How Long FFLs Must Retain ATF Form 4473 Records
The short answer: at least 20 years.
The longer answer involves different retention periods for different transaction types, specific rules about where and how records must be stored, requirements for what happens when an FFL discontinues business, and an increasingly important distinction between paper and digital storage.
Record retention isn't the most exciting compliance topic, but it's one of the most consequential. The ATF expects to be able to trace any firearm sold through your store back to the Form 4473 that authorized the transfer — whether that transaction happened last week or 18 years ago. If you can't produce the record, you have a problem.
This guide covers every aspect of Form 4473 retention: how long you must keep records, which transactions have which requirements, where records must be stored, what happens when you close your doors, and how digital storage changes the equation.
The 20-year rule
Under 27 CFR § 478.129(b), FFLs must retain completed ATF Form 4473 records for not less than 20 years after the date of the transaction. This applies to all transactions where the firearm was transferred to the buyer — meaning the NICS check came back Proceed (or the Brady Transfer Date passed on a delayed check) and the buyer took possession.
Twenty years is the federal minimum. There is no maximum. You are free to retain records longer than 20 years, and many FFLs do — either because they haven't gotten around to destroying old records or because their storage system (particularly digital storage) retains forms indefinitely by default.
What counts as the start of the 20-year clock
The 20-year retention period begins on the date of the transaction — specifically, the date the firearm was transferred to the buyer. This is the date recorded in Section E of the Form 4473, where the FFL certifies the transfer. If the buyer completed the form on Monday but didn't pick up the firearm until Wednesday (due to a NICS delay, for example), the 20-year clock starts on Wednesday.
What happens after 20 years
After the 20-year retention period expires, the FFL is no longer federally required to retain the form. You may destroy it — but you're not required to. Many FFLs keep records beyond the minimum because:
State or local laws may impose longer retention requirements
Destroying records requires its own process and documentation
The practical cost of continuing to store records (especially digital ones) is negligible
There's no downside to having a record you don't need, but there's significant downside to not having one you do
If you choose to destroy records after the retention period, do so in a manner that protects the sensitive personal information they contain — shredding for paper, secure deletion for digital files.
Retention periods by transaction type
Not every Form 4473 has the same 20-year requirement. The retention period depends on the outcome of the transaction:
Completed transactions (Proceed or Brady Transfer Date)
Retention: 20 years from the date of transfer.
This is the standard rule. The buyer passed the NICS check (or the Brady Transfer Date applied), the firearm was transferred, and the form must be kept for at least 20 years.
Denied transactions
Retention: 5 years from the date of the NICS denial.
When a NICS check comes back Denied, the firearm is not transferred — but the Form 4473 must still be retained. The retention period for denied transactions is 5 years, not 20. However, denied forms must be stored separately from completed transactions — this segregation requirement is an ATF compliance standard that applies to both paper and digital storage.
In practice, many FFLs retain denied forms for longer than 5 years simply because segregating and selectively destroying a subset of records is more effort than keeping them. If you're using E4473 Cloud Storage, denied transactions are automatically segregated and retained alongside your completed forms.
Transactions where no transfer occurred (other than denials)
Retention: 5 years.
This category covers situations where a Form 4473 was started but the transaction was never completed for reasons other than a NICS denial — the buyer changed their mind, the sale fell through, or the form was voided for some other reason. These forms must be retained for 5 years.
Delayed transactions that were never resolved
If a NICS check was delayed and the FBI never issued a final determination — and the FFL chose not to exercise the Brady Transfer Date — the transaction was never completed. The retention requirement for these unresolved forms is 5 years.
Where records must be stored
On the licensed premises
Federal law requires that Form 4473 records be maintained at the licensed premises — the physical address listed on your FFL. You cannot store records at your home (unless your home is your licensed premises), at an off-site storage facility, or at another business location (unless that location is also licensed and the records pertain to transactions conducted there).
This on-premises requirement is one of the reasons filing cabinets and storage rooms fill up — every form you've completed in the last 20 years must be physically present at your store.
The digital storage exception
If you're using ATF-compliant digital storage, your records are stored in the cloud — but the ATF still requires a local backup at your licensed premises, updated daily. This on-site backup satisfies the premises requirement while allowing the primary storage to be cloud-based.
E4473 Cloud Storage handles this automatically. Your completed forms are stored in encrypted cloud archives and synced daily to an on-site storage device at your licensed premises. Both copies are always current.
Organization requirements
Regardless of format, Form 4473 records must be organized for retrieval:
Alphabetically — by buyer's last name
Chronologically — by date of transaction
Numerically — by transaction number
You don't have to use all three methods — pick one and be consistent. The point is that when an ATF inspector asks for a specific form, you can find it promptly. "Promptly" with paper means minutes. With digital storage, it means seconds.
What happens when an FFL closes
When an FFL discontinues business — whether through retirement, closure, bankruptcy, or license revocation — all Form 4473 records and A&D records must be transferred to the ATF's National Tracing Center (NTC) in Martinsburg, West Virginia within 30 days of discontinuing business.
This is not optional. The NTC uses these records to conduct firearms traces — tracking the chain of custody of a firearm recovered in a crime from manufacturer to distributor to dealer to buyer. Your records are a critical link in that chain, and the ATF needs them to be accessible even after your business no longer exists.
What to send
When closing, you must send:
All completed Form 4473 records — for the entire history of your license
Your complete A&D bound book (or records)
Any other required records specified by the ATF
How to send them
The ATF provides specific instructions for shipping records to the NTC. Paper records should be boxed, labeled, and shipped via a trackable carrier. Digital records should be provided in a format accessible to the NTC — consult with the ATF for current requirements regarding digital record transfers.
Planning for closure
If you know in advance that you're closing — retirement, planned sale of the business — start organizing your records well before the 30-day deadline. For FFLs with 20+ years of paper records, this can be a significant undertaking. For FFLs using digital storage, the process is considerably simpler since records are already organized, searchable, and backed up.
Selling your business
If you're selling your FFL business to a new owner who will obtain their own FFL at the same location, the transfer of records depends on the specific circumstances. In some cases, the new licensee may retain the records at the premises. In others, the records must go to the NTC. Consult with your local ATF office during the transition.
Multi-location FFLs
If you operate multiple licensed locations, each location must maintain its own Form 4473 records for transactions conducted at that premises. You cannot consolidate records from multiple locations into a single storage facility (unless that facility is also a licensed premises).
For multi-location FFLs, this means each store needs its own filing system — or, with digital storage, each location's records are stored in the cloud with a local backup at that specific premises.
When a location closes but the business continues operating at other locations, the closing location's records must be transferred to the NTC — not to another store in your chain (unless the ATF approves an alternative arrangement).
Paper vs. digital: retention implications
The 20-year retention requirement is the same regardless of whether you store records on paper or digitally. But the practical implications are very different.
Paper retention challenges
Physical space — 20 years of paper forms at even moderate volume consumes significant storage space. A store processing 100 forms a month accumulates 24,000 forms over 20 years.
Organization maintenance — keeping 20 years of paper forms organized, accessible, and retrievable requires ongoing effort. Filing systems degrade without constant attention.
Physical vulnerability — paper is vulnerable to fire, water damage, theft, and deterioration. A single disaster can destroy decades of records with no backup.
Sensitive data exposure — thousands of forms containing Social Security Numbers, home addresses, and government ID numbers sitting in filing cabinets represent a significant security liability.
Disposal logistics — when records age past the retention period, they must be securely destroyed. Shredding 20 years of accumulated forms is a project in itself.
Digital retention advantages
Zero physical footprint — Cloud Storage takes up no space in your store. Twenty years of records occupy the same amount of physical space as zero records.
Automatic organization — records are organized for instant retrieval from the moment they're stored. No filing maintenance, no degrading organization over time.
Protected from physical damage — encrypted cloud archives with daily on-site backups protect against fire, flood, theft, and hardware failure.
Data security — encrypted storage with access controls replaces unlocked filing cabinets. Only authorized users can access the records.
Consistent retention — the system retains every form for the full retention period automatically. No forms accidentally destroyed early. No forms retained past their period unless you choose to.
ATF requirements for digital storage
If you choose to store Form 4473 records digitally, the ATF has specific requirements that go beyond simply saving files on a computer. For a complete breakdown, see our FFL guide to ATF Form 4473, but here's a summary:
60-day written notice — notify your local ATF office before implementing digital storage
Electronic completion — forms must originate digitally per ATF Ruling 2016-2 (you can't scan paper forms and store them digitally)
Unalterable format — originals cannot be deleted, amended, or replaced
ATF access terminals — one per 500 forms executed in the prior 12 months
Record segregation — completed and denied transactions stored separately
Organized retrieval — alphabetical, chronological, or numerical, printable on demand
On-site backup — daily sync to a local storage device at your licensed premises
Unencrypted access — forms downloadable in a readable format for ATF review
E4473 Cloud Storage meets all eight requirements out of the box. The ATF Audit Portal provides the access terminals, the system handles segregation automatically, and the daily on-site backup ensures compliance with the local storage requirement.
Common retention mistakes
Destroying records too early
The 20-year clock starts on the date of transfer, not the date the form was completed. If a NICS check was delayed and the transfer happened three days after the form was signed, the retention period starts on the transfer date. Miscalculating the start date — or simply losing track of when forms were completed — can lead to premature destruction.
Not retaining denied forms
Some FFLs assume that if the transaction didn't go through, the form can be discarded. Wrong. Denied forms must be retained for at least 5 years and stored separately from completed transactions.
Storing records off-premises
Records must be at your licensed premises. If you've moved boxes to a home office, a storage unit, or another location, they need to come back — or you need ATF-compliant digital storage with a local on-site backup.
Not planning for business closure
Many FFLs don't think about what happens to their records until they're actually closing. At that point, organizing and shipping 20+ years of paper records to the NTC in 30 days becomes a scramble. If closure is a possibility — retirement, lease expiration, sale of the business — start planning your record transfer well in advance.
Inconsistent organization over time
An FFL might start with alphabetical filing, switch to chronological after a few years, then abandon organized filing altogether during a busy period. The result is 20 years of records in three different organizational schemes — none of which are fully maintained. Consistency matters.
The bottom line
Form 4473 retention isn't complicated. Keep completed forms for 20 years. Keep denied forms for 5 years, stored separately. Keep everything at your licensed premises, organized for retrieval. And when you close, send it all to the NTC within 30 days.
What makes it hard is the volume. Over a 20-year career, a moderately busy FFL accumulates tens of thousands of forms — each one containing sensitive personal information, each one subject to ATF inspection, each one needing to be findable on demand.
Paper makes that hard. Digital makes it automatic.
E4473 Cloud Storage stores every form for the full retention period in encrypted, organized, instantly retrievable archives — with daily backups, automatic segregation, and an ATF Audit Portal that makes inspections faster for everyone. You stop worrying about filing cabinets, storage rooms, and whether you can find a form from 2019. The system handles it.
Twenty years is a long time to keep records. It's a lot easier when the records keep themselves.
Go paperless with your 4473 records: Schedule a free 15-minute demo and see how E4473 Cloud Storage handles 20-year retention, ATF audit access, and on-site backup — automatically. No obligation.