skills/project-closeout/references/regulated-industry-closeout.md

# Regulated-industry closeout

Use this reference to identify the applicable source and questions, not to infer obligations from an industry label. Confirm jurisdiction, entity, data and record type, contract, regulatory applicability, retention schedule, litigation or regulatory holds, and the responsible client function. Draft a disposition plan while material legal or policy questions remain open; do not represent it as approved or execute deletion without authority.

Sources below were checked September 5, 2026. Verify current text and applicability at the time of use, especially for a later engagement. If current-source tools are unavailable, name the unresolved verification instead of presenting a remembered retention period as current law.

## Financial services

For US banking model-risk work, [Federal Reserve SR 26-2](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm), issued April 17, 2026, supersedes SR 11-7 and SR 21-8. Check its applicability and the relevant regulator's guidance rather than assuming every quantitative model or institution is covered identically. Transfer the model inventory, version, data and assumptions, validation evidence, limitations, operating controls, and ownership relevant to the engagement.

For UK bank model-risk work, consult the [Bank of England/PRA SS1/23 source page](https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss) and confirm the applicable version, effective provisions, and institutional scope. Other jurisdictions require their own regulator and policy sources.

Archive decision, change, and approval evidence under the client's applicable record schedule. There is no universal seven-year rule for every financial-services engagement artifact.

## Healthcare and protected information

For US HIPAA business-associate arrangements, consult [HHS business-associate contract provisions](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html). Return or destruction on termination is subject to the applicable agreement and feasibility provisions; information that must remain may carry continuing restrictions and safeguards. Do not assume ending the engagement eliminates obligations for retained information or subcontractors.

Identify the actual PHI, custodians, copies, transfer recipient, permitted retention, disposition method, confirmation evidence, and ongoing protections. Coordinate with the client's privacy/compliance owner. Clinical workflow acceptance and records retention depend on the specific activity and authority, not a generic healthcare checklist.

## Government and public sector

For US federal contract closeout, consult [FAR 4.804](https://www.acquisition.gov/far/4.804) and the relevant subsections, agency rules, contract clauses, and contracting-officer authority. Confirm which closeout actions belong to the client or contracting authority and which the consultant must support. Do not treat completion of work as automatic administrative contract closure.

Preserve relevant audit records, ownership, security obligations, and disclosure markings under the applicable agreement and law. Other governments have different procurement and information-access regimes. A confidentiality label alone does not establish an exemption from disclosure.

## Disposition decision

Record the record/data category, controlling source and applicability, retention trigger and period if verified, holds, owner, approved disposition, and evidence of completion. Resolve conflicts between deletion requests, retention obligations, contracts, and holds with the authorized function. Transfer responsibility for outstanding attestations, audit responses, and continuing safeguards before resource release.