The paper gap in member files.

Credit unions put real effort into securing their digital records: access controls, backups, audit trails and incident plans. Then, a few metres from the server room, sit boxes of signature cards, loan files and account applications with none of those protections.

Paper is the one part of most records estates that can’t tell you who opened it, can’t be restored if it’s lost, and can’t be searched when a regulator calls.

What the rules expect

FINTRAC’s record-keeping guidance asks financial entities to keep most records for at least five years, and signature cards and many account records for five years after the account closes. Records must be retrievable so they can be provided within 30 days of a request. Electronic records are acceptable, as long as a paper copy can easily be produced. A provincial regulator can require longer.

In other words, the rules care less about whether a record is paper or digital than about whether you can produce it, intact and on time.

Paper can’t be logged, backed up or audited. Digital records can.

Closing the gap

List every kind of paper record you hold, and check what you must keep and for how long, so you don’t move or scan what can be destroyed. Start with the files you could least afford to lose.

Digitize under the conditions you’d accept for your own systems: known people, a documented chain of custody and sealed boxes. Then limit access to the digital files by role, record who opens them, and keep the certificate of destruction for any originals you destroy.

The real point

Members trust you with their financial lives. Bringing paper under the same controls as everything else is how that trust is kept, quietly and completely.

General guidance only, not legal or regulatory advice.