How Long to Keep Payroll Records: FLSA, IRS, & I-9 Rules

You’ve likely felt that knot of anxiety when facing an audit. As an HR manager or payroll leader, the volume of documentation—from timecards to tax filings—can feel overwhelming.

The fear of non-compliance, privacy risk from over-retention, or penalties from an audit because records were destroyed too soon or scattered across systems. It feels impossible to reconcile the conflicting timelines from different agencies like the IRS, the Department of Labor (DOL), and USCIS.

At Lift HCM, we partner with hundreds of businesses to simplify their compliance burdens. We understand that effective payroll record retention is not just about following rules; it's about building a defensible, secure, and automated process that reduces liability and saves time.

This article breaks down the core federal baselines (FLSA, IRS, and I-9), shows you how to integrate state add-ons, and provides a clear, step-by-step framework for building a secure, auditable, and disciplined retention schedule. By the end of this article, you will have a clear blueprint for your company’s record retention policy.

Table of Contents

• At a Glance: Payroll Record Retention Cheat Sheet
• The IRS 4-Year Rule: Your Tax Foundation
• FLSA & The DOL: The 3-Year vs. 2-Year Split
• USCIS Form I-9 Retention: The Unique Formula
• State Add-Ons: Why Federal Rules Are Never Enough
• Building a Defensible File Plan and Purge Procedure
• FAQ: Your Most Pressing Payroll Record Retention Questions
• Moving from Audit Anxiety to Audit Readiness

At a Glance: Payroll Record Retention Cheat Sheet

Before we dive into the legal nuances, use this table as your quick-reference guide for federal minimums.

The IRS 4-Year Rule: Your Tax Foundation

When it comes to payroll tax compliance, the IRS is the "heavyweight" regulator. While other agencies might settle for two or three years, the IRS mandates a baseline of four years. However, the clock doesn't just start on the day you cut a check; the retention period begins from the date the tax becomes due or is paid, whichever is later.

What Specifically Counts as a "Tax Record"?

To be truly audit-ready, you must substantiate every number on your returns. This includes:

• Identification Data: Employer Identification Number (EIN), names, addresses, Social Security numbers (SSNs), and occupations for all employees.
• The "Paper" Trail: Copies of filed tax returns (Forms 941, 944, and 940), confirmation numbers, and acknowledgment numbers for EFTPS deposits.
• Withholding Certificates: You must keep every employee’s Form W-4 (and any W-4P or W-4R) for at least four years after the date the last return was filed using that information.
• Non-Cash Wages: Documentation of the fair market value of in-kind wages (like company cars or housing) and fringe benefit substantiation.

The ACA Connection: Forms 1094-C and 1095-C

If you are an Applicable Large Employer (ALE), your Affordable Care Act (ACA) reporting is inextricably linked to your tax foundation. Most experts recommend bundling these with your 4-year tax files to ensure you can defend against "Employer Shared Responsibility" penalties.

📌 Expert Tip: If you claimed specific tax credits—such as the Employee Retention Credit (ERC) or Paid Leave credits under FFCRA—the IRS often extends the look-back period to 6 years. If you took these credits, do not purge those files at the 4-year mark.

FLSA & The DOL: The 3-Year vs. 2-Year Split

The Department of Labor (DOL) enforces the Fair Labor Standards Act (FLSA). They categorize records into two distinct buckets. Understanding the difference between "Payroll Records" and "Supporting Records" is the key to passing a Wage and Hour audit.

Core Payroll Records (The 3-Year Bucket)

These are the high-level documents that prove who worked for you and what they were paid. You must keep these for three years:

• The Totals: Total hours worked each workweek, total daily/weekly straight-time earnings, and total overtime compensation.
• The "Why": Collective bargaining agreements (CBAs), sales and purchase records (to prove business volume for coverage), and certificates of age for minors.

Supporting Records: A Deep Dive (The 2-Year Bucket)

The DOL allows a shorter retention period of two years for the raw data used to calculate those totals.

• Timecards and Piece Work Tickets: This includes raw logs from biometric clocks, mobile apps, or manual punch cards.
• Wage Rate Tables: The schedules that define how much someone is paid for specific shifts or tasks.
• Additions and Deductions: Documentation explaining why money was added to or taken from a paycheck (e.g., wage garnishments, uniform allowances, or union dues).
• Travel Time and Tip Credits: If you have field technicians traveling between sites or if you claim a tip credit for hospitality staff, these specific logs must be maintained to prove the hours were recorded accurately.

USCIS Form I-9 Retention: The Unique Formula

The U.S. Citizenship and Immigration Services (USCIS) mandates the use of Form I-9 to verify identity and employment authorization. This is the only federal document with a "moving" retention target based on two distinct dates.

The Formula: Retain each employee’s Form I-9 for the longer of:

1. Three years after the date of hire.
2. One year after employment ends.

Why It Matters:

Failure to properly complete and retain Form I-9 can result in significant fines and penalties. Immigration and Customs Enforcement (ICE) conducts audits to ensure compliance with I-9 requirements, and employers can be penalized for errors, omissions, or failure to retain the forms.

Critical Storage Requirement: USCIS strongly recommends keeping I-9 Forms separate from general personnel files. This limits who can view sensitive immigration documents and protects the company from discrimination claims.

State Add-Ons: Why Federal Rules Are Never Enough

If you only follow federal guidelines, you are only halfway to compliance. While the IRS and DOL set the national "floor," many states have built a "ceiling" that is much higher. For a multi-state employer, failing to account for these state-specific "add-ons" is one of the fastest ways to fail a local labor audit.

The Uniform Retention Standard: Consistency vs. Complexity

Managing 50 different retention schedules for 50 different states is a recipe for manual errors. To solve this, most sophisticated organizations adopt a Uniform Retention Standard.

The Strategy: Identify the state in which you operate that has the most stringent (longest) requirement—such as New York’s 6-year rule—and apply that as your company-wide policy for that record type.

Why this works:

• Operational Efficiency: Your team follows one rule instead of fifty, drastically reducing the chance of a "premature purge" in a high-compliance state.
• Audit Readiness: You are always prepared for the strictest possible inquiry, regardless of which state the auditor is from.
• Simpler Automation: You can set a single "End-of-Life" trigger in your HCM system rather than building complex, location-based logic.

💡 Pro-Tip: Retention vs. Execution

A Uniform Standard is excellent for retention (how long you keep a file), but it should never be used for execution (how much you pay). Wage rates, overtime rules, and tax withholdings must always be executed based on the specific laws of the state where the work was performed.

Notable State Variances

While most federal rules cluster around 3 or 4 years, these "long-tail" states often catch employers off guard:

• New York: Requires payroll records be kept for 6 years under the Wage Theft Prevention Act.
• Illinois: Mandates that payroll records and "reports of all payments" be maintained for 5 years.
• California: While the technical requirement is 3 years, counsel often recommends a 4-year standard to align with the statute of limitations for state wage claims.

Building a Defensible File Plan and Purge Procedure

The biggest exposure for businesses is inconsistency. Records scattered across email, personal desktops ("shadow files"), and various vendor portals lead to major risks.

Transforming Inconsistency into a System

The foundation of a defensible plan is a single, documented retention schedule mapped to your System of Record (your HCM or Payroll platform).

1. Named Ownership: Assign "custodians" (e.g., the Payroll Manager) responsible for each record type.
2. Automated Reminders: Use your HCM solution to trigger alerts when records reach their end-of-life.
3. Litigation Holds: The moment you receive an agency notice or a threat of litigation, the "clock stops." You must immediately suspend all destruction procedures for relevant documents.

The Importance of a Disciplined Purge

Over-retention is a privacy liability. The longer you keep sensitive PII (Social Security numbers, bank details), the higher your exposure in a data breach. Once a record hits its end-of-life—and no hold is in place—destroy it.

• Digital: Follow secure deletion protocols.
• Physical: Use certified cross-cut shredding.
• Logging: Maintain a "Destruction Log" noting what was destroyed, when, and by whom.

FAQ: Your Most Pressing Payroll Record Retention Questions

Q: If I change payroll providers, whose responsibility is it to keep the old records?A: Legally, the responsibility always rests with the employer (you), not the service provider. When switching HCM or payroll platforms, never assume your old vendor will host your data indefinitely. Ensure you have a full "data dump" or "SOC-1 compliant" archive of all historical payroll registers, tax filings, and year-end data. If the IRS audits you three years from now, they will penalize your business, not your former payroll company, if records are missing.

Q: Does a "digital copy" count as an original for the IRS and DOL?A: Yes. Both the IRS (Revenue Procedure 97-22) and the DOL accept electronic records. However, they must be "retrievable." This means you must be able to produce a legible, hard-copy printout upon request during an audit. If your digital files are corrupted, or if you lose the "key" to an encrypted drive and cannot show the inspector the documents, the government treats those records as if they never existed.

Q: What is a "Litigation Hold," and when does it override my destruction policy?A: A litigation hold (or preservation order) is a temporary suspension of your normal record-purging cycle. It is triggered the moment you are served with a lawsuit, a subpoena, or even if you have "reasonable anticipation" of a claim (like an employee threatening to sue for unpaid overtime). In these cases, you must stop all automated deletions for relevant records. Destroying documents during a hold—even if it was "automated"—can lead to "spoliation of evidence" sanctions, which are often more expensive than the lawsuit itself.

Q: I have "shadow files" in my email and on manager desktops. Is that a problem?A: Yes, it’s a massive privacy and compliance risk. "Shadow files" are unofficial copies of sensitive employee data stored outside your secure HCM system. These files often bypass your destruction policy, meaning you might accidentally keep a scan of an employee's Social Security card for 10 years in an Outlook folder. This creates an unnecessary target during a data breach. Your policy should strictly mandate that all official records live in your centralized system of record.

Q: Which date do I use for the I-9 if an employee worked for us twice?A: This is a common point of confusion. If you rehire an employee within three years of the date their original Form I-9 was completed, you may be able to use a "re-verification" (Section 3) instead of a new form. However, for retention purposes, the clock resets based on the most recent hire date and the most recent termination date. When in doubt, it is safer to keep both records until the most recent one reaches its end-of-life.

Handy Reference Guide to the Fair Labor Standards Act

Moving from Audit Anxiety to Audit Readiness

Effective payroll record retention isn't just a "numbers game"—it’s a dynamic compliance strategy. By aligning your business with the FLSA, IRS, and USCIS baselines and accounting for state-specific add-ons, you move from a state of "audit anxiety" to "audit readiness."

The next logical step is taking your documented schedule and embedding it into an integrated system. Lift HCM provides the tools to automate this entire lifecycle, securing your data and your business.

Ready to transform your compliance risk into a proactive advantage? Contact Lift HCM today for a personalized consultation and discover how we can secure your record retention lifecycle!