What's the simplest rule for how long to keep invoices and receipts?

If you operate in only one country, follow that country's rule. If you operate in two or more, default to seven years; that satisfies IRS, CRA, HMRC, and ATO baseline requirements, with a small margin for the long-tail rules (IRS bad-debt deductions, audits, lengthy assessment windows). Seven years is the practical right answer for almost every small business.

What does the IRS specifically require?

The IRS uses a tiered system. Default: three years from the date you filed (or two years from the date you paid the tax, whichever is later). Underreported income by more than 25%? Six years. Worthless-securities losses or bad-debt deductions? Seven years. No return or a fraudulent return? Keep records indefinitely. Employment tax records have their own rule: at least four years from the date the tax becomes due or is paid.

How long does CRA require Canadian businesses to keep records?

CRA's general rule is six years from the end of the last tax year the records relate to. Some specific records (incorporation documents, share registers, board minutes) have to be kept 'permanently', meaning until two years after the corporation is dissolved. CRA can require records to be kept longer in specific circumstances, like an active audit or a notice of objection. If you want to destroy records earlier than six years, you have to apply to the CRA for written permission first.

What are the UK retention rules?

HMRC distinguishes between self-employed and limited companies. Self-employed must keep records for five years after the 31 January submission deadline of the relevant tax year, so records for the 2025–26 tax year (with a 31 January 2027 filing deadline) must be kept until 31 January 2032. Limited companies must keep accounting records for six years from the end of the company's financial year they relate to (longer in some cases: for example, where transactions cover more than one accounting period or where the company has bought something it expects to last more than six years). VAT records must be kept for six years.

Is digital storage acceptable, or do I need paper?

Digital storage is acceptable in all three jurisdictions, with conditions. The IRS allows electronic storage under Rev. Proc. 97-22, provided records are accessible, accurate, and reproducible. CRA accepts electronic records if they're readable and can be reproduced in human-readable form. HMRC requires records to be readable and accessible, and Making Tax Digital actively requires digital records for VAT-registered businesses. The conditions are essentially the same across jurisdictions: backups, format-stable files (PDF rather than proprietary formats), and the ability to produce records on demand.

What about non-tax records like contracts and bank statements?

Contracts: keep until the limitation period for claims under them has expired — commonly six years (though it varies; California is four years for written contracts). Bank statements: same period as the underlying tax records, since they support what you reported. Large-asset purchase records: keep as long as you own the asset plus the tax-records period after disposal, because capital-gains math reaches back to the original purchase. Insurance policies: keep until the policy lapses plus a few years.

How Long to Keep Invoices and Receipts

Record-retention timeline: US IRS runs 3 years by default, 6 years for under-reported income, and 7 for bad-debt claims; Canada CRA is 6 years; UK self-employed 5 years and limited companies and VAT 6 years, with 7 years as the pragmatic global floor.

Why retention matters more than businesses realize

Ask three tax authorities how long to keep invoices and receipts and you'll get three different answers. Small businesses tend to underestimate record retention on three counts.

First, the audit window in any country is longer than the default rule. The IRS can audit six years back (not three) if you understated income by 25%. CRA can extend its 6-year window during an active review. HMRC can go back 20 years for deliberate behavior. The "headline" retention period is the floor, not the ceiling.

Second, records you don't have are records you can't defend. When an auditor asks for a 2020 invoice and you can't produce it, you don't get the deduction, even if it was legitimate. Missing records turn into denied expenses, which turn into back taxes, interest, and penalties.

Third, storage cost is trivial; reconstruction cost is enormous. A decade of invoice PDFs is maybe 2–5 GB on a cloud drive. Reconstructing 2020 records when CRA opens a review in 2026 is days of staff time and probably an accountant's bill in the four figures.

Retention is cheap insurance against an event that's unlikely in any given year but close to inevitable across a 20-year business lifespan.

United States: the IRS tiered rules

The IRS publishes a record-retention reference (linked above) with the following structure. Apply the longest period that matches any record:

3 years. Default for income tax records. Keep for at least three years from the date you filed the return, or two years from the date you paid the tax, whichever is later.
6 years. If you underreported income by more than 25%, the assessment window doubles to six years. Keep records six years if there's any chance of an audit on understatement grounds.
7 years. For records relating to claims for losses from worthless securities or bad debt deductions.
Indefinitely. If you didn't file a return for that year, or filed a fraudulent return.
At least 4 years for employment tax records (FICA, FUTA, withheld income tax). This applies if you have any employees.
Until the period of limitations expires for the tax return on which depreciation, amortization, or depletion deductions are claimed for the underlying asset: meaning, for capital assets, you have to keep the original purchase records as long as you depreciate them, plus three years after.

The practical IRS recommendation, paraphrasing the IRS's own guidance: "the period of limitations is the period of time in which you can amend your tax return to claim a credit or refund, or that the IRS can assess additional tax." Most small businesses use the 7-year mark as a single rule that covers virtually every IRS scenario.

Canada: the CRA 6-year rule

CRA's general rule is simpler than the IRS's: keep records for six years from the end of the last tax year they relate to. For an invoice issued in March 2026 (calendar tax year 2026), the retention period runs from January 1, 2027 through December 31, 2032.

A few wrinkles:

Permanent records. If you operate as a corporation, certain records (articles of incorporation, by-laws, share registers, minutes of directors' and shareholders' meetings) must be kept permanently, in practice until two years after the corporation is dissolved.
Active matters. If CRA has issued a notice of objection or there's an open appeal, keep all related records until the matter is resolved plus six years afterward.
Early destruction requires permission. If you want to destroy records before the six-year period ends, you have to apply to CRA in writing (Form T137). CRA may grant permission in narrow circumstances.
GST/HST and payroll records follow the same six-year rule from the end of the relevant period.

For sole proprietors, the rule applies to your personal tax records as they relate to the business (since unincorporated businesses are reported on the personal return).

United Kingdom: HMRC's two regimes

HMRC's retention requirements differ depending on whether you're self-employed or a limited company.

Self-employed (sole traders and partnerships):

Five years after the 31 January submission deadline of the relevant tax year.
Self-Assessment for the 2025–26 tax year is due 31 January 2027. You must keep those records until 31 January 2032.

Limited companies:

Six years from the end of the company's last financial year the records relate to.
Longer in specific cases: for example, transactions that cover more than one accounting period, or capital allowances claimed on assets you expect to last more than six years.

VAT records (for VAT-registered businesses of any structure):

Six years.
Making Tax Digital for VAT requires these records to be kept digitally.

If HMRC has opened an inquiry, you must keep records until the inquiry is closed plus the normal retention period.

Other major jurisdictions (quick reference)

Australia (ATO): Generally 5 years from the date the records were prepared, obtained, or the transaction was completed (whichever is later). Some records (capital gains, superannuation) may have longer periods.
Ireland (Revenue): Generally 6 years for both individuals and companies.
European Union: Most member states require 5 to 10 years; specifics depend on the country's tax authority. Germany, for example, still requires 10 years for ledgers and annual financial statements, though its retention period for invoices and booking documents dropped to 8 years from January 2025.

If you operate across borders, default to the longest applicable period. Seven years is the global pragmatic floor; ten years if you have material activity in Germany or another long-retention jurisdiction.

Digital storage: what counts and what doesn't

All three jurisdictions accept electronic records, with substantively similar conditions.

IRS (Rev. Proc. 97-22): Records must be complete, accurate, and reproducible in legible form. The system must include internal controls — backups, audit trails, recovery procedures. The IRS may require an index and the ability to search, and records must be available within a reasonable time when requested.

CRA: Electronic records are acceptable if they're readable and reproducible in human-readable form. Records must remain legible for the entire retention period, so formats that become obsolete (e.g., proprietary 1990s software) create a compliance gap. CRA can require records in a specific format during an audit.

HMRC: Records must be legible and accessible. For VAT, Making Tax Digital requires digital records with digital links to the submission — paper records or hand-keyed numbers from a spreadsheet to the portal don't satisfy MTD. HMRC accepts cloud storage (Google Drive, OneDrive, Dropbox) provided access controls are reasonable.

Practical implications:

Use PDF/A or plain PDF rather than proprietary formats. Word documents, Excel spreadsheets, and accounting-software formats all carry obsolescence risk.
Back up. A single cloud drive is fine for the records themselves, but keep a copy on a second cloud drive or local disk.
Don't rely on third-party platforms alone. If you store invoices only in Stripe, Square, QuickBooks, or another SaaS platform, you're exposed if that platform changes its retention policy or your account lapses. Export PDFs to your own storage on a recurring schedule.
Index sensibly. Folders by year and type (invoices/receipts/contracts) is enough for most small businesses. Larger businesses should maintain a metadata index.

A practical retention system

A simple structure that covers most small businesses:

/Records
  /2020
    /Invoices-out
    /Invoices-in (received from suppliers)
    /Receipts
    /Bank-statements
    /Tax-returns
    /Payroll
    /Contracts
  /2021
    ...

For each year, retain:

Every issued invoice (PDF) and the corresponding payment record.
Every supplier invoice and corresponding payment record.
Every receipt for an expense you intend to deduct.
Bank, credit-card, and payment-processor statements.
The completed tax returns plus all supporting schedules.
All payroll records (separate folder, since the retention period differs in some jurisdictions).
Signed contracts, proposals, and quotes.

Run a quarterly export from any third-party platform you use (your accounting software, your invoicing tool, your payment processor) into your own archive folder. Don't rely on the platform retaining records for you indefinitely.

Run an annual close-out at the end of each fiscal year: confirm everything from that year is in the archive folder, lock the folder (read-only), and start the next year fresh.

Run a deletion review at the start of each year to remove anything that's now beyond your retention period (typically 7+ years old). For most small businesses, deletion is mostly symbolic; the storage cost is so low that there's rarely a reason to delete at all.

Secure disposal: when you do destroy records

Eventually you'll want to dispose of older records: either because they're past every retention requirement or because they contain personally identifiable information you no longer have a basis to retain (GDPR, CCPA, PIPEDA all impose retention limits on personal data).

Two principles:

Don't just delete digital records. Empty the recycle bin, then run secure-erase tools on local storage. For cloud storage, deletion is generally sufficient (most cloud providers handle the underlying erasure on their end), but check the platform's data-destruction policy.
Shred paper. Cross-cut shredders (security level P-3 or higher) for routine business records; P-5 or higher for sensitive personal data. For volumes that justify it, use a certified document destruction service that provides a Certificate of Destruction.

For data subject to GDPR (EU/UK) or PIPEDA (Canada), a retention schedule that documents what's kept, why, and for how long is itself a compliance artifact; auditors expect to see one if asked.

Common retention mistakes to avoid

Relying on email. Inbox storage is not a record-retention system. Search fails, accounts get suspended, and email providers have their own retention limits.
Trusting the SaaS platform forever. Stripe, QuickBooks, FreshBooks, Square: all reputable, all subject to data-loss events, account closures, and policy changes. Export to your own storage.
Mixing personal and business records. When an audit arrives, extracting business expenses from a stream of personal grocery receipts is painful and error-prone. Keep them separate from day one.
Deleting at the headline period. The IRS 3-year rule is the floor. Default to 7 years for most US records; 6 years for Canada and the UK; 7+ years if you operate across borders.
Underestimating capital records. Anything depreciable or amortizable needs its original purchase receipt for as long as you own the asset — not just the standard tax-records period.