How long to keep client bank statements depends on who owns the records and what the engagement letter says. For tax purposes, the client usually needs their statements for at least three years, and sometimes longer. A bookkeeper should keep a working copy only as long as the work needs it, then return or delete it.
Originals versus converted files: which to keep?
The original statement is the bank's PDF, and the converted file is the spreadsheet or import file made from it. Keep the original longer, because it is the source document and the converted file can always be rebuilt from it. Keep the converted file only as long as the books need it.
Why the original wins
An original statement is the proof. If the client is audited, or a number in the books is questioned, the question is answered by the bank's own document, not by a file derived from it. A converted file has already been through a tool and, usually, a person's edits. It is a working copy, and it is replaceable.
The same logic applies to the exported import file. Once it has been imported into QuickBooks or Xero, the transactions live in the client's books, and the file is a leftover. Keeping it does no harm to the client's records, but it is one more copy of sensitive data, and there is no reason to hold it indefinitely.
What the tax authority asks for
The client, not the bookkeeper, is the person who has to produce records for a tax return. The IRS page on how long to keep records says to keep records for 3 years by default, for 6 years if you leave out more than 25% of the gross income shown on a return, and for 7 years if you claim a loss from worthless securities or a bad debt. It adds that employment tax records should be kept for at least 4 years after the tax is due or paid, whichever is later, and indefinitely if no return is filed or a fraudulent one is filed. That page is US federal guidance. State rules and other countries differ, so check the rule that applies to your client.
For a bookkeeper, the practical reading is this: the client must keep the originals for several years, so the safest default is to make sure the client has their own copy, and to keep yours only for a period you have agreed.
Who decides how long statements are kept?
The client owns their financial records, so the client decides how long they are kept, within what the law and their accountant require. The bookkeeper decides only how long the practice holds its own working copies, and should write that period into the engagement letter so nobody has to guess.
Three parties each have a say:
- The client owns the records and is responsible for tax retention.
- The CPA or tax preparer may need statements for particular years, and can say which ones.
- The bookkeeper sets a retention period for the practice's copies and follows it.
A good engagement letter states what the practice keeps, for how long, and what happens at the end. The engagement letter clause checklist in the confidentiality post covers wording for retention alongside access and software use. The more specific the term, the fewer arguments later: "we keep your statements for two years after the engagement ends, then delete them" is clearer than "we keep records as needed".
Retention settings in a statement converter
A retention setting in a converter controls how long the tool keeps your uploaded originals after you export. Set it to the shortest period that still lets you re-run or check a statement. Shorter retention means fewer copies exist, and fewer copies means less to lose.
AutoBankConvert says on its homepage that you choose how long originals are kept after export. Match that choice to your own policy: if your engagement letters promise deletion after the work, set the converter to the shortest period it offers, and keep the client's file in the folder you manage.
A few points to check when you set it:
- Does the setting apply per client or to everything? A client with a longer retention need should not force the same period on the rest.
- Does the setting cover originals only? Ask whether converted results and the client's rules are treated separately.
- Can you delete early? You should be able to remove a statement or a client before the period ends.
For the wider list of questions to ask a vendor about stored files, see the vendor checklist for uploading client statements. To see how the setting looks in practice, request access on the get started page.
A retention policy table template
The table below is a starting template. The periods are examples. Replace them with the figures you agree with each client and their CPA.
| File type | Keep for (example) | Who decides | Where stored |
|---|---|---|---|
| Original bank statement PDF | Client: at least 3 years, longer if their CPA advises. Practice: 2 years after the engagement ends | Client, with their CPA | Client's own storage; practice client folder |
| Converted spreadsheet | Until the month is reconciled and signed off | Bookkeeper | Practice client folder |
| QuickBooks or Xero import file | Until the import is checked | Bookkeeper | Practice client folder, then deleted |
| Year-end package for the CPA | As the CPA requests | CPA and client | Secure share, then client copy |
| Converter's stored originals | The converter's retention setting | Bookkeeper | The converter |
Deleting statements a client still needs
Do not delete a client's statements before you confirm they hold their own copy. If the client has no copy and you delete yours, the record may be gone, and the bank may only supply old statements for a fee or within a limited window. Hand the files over first, then delete.
Before deleting at the end of an engagement or a retention period:
- Send the client a complete set of originals and converted files, and ask them to confirm receipt.
- Ask the CPA whether any year is still open and needs your working papers.
- Check the books for each year are final, using the year-end bookkeeping checklist.
- Delete the files in your folders, then the converter's stored copies, then any email copies.
- Record the date and what was removed.
Keep that record. It is the practice's answer if a client later asks what happened to their files. The wider set of device, account and sharing rules lives in the practice security checklist, and the retention period should appear in it too.