How Far Back Do You Need Bank Statements for an IRS Audit?

Last updated July 2026.

Quick answer: The IRS can normally audit a return for three years after you file it, six years if you left out more than 25% of your income, and with no time limit at all if the return was fraudulent or you never filed. Because of the six-year window plus filing lag, the practical standard is to keep seven years of bank statements. That covers every ordinary audit scenario without holding records forever. Bad-debt and worthless-security claims also carry a seven-year rule, which is another reason seven is the number most accountants land on.

Two different questions get tangled together here, so separate them up front. One is how far back the IRS is allowed to look, which is set by law. The other is how long you should keep your records, which is a practical decision built around that law. They are related, but they are not the same number, and confusing them is how people either toss records too early or hoard them for a decade.

How many years can the IRS audit your return?

Three years is the general limit. Under the tax code, the IRS normally has three years from the date you file a return to audit it and assess more tax. That default covers the large majority of audits. There are two ways the window gets longer. If you understate your gross income by more than 25%, a substantial omission, the period doubles to six years. And if you file a fraudulent return or fail to file at all, there is no time limit: the IRS can come back whenever it wants because the clock never starts. A separate six-year rule also applies to unreported income from foreign financial assets over $5,000.

How far back should you keep bank statements?

Keep seven years. The IRS itself frames recordkeeping around the periods of limitation: keep records for three years in the ordinary case, six years if you failed to report income you should have and it is more than 25% of your gross income, and indefinitely if you did not file or filed a fraudulent return. Seven years is the number that safely spans the six-year substantial-omission window once you add the gap between the tax year and when you actually filed, and it also matches the IRS rule to keep records seven years if you claim a loss from worthless securities or a bad-debt deduction. Employment tax records are their own case: keep those at least four years after the tax is due or paid.

What is the six-year rule for an IRS audit?

The six-year rule applies when you leave a lot of income off the return. If you omit gross income that adds up to more than 25% of the gross income you did report, the IRS gets six years instead of three to audit and assess. This is not about a small rounding error; it is a substantial understatement. It is the main reason the three-year default is not a safe planning number on its own. You may believe you reported everything, but if the IRS disagrees and the gap crosses that 25% line, the older years are back in play. Keeping bank statements for the full six-plus-year window means you can actually prove your deposits and sourcing if that happens.

Can the IRS go back more than 10 years?

Yes, in the cases where there is no statute of limitations at all. If you never filed a return for a year, or you filed a fraudulent return, the assessment clock for that year never starts, so the IRS can examine it 10, 15, or more years later. Fraud and non-filing are the exceptions that remove the time limit entirely. For everyone who files honest returns, the practical ceiling is the six-year substantial-omission window, which is why seven years of records is enough for the vast majority of taxpayers and businesses.

How long do banks keep statements available?

Longer than you might think, but not forever, and self-service access is often shorter than the retention itself. Federal anti-money-laundering rules require banks to retain deposit-account records for five years. In practice, most US banks keep statements available online for roughly five to seven years, and many hold seven specifically to line up with tax audit windows. The catch is that the download you can pull yourself is usually much shorter, often just 90 days to 18 months of transaction history, even though the PDF statements go back years. If you close an account, that online access can disappear, so pull and save the statements while you still can. Note that the seven-years-online figure is a common industry practice, not a legal requirement; the legal floor is the five-year retention rule.

What records does the IRS want in an audit?

Bank statements are central, but they rarely stand alone. In an audit, the IRS typically wants the bank statements that show your deposits and payments, plus the documents that explain them: invoices, receipts, canceled checks, and the books that tie the two together. Deposits are where a lot of audits focus, because unexplained deposits look like unreported income until you can source them. That means keeping not just the statements but the paper trail behind each line, from customer invoices to the receipts backing your deductions. If your deductions rest on a pile of receipts, it pays to have them digitized and searchable, so a tool that can turn a shoebox of receipts into categorized expense records is worth setting up long before any letter arrives.

How to keep audit-ready bank statements

Download the statements now, while the account is open and the history is available, and store them as searchable data, not just PDFs in a folder. Seven years is a lot of statements, and if an auditor asks for average balances, specific deposits, or a full year of a particular category, digging through PDFs by hand is slow and error-prone. Converting each statement into clean, dated rows means you can filter, total, and answer questions in minutes. Our guide on how far back you can get bank statements covers retrieval, including from closed accounts, and the bank statement to Excel converter turns years of PDFs into a workbook you can search, so an audit request becomes a filter instead of a fire drill.