How long freight brokers should keep carrier vetting records

May 20, 2026 · 9 min read

TL;DR

Keep carrier vetting records for at least seven years past the last load with that carrier. Federal regulations set a floor of three years for some record categories. State personal-injury statutes of limitations run two to six years, with discovery rules that push effective exposure further. Disk space is cheap. The cost of producing a defensible record from five-year-old spreadsheets is not. Retain by default, delete on a schedule, and store in a tamper-proof format.

What federal regulations actually require

FMCSA record-retention rules for property brokers live in 49 CFR Part 371. They are narrower than most brokers think. The key requirements:

Records of transactions. 49 CFR 371.3 requires brokers to keep records of each shipment they arrange, including the names and addresses of the consignor and consignee, the dates of the shipment, the carrier's name and authority number, and the amount of compensation received. Retention period: three years.
Records subject to inspection. Same section requires that these records be made available to any party to the transaction on reasonable notice.
Hours-of-service and DOT records. Carriers, not brokers, have separate retention obligations under 49 CFR Parts 395 and 396. Brokers do not inherit those obligations directly, but the records become relevant evidence in any litigation touching the broker.

Note what is missing from federal regulation: no explicit requirement to retain carrier vetting records (safety rating snapshots, CSA scores, insurance certs at booking, authority verification). The federal floor covers the commercial transaction record. The vetting record is the broker's litigation-defense artifact, and the retention discipline is on the broker to set.

State statutes of limitations

Personal-injury claims against brokers post Montgomery v. Caribe run under state law, so the limitations period varies. Common ranges:

Two years: California, Texas, Pennsylvania, Ohio, Connecticut, Kansas, and roughly a dozen others.
Three years: New York, Massachusetts, Maryland, Washington, Virginia, and most of the Mid-Atlantic.
Four years: Florida, Nebraska, Wyoming, others.
Five years: Missouri, Tennessee, several others.
Six years: Maine, Minnesota, North Dakota.
Wrongful death: typically the same as personal injury, sometimes longer (Massachusetts is three years, Tennessee is one year, California is two).

Two complications that push effective retention longer than the face limitations period:

Discovery rule. Many states toll the statute until the injured party discovered (or should have discovered) the injury. In a brain-injury case where cognitive impairment is diagnosed years after the wreck, the clock may start late.
Minor plaintiffs. Most states toll the statute for plaintiffs who were minors at the time of injury, sometimes until they reach majority plus the standard limitations period. A claim from a minor passenger in a 2026 wreck could surface in 2042.

The practical implication: face limitations periods are the floor, not the ceiling. Plan for outlier cases that arrive years after the load.

The recommended retention policy

A defensible policy for freight brokers post Montgomery:

Active carriers: retain all vetting records indefinitely while the carrier is active. Active means any load in the past 12 months.
Inactive carriers: retain for seven years from the last load with that carrier. Seven years covers most state statutes of limitations plus typical discovery-rule tolling, and aligns with common tax record retention practice already in place at most brokerages.
High-risk loads (hazmat, oversized, high-value, fatal-injury-eligible cargo categories): retain for ten years from the load date. The potential exposure profile justifies the longer hold.
Loads involved in any reported incident: retain indefinitely. The moment a carrier has any reported crash, near-miss, or claim related to a load you brokered, that load record is potentially evidence in a live or future case. Do not delete it.
Carriers terminated for cause: retain indefinitely. A carrier you fired for safety, insurance, or fraud issues is precisely the carrier a plaintiff's lawyer will subpoena records about. Keep the file.

The tamper-proof requirement

Retention is necessary but not sufficient. A retained record that could have been edited at any time after the fact is not the same artifact as a retained record that was locked at the moment of capture. Plaintiff's counsel will ask the question on cross-examination: when was this record created, when was it last modified, and how do we know?

Three practical standards for a record-keeping system to meet:

Timestamped at capture. The timestamp comes from the system, not from a date field a user can type into.
Immutable after capture. The record cannot be edited or deleted after capture except through an audited process that itself logs the change.
Audit log of access. Who viewed the record, when, from which device. Modern compliance tooling logs this by default.

Spreadsheets fail all three. Folder-of-PDFs systems pass timestamp at capture but fail immutability and access logging. Purpose-built tools like VettedHaul pass all three by design.

The discovery / litigation timing reality

From the moment a wreck happens to the moment a broker is served with a complaint typically runs six months to two years. Plaintiff's counsel investigates, sends pre-suit demand letters, and exhausts the carrier's primary insurance before pivoting to the broker.

From the moment a broker is served to the moment vetting records are requested through discovery runs an additional three to twelve months. Discovery requests typically demand every document related to the carrier and the specific load, including the broker's carrier qualification file, contemporaneous insurance verification, FMCSA snapshots, and the rate confirmation. Discovery responses are due 30 days from request, sometimes extended.

The implication: vetting records you might need to produce in a 2028 demand letter relate to a 2026 load. The records you produce in a 2032 trial relate to loads booked across a span of years prior. Retention is not optional and short retention periods are not safe.

Storage cost reality

A typical broker vetting record per carrier per load runs 200KB to 2MB across FMCSA snapshot PDF, insurance certificate PDF, authority verification screenshot, and a metadata JSON. Round to 1MB.

A broker booking 1,000 loads per month generates approximately 12GB of vetting records per year. Over ten years, 120GB. Cloud storage at standard tier runs roughly $25 per TB per month. Ten years of vetting records costs approximately $3 per month to store.

Storage cost is not the constraint. The constraint is having a system that captures the record reliably in the first place and that produces it on demand a decade later.

What to retain vs what to delete

On the "retain" side:

FMCSA safety rating snapshot at booking
CSA scores at booking (all seven BASIC categories)
Insurance certificate of insurance (signed agent copy)
Operating authority verification snapshot
Broker-carrier agreement (signed copy and any amendments)
Rate confirmation for each load
Carrier packet (W-9, authority docs, any compliance certifications)
Any communications related to safety concerns or carrier vetting decisions
Monitoring alerts and the broker's response (or non-response, and why)

On the "safe to delete after retention period" side:

Routine load-status updates and check-call logs (after FMCSA 3-year minimum)
Marketing emails to and from carriers
Internal Slack threads not related to safety or vetting decisions

When in doubt, retain. The legal cost of not having a record is material; the storage cost of keeping it is trivial.

Building the retention policy into your business

A defensible retention policy needs three components:

Written policy document. One to two pages. What you retain, for how long, how it's stored, how access is controlled, who is responsible. Hand to your insurance underwriter at renewal.
Automated retention enforcement. The system enforces the policy by default. Records do not get deleted early. Records do not get retained forever by accident.
Annual audit. Once a year, confirm the system is doing what the policy says. Spot-check old records to confirm they are accessible and readable. Storage formats can degrade.

The bottom line

Seven years past last load is the default for most brokers. Ten years for high-risk load categories. Indefinite for any carrier or load with reported incidents. Federal regulations set a 3-year floor that does not cover the post-Montgomery litigation exposure; state statutes of limitations plus discovery rules and minor plaintiffs push effective exposure much longer.

Storage cost is not the constraint. The constraint is having a tamper-proof system that captures the record at booking, locks it against later edits, and produces it on demand years later when discovery requests arrive. That is what VettedHaul is built around. Join the waitlist to lock in founding-customer pricing.