Colorado Record Retention Law: Schedules, Destruction, and Penalties

Colorado’s record retention requirements vary by document type and industry, with minimum holding periods that run from three years for basic wage records to permanent for corporate governance documents. There is no single statewide schedule. Instead, each category of record is governed by its own statute or agency rule, and when more than one rule applies, the longest controls.

Quick Reference by Record Type

Wage and payroll records: 3 years under the Wage Act and COMPS Order; 5 years under the Colorado Employment Security Act
Form I-9: 3 years after hire or 1 year after separation, whichever is later
Colorado income and gift tax records: 4 years after the return’s due date or payment
Sales tax and other non-income state tax records: 3 years
Corporate minutes, bylaws, shareholder lists: permanent
Core bank records (minutes, capital stock ledgers, general ledger, daily statements of condition): permanent
Consumer loan records: 4 years after the final entry
Private education loan files: 6 years after the credit obligation ends
Real estate transaction files: 4 years from consummation or listing expiration
Notary journals: 10 years after the last entry
Unclaimed property holder records: 10 years
Adult medical records: at least 7 years after last treatment (Colorado Medical Board Policy 40-07)
Minor medical records: 7 years after the patient reaches majority (until age 25)

Employment and Payroll Records

Three different rules apply to Colorado employers, and keeping records for the longest period is the only safe approach.

The Colorado Wage Act and the Colorado Overtime and Minimum Pay Standards Order (COMPS Order) require employers to retain specific wage records for at least three years after the wages were due. Those records include each employee’s name, address, occupation, hire date, daily hours worked, pay rates, gross and net wages, withholdings, and pay-period dates. If a wage claim is pending, the employer must keep the relevant records until the claim resolves, even if the three-year window has passed.¹

The Colorado Employment Security Act goes further, requiring work records to stay open for inspection and be retained for at least five years. That obligation supports audits by the Division of Unemployment Insurance, which examines payroll data, cash-disbursement records, and payments to workers not classified as employees.²

Holding payroll records for five years satisfies both state statutes and covers the unemployment insurance audit window.

Federal law adds the Form I-9. Employers must retain a Form I-9 for every employee for three years after the date of hire or one year after the date employment ends, whichever comes later. For short-tenured workers, the three-year-from-hire calculation usually controls; for longer-tenured employees, the one-year-after-separation date typically applies.³

Tax Records

Colorado’s tax retention windows are shorter than many business owners assume.

For income and gift taxes, taxpayers must keep books, accounts, and records necessary to determine liability for four years following the due date of the return or the payment of the tax. The Colorado Department of Revenue preserves filed income tax returns for the same four-year period before destruction may be authorized.⁴

For other state taxes, including sales tax and oil and gas production tax, the retention period is three years.⁴

These are minimum floors. If you’re under audit or anticipate a dispute, hold everything until the matter resolves. Federal returns have separate IRS retention rules, which generally recommend keeping federal income tax records for at least three years from the filing date.

Corporate and Business Entity Records

The Colorado Business Corporation Act requires every corporation to keep permanent records of all shareholder and board-of-directors meeting minutes, records of actions taken without a meeting, and records of actions by board committees. Corporations must also maintain their articles of incorporation, bylaws, and all amendments in current form, along with a list of shareholders.⁵

Permanent means permanent. These documents have no scheduled destruction date and must remain available for shareholder inspection as long as the entity exists.

Healthcare Records

Colorado Medical Board Policy 40-07 calls for retaining adult patient records for a minimum of seven years after the last date of treatment. For minor patients, the recommended retention period is seven years after the patient reaches the age of majority, which generally means keeping records until the former patient turns 25.

Federal HIPAA requirements impose their own floor for certain records and operate independently of Colorado’s rules. Providers working in institutional settings may satisfy their obligations through the agency’s record-keeping system rather than maintaining duplicate personal files, provided the system meets regulatory standards.

Financial Institutions

State-chartered banks in Colorado must retain certain core records permanently: stockholder and director meeting minutes, capital stock ledgers, the general ledger, and daily statements of condition. The Banking Board classifies all other bank records and prescribes retention periods for each class, either permanent or for a specified term of years.⁶

Where federal rules from agencies like the FDIC or CFPB impose a longer retention period, the federal standard controls.

Consumer and Education Lending

Businesses making consumer loans in Colorado are governed by the Colorado Consumer Credit Code, which sets a four-year retention period for loan records. Records for any given loan need not be preserved beyond four years after the final entry relating to that loan. For revolving credit accounts, the four-year clock runs from the date of each individual entry rather than from account closure.⁷

Private education creditors face a longer obligation and must retain loan files for at least six years after the termination of the credit obligation.⁸

Real Estate Transactions

Licensed brokers and brokerage firms must retain transaction files for four years, beginning from the consummation date of the transaction or the expiration date of any listing contract that does not result in a closing. Files can be kept in paper or electronic format as long as they remain available for inspection by the Colorado Real Estate Commission during the retention period.⁹

Brokers are personally responsible for their transaction files regardless of whether they switch brokerages. The Commission recommends retaining text messages and emails in transaction files, though this is not strictly required.⁹

Notary Journals

Colorado notaries must maintain a journal of every notarial act performed and retain it for ten years after the last act recorded in the journal. When a notary’s commission expires or is revoked, or the notary resigns, they must continue to hold the journal for the full ten-year period and inform the Secretary of State where the journal is located.¹⁰

Unclaimed Property

Businesses holding unclaimed property face one of the longest retention windows in Colorado law. Any holder required to file a report under the Revised Uniform Unclaimed Property Act must keep records for ten years after the later of the date the report was filed or the last date a timely report was due. The state administrator can prescribe a shorter period by rule, but absent such a rule, ten years is the default.¹¹

Can You Keep Records Electronically?

Yes, with caveats. Colorado’s Uniform Electronic Transactions Act confirms that electronic records satisfy any state-law requirement to retain a record, provided the electronic version accurately reflects the information as it existed in final form and remains accessible for later reference. This holds even when a law specifically requires the original form of a document. An electronic image of a check, for example, satisfies any law requiring retention of that check.¹²

Two limits apply. Any law enacted after May 30, 2002, can specifically prohibit electronic records for a particular purpose, overriding the general rule. And individual government agencies may impose additional requirements for records within their jurisdiction beyond the baseline accessibility and accuracy standards.¹²

Practically, you can digitize paper records and destroy the originals for most retention obligations. But the electronic system has to produce readable, unaltered copies on demand. If your storage technology fails or a file format becomes obsolete and you can’t retrieve the records, you’re still on the hook.

Litigation Holds Override Everything

Normal retention schedules stop applying the moment litigation is pending or reasonably foreseeable. At that point, you have a duty to preserve any records relevant to the dispute, and destroying them can result in sanctions ranging from monetary penalties to a default judgment against you.¹³

Courts can instruct juries to draw an adverse inference against a party that destroyed evidence, letting the jury assume the missing records would have been damaging. A business that shreds files on schedule but ignores a litigation hold can face consequences far worse than the underlying claim. The duty to preserve kicks in when you know or should know that litigation is likely and that the records in question are relevant to it.¹³

How Records Must Be Destroyed

When retention periods end, personal information can’t just be thrown away. Colorado requires every business that maintains paper or electronic documents containing personal identifying information to develop a written disposal policy. When those documents are no longer needed, the business must destroy them by shredding, erasing, or otherwise making the personal information unreadable.¹⁴

Businesses already regulated by a state or federal agency that maintains its own disposal standards are considered compliant if they follow their regulator’s rules. The Colorado Attorney General’s office has stated that the written-policy requirement applies to both paper and electronic formats.¹⁵

Penalties for Noncompliance

Colorado enforces retention laws through agency-specific penalties rather than a single mechanism, and some are steep.

Employers who fail to produce wage records upon request by the Division of Labor face fines of at least $50 per day. Separate penalties of $250 per employee per month apply for pay-statement violations.¹

Businesses that don’t retain tax records risk estimated tax assessments, where the Department of Revenue calculates what it believes you owe based on available information. These estimates rarely favor the taxpayer.

The Colorado Division of Banking can impose disciplinary actions on financial institutions that do not maintain records as required by the Banking Code or Banking Board rules.⁶

Real estate professionals who do not follow the Commission’s record-keeping mandates risk license suspension or revocation. The Commission can request production of transaction files at any time during the four-year retention period, and an inability to produce them is treated as a licensing violation.⁹

1
Colorado Department of Labor and Employment. INFO 3A Timing of Wage Payments and Required Record-Keeping
2
Department of Labor & Employment. Employer Audits
3
U.S. Citizenship and Immigration Services. Retaining Form I-9
4
Justia. Colorado Revised Statutes Title 39-21-113 – Reports and Returns
5
Justia. Colorado Revised Statutes Section 7-116-101 – Corporate Records
6
Justia. Colorado Revised Statutes Section 11-102-308 – Bank Records Preservation Reproduction
7
FindLaw. Colorado Revised Statutes Title 5 Section 5-2-304
8
Justia. Colorado Revised Statutes Section 5-20-211 – Record Retention Confidentiality
9
Division of Real Estate. Transaction File Requirements and Retention
10
FindLaw. Colorado Revised Statutes Title 24 Section 24-21-519
11
Justia. Colorado Revised Statutes Section 38-13-404 – Retention of Records by Holder
12
Justia. Colorado Revised Statutes Section 24-71.3-112 – Retention of Electronic Records Originals
13
Colorado Judicial Branch. Terra Management Group LLC v Keaten – Opinion on Spoliation Sanctions
14
Justia. Colorado Revised Statutes Section 6-1-713 – Disposal of Personal Identifying Information Policy Definitions
15
Colorado Attorney General. Colorados Consumer Data Protection Laws FAQs for Businesses and Government Agencies