How Long to Keep Credit Card Records for Taxes and Disputes
How long to keep credit card receipts for your business: one schedule that covers IRS audits and chargebacks without storing card data PCI forbids.
Photo: Pixabay
On this page 6 sections
Key takeaways
- Split every document into its parts: the sale record stays for years, while security codes and full card numbers go.
- Your retention period is the longer of your CPA's tax period and any period your merchant agreement sets.
- Deposits for future work keep a dispute window open long after the payment cleared.
- Download processor statements every month, because your portal login ends with your account.
Keep the records behind your card sales for as long as tax authorities have the right to examine the return those sales support. That period runs for years, and your CPA sets the exact number for your business. Card network dispute windows run for months, so a schedule built around taxes covers chargebacks as well. PCI DSS adds the catch: certain card data must not be kept at all, however long you hold everything else. The answer to how long to keep credit card receipts in a business comes in two parts. Keep the sales record for years. Destroy the sensitive card data once the sale is authorized.
Each set of rules has its own logic. Once you understand it, you'll know what to do when one piece of paper falls under more than one of them.
Why Retention Rules Pull in Different Directions
Three separate authorities have a say in your records, and they want different things.
Tax law is federal and state law. It wants proof of income and deductions kept until the government loses the right to question the return.
Network rules are written by Visa, Mastercard, American Express and Discover, and they reach you through your merchant agreement. Cardholders get time to dispute a charge under these rules, and you get a short deadline to answer. Most merchant agreements also include a recordkeeping clause. Find yours and treat any period it names as a minimum.
PCI DSS is the card industry's data security standard, enforced through that same agreement. It pushes the other way: store as little card data as possible, and never keep certain parts of it.
The conflict sits inside individual documents. A merchant copy of a receipt is both a tax record and dispute evidence. If it shows a full card number, it is also a security liability. Take a card authorization form for a law firm's retainer. It proves the client consented, but once a staffer writes the security code on it, that form becomes a PCI problem sitting in a filing cabinet. Most retention mistakes come from treating the whole document as one thing.
Medical and dental practices carry a fourth set of rules. When a payment record identifies a patient and the treatment, health-privacy laws and state medical-records laws come into play. Those laws set their own retention periods and handling standards, so ask your healthcare counsel how they apply before you adopt the schedule below.
IRS Requirements for Sales Records
The IRS cares less about format than about whether your records support the income and deductions on your return. For a business that takes cards, that means five kinds of documents:
- daily batch or settlement reports from your terminal or POS
- monthly processor statements
- bank statements showing the deposits
- itemized receipts and invoices, including refunds and voids
- POS sales summaries by day, with sales tax collected
Processors report your card volume to the IRS each year. An auditor compares that figure with the gross receipts you reported, so be ready to explain the gap between the two: refunds, chargebacks, sales tax, tips and processing fees. Your processor statements do double duty here. They support your sales, and they prove the processing fees you deducted as a business expense. If yours are hard to follow, reading a merchant statement line by line shows where each figure comes from.
How long you keep these records follows from how long the IRS has to examine the return. A standard period covers most returns. Longer periods apply when income is substantially underreported or a return was never filed. Payroll and tip records follow separate rules, as do records for equipment you depreciate. State tax agencies set their own periods too, and that includes the agency that audits your sales tax. Read the IRS recordkeeping guidance alongside your state revenue department's rules, then have your CPA set one number for your business. This is general information, not tax advice.
Chargeback Windows and Dispute Evidence
Cardholders have months to dispute a charge, and the clock doesn't always start on the sale date. For certain dispute reasons, such as goods never delivered or services never provided, network rules start the clock on the expected delivery or service date. That matters to a restaurant booking a private event months out, and to a dental practice collecting up front for a treatment plan. On those sales, the dispute window stays open long after the payment cleared. Ask your processor which timeframes apply to the way you sell.
Once a dispute arrives, your processor sets a short deadline for your response. Evidence sitting in a storage unit misses it. Index the documents that win disputes by date and amount so you find them in minutes. How chargebacks work, step by step walks through the full timeline.
Useful evidence depends on how you took the card:
- In person: chip or contactless authorization data from your processor, plus the itemized receipt. Restaurants and bars that adjust tips after authorization should add the signed tip receipt.
- Online: address and security code verification results, 3-D Secure authentication results, delivery tracking, and the customer's emails or account activity.
- Keyed by phone or mail: the signed authorization form with the security code removed, along with an invoice the customer approved in writing.
- Recurring and card-on-file: the signed agreement showing the billing terms, plus records of when the customer did or didn't cancel.
For fraud disputes on in-person sales, chip and contactless authentication data does more for you than a signature does.
What PCI Says You Must Never Store
PCI DSS sorts card data into two groups, and the line between them sets your rules for PCI data retention.
Sensitive authentication data makes up the first group. It covers the security code printed on the card and PIN data, plus the full contents read from the magnetic stripe or chip. You don't keep it after authorization, and a business reason doesn't change that.
Cardholder data is the second group. It starts with the full card number and adds the cardholder's name and expiration date. Keep it only for a real business need. If you do keep it, protect it and delete it on a schedule you define. Requirements change between versions of the standard, so confirm the current wording with the PCI Security Standards Council or your processor. Our plain-English guide to PCI DSS compliance covers the background.
For most small merchants, the simplest choice is to hold no full card numbers at all. Your merchant copy needs only the last four digits to match a sale to a dispute. Customer receipts should show a truncated number too, so print a test receipt and check what your terminal puts on it.
One rule trips up phone-order businesses again and again: the paper authorization form. Picture a dental front desk that takes card details by phone on a printed form. That form holds the full number and the security code, and it goes into the patient's folder so the office can charge the card again later. Now the folder holds data the standard says shouldn't exist past authorization.
To fix it, enter the card into a virtual terminal or gateway that stores it as a token, then shred the form. If you want the signed consent as evidence, black out everything but the last four digits and keep that copy. The PCI compliance guide to choosing your SAQ explains how that choice affects your annual self-assessment.
Paper vs. Digital Storage Done Safely
Storing signed receipts on paper works if the storage is boring and disciplined. Box them by month and label each box with its destruction date. Keep the boxes locked, and run them through a cross-cut shredder when that date arrives. Restaurants that collect tip-adjusted signature slips should file them with that day's batch report so one lookup settles a tip dispute.
Digital storage is easier to search, and the IRS accepts electronic records that meet its standards for accuracy and readability. Confirm the details with your accountant before you shred originals. Check older receipts and imprints for full card numbers before you scan anything. A scan of a full card number is stored cardholder data, so redact first.
Watch for one gap in particular. Many merchants assume their processor keeps their history for them. A processor portal is not your archive: the processor decides how far back statements go, and your login is tied to an account you'll close if you ever switch. Download statements and batch reports every month and store them with your books. Attaching them inside your accounting software works well, and QuickBooks vs. Xero compares how each handles payment data. Keep card numbers out of spreadsheets and email threads, and off shared drives.
How Long to Keep Credit Card Receipts: A Business Retention Schedule
This schedule puts all three sets of rules on one page. "Retention period" means the single period your CPA sets from IRS and state rules, or the period your merchant agreement requires if that one is longer.
| Record | What it proves | Keep it for |
|---|---|---|
| Batch and settlement reports | Gross receipts | Retention period |
| Monthly processor statements | Sales and fee deductions | Retention period |
| Itemized receipts and invoices | Sale details and sales tax | Retention period |
| Merchant copies and signed tip slips (last four only) | Authorization and tips | Retention period |
| Delivery proof and customer messages | Dispute defense | Until that sale's dispute window closes; longer if they support a refund or write-off |
| Chargeback case files | Outcome and losses | Retention period |
| Card authorization forms | Consent for keyed or recurring charges | Life of the arrangement plus the dispute window, with the security code removed at once |
| Full card numbers | Nothing you need | Don't keep them; use tokens |
| Security codes, stripe or chip data, PINs | Nothing | Not past authorization |
An illustrative example. Assume a dental practice whose CPA sets a seven-year retention policy. Seven years is an assumption for this example, not a rule. A patient pays by phone in March for a treatment plan that finishes in September. The office destroys the security code on the intake sheet the same day it charges the card.
Because the dispute window for services not provided starts from the service date, the practice keeps its appointment records and signed financial agreement ready to retrieve until the window that opens in September has closed. It shares them only as its privacy obligations allow. Its tax file holds the statement and receipt, along with the invoice, for the full seven years.
If patient-record laws require longer retention, the longer period wins.
This week, pull one authorization form and one box of old receipts, and look for security codes or full card numbers. Download the past year of processor statements while you still have access, and read the recordkeeping section of your merchant agreement. Then ask your CPA for the single number that fills in "retention period" above. If your current setup forces you to keep card numbers on paper to run repeat charges, ask any provider you're considering whether its gateway stores cards as tokens so the paper can go. That includes MannyPay, which you can ask through a free processing quote.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
