where a transfer is reversed by a fresh on-chain transaction, should carry both the original hash and the return hash. For an MT103 flow the same information is stored against field 20 and the UETR in block 3. Without that linkage the institution holds two sets of records that cannot be reconciled, which is the finding examiners write most often about virtual currency businesses.

How should records be produced when a regulator asks?

In Canada, FINTRAC may request records and the reporting entity must provide them within 30 days of the request. In the United States, requests come from FinCEN, the IRS as the examining authority for MSBs, or a state regulator, and the timeframe is set in the request, often measured in days. Law enforcement requests can be more urgent. The institution should be able to produce, for any transaction, a single package: the customer identification and beneficial ownership record, the risk rating, the transfer record, the ISO 20022 or MT messages, the screening results, the approval record, the Travel Rule payload, the settlement proof with hash, and any report filed.

The test to run before an examination is a mock request. Pick ten transfers at random across a two-year window, including at least one return and one that generated an alert, and time how long it takes to assemble each package. If a package takes more than a working day, or requires an engineer to query a database by hand, the production capability is inadequate. A compliance workbench that can export a case with its linked messages, screening results and hashes as a single bundle is the operational answer.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs, and its record model is the one this article describes. Every payment is an ISO 20022 pacs.008 or pacs.009 inside a head.001 envelope, with pacs.002 status reports and pacs.004 returns tracked end to end by UETR, and the platform also accepts and emits SWIFT MT103. Settlement in regulated stablecoins such as USDC and USDT on public blockchains produces a transaction hash that is stored against the UETR, so the instruction and the settlement proof are one record. KYB and KYC onboarding, sanctions and PEP screening, wallet screening, KYT and Travel Rule data in IVMS101 form all write to a tamper evident audit trail, and the compliance workbench can export a case as a single bundle for a regulator. SpendTheBits is a Bank of Canada registered payment service provider and a named finalist in the Swift Hackathon 2026 Technical Challenge.