How Long Does a Business Have to Keep Credit Card Receipts?

For most routine expenses, a business has to keep credit card receipts for at least three years from the date it files the tax return that claims the expense. That is the federal floor. The real answer stretches longer in common situations: four years for payroll-related receipts, six years if income was significantly underreported, seven years for bad-debt write-offs, the life of an asset plus three years for equipment purchases, and indefinitely for years when a required return was never filed or a fraudulent one was. Card-network dispute rules and state tax deadlines add their own clocks on top. How long does a business have to keep credit card receipts in practice? Long enough to satisfy the longest deadline that touches each receipt.

The Three-Year Federal Baseline

The IRS generally has three years from the date a return is filed to audit it and assess additional tax. File early and the clock still starts on the return’s due date, not the day you sent it.¹ Any credit card receipt supporting a deduction on that return has to survive until that window closes. The retention period attaches to the tax year the expense was claimed, not the transaction date on the card.

Three years is the floor. Several ordinary situations push it further, and a business that clears its files at exactly three years is taking a real risk.

When the Clock Runs Longer

Six Years for Underreported Income

If a business omits more than 25% of the gross income it should have reported, the IRS gets six years instead of three.¹ It doesn’t have to be intentional. A bookkeeping mistake that trips the 25% threshold doubles the audit window automatically, and every receipt behind every deduction on that return needs to survive the full six years, because the whole return is back on the table.

Seven Years for Bad Debt and Worthless Securities

Receipts and records supporting a bad-debt deduction or a loss on worthless securities need to be kept for seven years from the filing date.² Debts take time to become demonstrably uncollectible, and the IRS gives itself extra runway to look back at those claims.

Indefinite Retention

Two situations remove the deadline entirely. If a business files a fraudulent return or fails to file a required return at all, the IRS can assess tax at any time.³ Receipts tied to those tax years should be kept permanently. Businesses that skipped filings during lean years sometimes get caught out by this decades later.

Receipts for Equipment and Other Assets

A receipt for equipment, vehicles, or furniture isn’t just proof of an expense. It establishes the cost basis used to calculate depreciation over the asset’s useful life. Keep that receipt for as long as the asset is being depreciated, then three more years past the final return that includes a depreciation deduction for it.²

For a piece of equipment depreciated over seven years, that means holding the original receipt for roughly ten. For commercial real property depreciated over 39 years, the math gets uncomfortable. If you received property in a nontaxable exchange, keep records for both the old and new property until the limitations period expires for the year you dispose of the new one.⁴

Employee Reimbursements and Payroll

Businesses that reimburse employees for card-based expenses under an accountable plan need to keep those receipts and related documentation for at least four years after the employment tax is due or paid, whichever is later.⁵ This covers all employment tax records, including fringe benefits and expense reimbursements with their substantiation.

For reimbursements to avoid being treated as taxable wages, the plan must require employees to substantiate expenses within 60 days and return any excess within 120 days.⁵ The receipts employees submit become part of your employment tax records, and the four-year clock covers all of them.

State Tax and Sales Tax Windows

Federal rules set the floor, but your state may want more. State income tax audit windows generally run three to four years from the later of the return’s due date or filing date, with a few states running longer. Whichever period is longest in a state where you file becomes your retention baseline for receipts tied to that return. Businesses filing in multiple states should identify the longest window across every jurisdiction and use that.

Customer sales receipts do different work. They document the sale amount, the tax collected, and where the sale happened. State sales tax lookback periods generally run three to six years, and most states extend or eliminate the deadline when fraud, evasion, or failure to file is involved. When a business can’t produce sales records during a state audit, the state typically estimates what was owed, and those estimates run high.

Chargeback and Dispute Windows

Tax rules aside, receipts are also the evidence that wins chargebacks. Each card network sets its own dispute clock. Under Visa’s rules, an issuing bank generally has 45 calendar days from the transaction date to file a dispute, and the merchant’s acquiring bank has 45 days to respond.⁶ American Express gives cardholders 180 days from the transaction date to raise a dispute.⁷ Because pre-arbitration and secondary review cycles can stretch things further, most merchant-services guidance recommends keeping transaction records for at least 13 months.

The itemized receipt or signed sales draft is often what decides the dispute. Digital copies work, provided they are legible and complete.

When a Statement Isn’t Enough

A card statement shows the date, amount, and merchant. It rarely shows what was actually bought. The IRS lists both credit card receipts and statements as acceptable supporting documents but adds that a combination of documents may be needed to substantiate all elements of a transaction.⁸ For travel and meals, documentary evidence must show the amount, date, place, and essential character of the expense. A restaurant receipt should show the name and location, the number of people served, and the date and amount charged.⁹

The exception: for expenses under $75 other than lodging, no receipt is required.¹⁰ A statement line plus a short note on business purpose will generally hold up for those. Lodging always needs a receipt regardless of amount. For any expense of $75 or more and for all lodging, keep the itemized receipt. Relying on statements alone for large or travel-related expenses is how deductions get disallowed.

PCI Rules on What You Can Store

Tax law tells you how long to keep receipts. PCI DSS governs what those receipts can contain and how they must be destroyed. Violations can trigger fines from your payment processor, higher processing fees, or loss of the ability to accept cards.

Sensitive authentication data must never be stored after a transaction is authorized, even in encrypted form.¹¹ That includes the card verification code, the PIN, and the full magnetic stripe or chip track data.¹² If any receipt in your files carries that data, it needs to be destroyed immediately, not at the end of your retention period.

Cardholder data, meaning the full primary account number, cardholder name, expiration date, and service code, can be stored with proper safeguards.¹² Printed receipts must mask the card number so only the last four digits show. Digital records require truncation or encryption. Keeping an unmasked full card number on any receipt is a serious violation.

Once retention ends, destruction has to be secure. Paper gets cross-cut shredded. Digital records require cryptographic erasure or secure deletion that prevents forensic recovery. Deleting a file or tossing a receipt in the trash doesn’t meet the standard.

Going Digital

The IRS accepts electronic copies as substitutes for paper originals, but the system has to meet specific standards. An electronic storage system must index, store, preserve, retrieve, and reproduce records. At audit, the business must be able to produce hardcopies and provide the hardware, software, and personnel needed to access them.¹³ The system must also maintain an audit trail between individual source documents and general ledger entries.

Indexing is where many businesses fall short. Each stored receipt should be retrievable by tax year, expense category, and vendor. The IRS treats the requirement as met if the system is functionally comparable to a reasonable paper filing system.¹³ Machine-sensible records in your accounting software must contain enough transaction-level detail that source documents can be identified, and they have to reconcile with both the books and the return.¹⁴

A Practical Retention Schedule

With federal, state, card-network, and PCI clocks all running at once, the workable approach is to set a default period based on the longest rule that touches each category, then flag the exceptions.

Routine business expense receipts: at least three years from the filing date, six if there’s any chance income was underreported by more than 25%.²
Employment tax and reimbursement records: at least four years after the tax is due or paid.⁵
Asset purchase receipts: until the asset is fully depreciated or sold, plus three years.²
Bad debt or worthless security losses: seven years from the filing date.²
Customer sales receipts for sales tax: the full statutory period in every state where you collect, typically three to six years.
Customer transaction records for chargeback defense: at least 13 months from the transaction date, or longer if your merchant agreement requires it.
Unfiled or fraudulent return years: indefinitely.³

A default seven-year retention policy covers most common scenarios, with asset purchases and the indefinite cases handled separately. Whatever period you pick, mark destruction dates on the calendar and follow through. Keeping receipts with cardholder data longer than needed creates PCI liability for no reason.

1
Office of the Law Revision Counsel. 26 USC 6501 – Limitations on Assessment and Collection
2
Internal Revenue Service. How Long Should I Keep Records
3
Internal Revenue Service. Time IRS Can Assess Tax
4
Internal Revenue Service. Topic No. 305, Recordkeeping
5
Internal Revenue Service. Publication 15 (2026), (Circular E), Employer’s Tax Guide
6
Visa. Visa Core Rules and Visa Product and Service Rules
7
American Express. US Disputes Reference Guide
8
Internal Revenue Service. What Kind of Records Should I Keep
9
Internal Revenue Service. Publication 463, Travel, Gift, and Car Expenses
10
eCFR. 26 CFR 1.274-5 – Substantiation Requirements
11
PCI Security Standards Council. PCI Data Storage Dos and Donts
12
PCI Security Standards Council. PCI SSC Glossary
13
IRS.gov. Revenue Procedure 97-22
14
IRS.gov. Revenue Procedure 98-25