Family Office Document Retention Policy: When May a File Actually Be Deleted?

A family office finds a folder marked “2020 property purchase.” Its cleanup rule says to remove files seven years after upload, so the folder appears due for deletion in 2027. The property is still owned. The folder holds its purchase statement and improvement invoices, which may be needed to establish tax basis when the property is eventually sold. The upload date is the wrong clock.

A family office document retention policy should answer a narrower, more useful question than “How long do we keep everything?” For each record class and legal owner, it should identify the event that starts a retention period, the source of that period, any active hold, who has authority to release the file and how disposition is proved. Expiry makes a record eligible for review. It does not automatically authorize deletion.

01The Policy Starts With a Record, Not a Storage Folder

The FOS document-management guide tests whether a system can preserve the correct version, access and authority trail. A retention policy takes the next decision: when must the record remain available, and when may the office dispose of it? A secure repository cannot make that judgment from a folder name alone.

Start by identifying the authoritative record. A signed trust amendment and the unsigned draft emailed before it are not the same record. Nor are a manager's capital-call notice, the office's approval and the bank's payment confirmation. A policy can assign different treatment to working copies, but it must first know where the controlling version and evidence live.

Then name the legal owner and the custodian. One family office may service several trusts, companies, partnerships and principals. A document held by staff for convenience can belong to a different entity, and the office's central system may not be the only copy. The schedule should say whose obligation it is, who maintains the file and where connected copies or vendor-held records are controlled.

The policy needs a rule for changes. A property sale, amended return, fund liquidation, investigation, new lawsuit or change in entity status can move the trigger or create a hold. If the schedule cannot be updated when those events occur, its apparent expiry dates are unreliable.

02Build a Schedule That Names the Trigger and the Authority

This is an illustrative policy design, not a legal timetable. The periods for a real office require review for each entity, jurisdiction and activity. Each card is one proposed schedule class with the source, controlling copy and release gate visible together. The office would assign a class ID and approve a versioned period before using it in a deletion job.

1Signed entity or trust instrument

• Owner and controlling copy: The named entity or trust; legal custodian keeps the signed instrument and amendment chain.
• Clock and source: Governing status plus a counsel-approved post-termination rule, checked for the applicable entity and jurisdiction. A later amendment or dispute may change the need.
• Hold and release: Counsel checks beneficiary, tax, transaction and dispute needs. The named entity officer approves any disposition under the adopted policy.

2Property acquisition and basis packet

• Owner and controlling copy: The property owner; tax custodian keeps acquisition, improvement, exchange and disposition evidence.
• Clock and source: Retain while basis matters. For an ordinary disposition, the IRS property-record guidance generally looks to the limitations period for its tax year. If a nontaxable exchange carries basis into replacement property, the old records may need to follow the new property through its later disposition-year limitations period. The tax lead determines the actual branch and exceptions.
• Hold and release: Tax lead and counsel check open filings, exchanges and disputes; the authorized record owner releases only after that review.

3Tax-return support

• Owner and controlling copy: The return filer; tax custodian keeps the filed return and supporting workpapers.
• Clock and source: Applicable limitations period and exceptions for that filing or claim, as confirmed by tax counsel or the return preparer.
• Hold and release: Amended filing, examination, carryover or claim can extend need. Tax lead proposes and the authorized owner approves after a hold check.

4Fund subscription and cash-flow evidence

• Owner and controlling copy: The investing entity; investment operations holds the signed subscription, notices and reconciled payment/distribution trail.
• Clock and source: Fund lifecycle, signed terms, tax support and any applicable regulatory or contractual duty. The local approved schedule must state the actual rule.
• Hold and release: An open fund, capital account, transfer, examination or claim requires review by investment and legal owners before disposition.

5Routine working copy

• Owner and controlling copy: The team custodian; the canonical record and required trail remain with their assigned owner.
• Clock and source: The adopted working-copy rule may allow cleanup after the authoritative record and its trail are verified; the schedule records that rule's version.
• Hold and release: Holds can cover drafts, messages or duplicates. The records owner checks scope and approves controlled cleanup only after every applicable hold is released.

The cards deliberately do not give every class a number such as “seven years.” A real schedule needs an approved duration or event-based eligibility rule for each class. If one is not established, mark it unresolved—do not delete. “Permanent” should also be a conscious policy choice or a sourced obligation, not a catch-all response to uncertainty.

To turn a card into an adopted schedule entry, the records owner can complete this compact row for each class: class ID and legal owner; controlling-copy location and custodian; trigger event; approved period or eligibility condition with source and version; current trigger status; hold and exception search; release authority and next review date. For Cedar's property packet, the trigger status is not reached. For the fictional WC-2 working-copy class below, the condition is event-based and later becomes satisfied. Neither status should be inferred from the file's upload date.

For US federal income tax records, the IRS explains that support for a return item is generally kept until the relevant limitations period ends. Its page gives a general three-year case and specific exceptions, including longer or indefinite periods. The same guidance says property records generally remain until the limitations period for the year of disposal expires; in a nontaxable exchange, old basis records may need to carry into the replacement property's file. A family office therefore cannot turn “three years after filing” or “seven years after upload” into one rule for every tax-related file.

This federal guidance does not settle state, trust, employment, investment-adviser, contract or litigation duties. The office's counsel and tax advisers must decide which requirements apply to the actual owner and record. A family office's regulatory status cannot be inferred from its name alone; the SEC's family-office exclusion guide describes specific conditions for exclusion from the federal investment-adviser definition.

03Work the Proposed Purge Through One File

Consider the fictional Cedar Family LLC property packet. The LLC acquired a building in 2020. Its controlling file contains the purchase statement, improvements and later basis adjustments. In January 2027, a storage report flags the folder because it was uploaded seven years earlier. The property is still held. No one has documented a sale or exchange, and the tax lead has not signed off on the basis history.

The decision is retain, even before checking for a legal hold. The IRS property-record rule ties the retention analysis to a disposition year and its limitations period. If an exchange carries basis into replacement property, the old records may have to remain through the later property's disposal-year limitations period. The office cannot calculate an expiry from a 2020 upload date while Cedar still owns the building. The records owner replaces the upload-year rule with two branches: ordinary disposition and its applicable limitations period, or nontaxable exchange with carried basis and a later replacement-property review. The tax adviser validates which branch applies when an event occurs.

Now change one fact. A second folder contains a duplicate working copy of a 2022 vendor invoice. The canonical invoice, approval and payment trail have been verified elsewhere. The office's approved working-copy rule would otherwise allow cleanup. But a counsel-issued hold covers that vendor transaction. The duplicate is not eligible for deletion while the hold applies, even if its routine period has expired. Counsel defines which versions, messages, systems and custodians fall within the hold.

In this fictional case, counsel issues written hold release H-24-07 on 10 March 2028. The office does not restart an old deletion queue. Its fictional WC-2, version 3, effective 1 January 2028, makes a routine duplicate eligible for disposition once the canonical record and required trail are verified, every applicable hold is released and an independent batch check is complete. It imposes no additional waiting interval. This is an assumed local policy rule, not a statutory period.

On 15 March, the custodian checks the controlling trail and prepares a one-file batch. A separate analyst confirms its scope and no other applicable hold. Only then is the copy eligible; the operations director approves the scoped action and the archive operator logs its execution. The controlling invoice remains. The card records the details.

The outcomes turn on different gates. The property file has no valid elapsed trigger. The invoice copy moves through hold release → controlling-trail and obligation check → independent batch check → eligible → authorized approval → logged deletion. A released hold alone would not have made it eligible. Keeping those reasons separate prevents the schedule from becoming a list of unexplained “keep” and “delete” labels.

04Apply Holds Without Freezing Everything Forever

A hold can arise from threatened or active litigation, an investigation or another matter counsel determines requires preservation. Carter Ledyard's retention-policy discussion describes suspending normal destruction for relevant records, notifying custodians and disabling automated deletion where needed. It also distinguishes affected records from unaffected routine disposal. The scope and timing of a real hold are legal decisions, not a checkbox a storage system can decide alone.

The office should record four things when a hold begins:

• Matter and scope: the affected entities, people, record classes, dates and systems, including relevant copies held by a provider.
• Preservation action: which deletion jobs were stopped, which custodians were notified and how new records enter the hold.
• Owner and review: counsel's instruction, a records owner who executes it and a date to test whether scope has changed.
• Release: counsel's written release or narrowing, with a fresh schedule check before any old deletion queue resumes.

A release from hold is not itself a disposal order. The underlying duration, property or fund lifecycle and other exceptions still have to be checked. Conversely, an office should not describe every document as permanently held because one matter exists; that makes the schedule unusable and can increase unnecessary exposure and cost.

05Make Disposition a Controlled Decision

After a class reaches its valid trigger and no hold blocks it, the custodian prepares a disposition request. It identifies the owner, record class, schedule version, source of the rule, calculated expiry if a period applies or the date an event-based condition was satisfied, locations and any vendor copy. A second person checks the evidence and confirms that the proposed batch contains no out-of-scope records. The authorized owner then approves the action.

The method must match the material. For example, the FTC Disposal Rule applies when a person or organization uses consumer reports for a business purpose. For covered information, disposal measures must be reasonable and appropriate to prevent unauthorized access or use. That is a conditional rule about a specific data class; it is not a universal family-office retention period or a reason to destroy records still required for another purpose.

The office should retain a small disposition certificate rather than the disposed content itself. A usable certificate records:

1. Batch ID, legal owner, record class and schedule version.
2. Trigger event, approved period or eligibility condition, calculated expiry if applicable, satisfaction date and the specialist or counsel validation relied on.
3. Hold search and result, including release reference if a hold once applied.
4. Approver, execution date, method, locations and service-provider confirmation where relevant.
5. Exceptions: any file removed from the batch, the reason and its new owner or review date.

Do not claim “all copies destroyed” unless the office can verify the systems and providers in scope. If immutable backup cycles or vendor terms prevent immediate removal, document the limitation, access controls and scheduled end state instead of signing a false completion statement.

Review the schedule when law, structure, systems or the family’s activities change, and at a set policy interval. Sample actual files against it: can the office identify the controlling copy, compute the correct trigger, find a live hold and produce an approval for a completed disposition? A policy is working when another authorized person can answer those questions for a record without guessing from a folder date.