Record-Keeping and Retention Rules
Record-keeping is one of the most important, and most overlooked, parts of running a dispensary.
If you cannot show complete, accurate, and organized records during an inspection or renewal, OCM treats it as a compliance failure.
This page explains what you must keep, how long you must keep it, and what counts as “on-site and available” during an inspection.
What Records You Must Keep
You must keep all records tied to your cannabis operations, including:
Sales and POS Records
- All sales transactions
- Voids, refunds, and canceled transactions
- Discounts (only if approved by OCM)
- Cash logs and reconciliation reports
Inventory and METRC
- Intake logs
- METRC packages, transfers, and adjustments
- Daily inventory counts
- Weekly cycle counts
- Quarantine logs
- Waste and destruction logs
- Recall logs
Delivery Records
- Driver manifests
- Delivery logs
- Attempted delivery logs
- ID verification records
- Vehicle assignment logs
- W-2 proof for delivery drivers
Security Records
- Camera footage
- Camera maintenance and downtime logs
- Alarm system activity logs
- Access control logs for restricted areas
Staff and Labor Records
- Employee roster
- New hire forms (I-9, W-4, state forms)
- Schedules and hours worked
- Payroll records
- Overtime logs
- Training records (ID checks, METRC, security, waste, safety)
- Termination records
Financial and Corporate Records
- Bank statements
- Tax filings
- Fee payments
- Ownership and control documentation
- Operating agreements
- Vendor contracts
OCM Compliance Records
- Inspection reports
- Incident reports
- OCM notices, warnings, or corrective action letters
- License documents
- Insurance coverage verification
Facility and Safety Records
- Fire inspection reports
- DOB and FDNY permits
- Certificate of Occupancy or Temporary Certificate of Occupancy
- Maintenance logs
- Safety Data Sheets (SDS)
OCM expects all required records to be complete and available on demand.
How Long You Must Keep Records
OCM does not accept partial retention or selective storage. The following minimum retention periods apply:
Five-Year Retention (Most Records)
You must retain at least 5 years of the following:
- Sales and POS records
- Inventory and METRC records
- Delivery logs and manifests
- Waste, destruction, and recall logs
- Inspection and audit records
- Ownership and corporate records
- Vendor contracts and agreements
- Banking and financial records related to operations
Camera Footage Retention
- Minimum required: 60 days
- Best practice: 90 days or longer
Footage must be retrievable immediately during an inspection.
Tax Records
- Minimum retention: 7 years
This includes:
- Cannabis tax filings
- Sales tax filings
- Federal tax records
- Supporting documentation
Employee and Labor Records (New York State)
- Minimum retention: 6 years
This includes:
- Payroll records
- Timecards
- Schedules
- Wage and hour documentation
Rule of thumb:
If a record supports compliance, keep it longer — not shorter.
Where Records Must Be Stored
Records must be:
- Stored on-site, or
- Electronically accessible immediately from the licensed premises
Acceptable storage methods include:
- Secure cloud storage with on-site access
- Locked filing systems
- POS and METRC exports
Unacceptable responses during an inspection include:
- “We don’t have access right now”
- “Our accountant keeps that off-site”
- “The owner has the password but isn’t here”
If a record cannot be produced promptly, OCM treats it as missing.
Electronic vs Physical Records
Electronic Records
Electronic records must be:
- Accessible on-site
- Secure
- Backed up
- Exportable for OCM review
- Maintained with access controls or change logs
Physical Records
Physical documents should be:
- Stored in a clearly labeled compliance binder
- Updated immediately after changes
- Available without delay
Daily Logs You Must Maintain
OCM expects daily documentation for:
- Opening and closing checklists
- Safe and vault access
- Cash handling
- Inventory adjustments
- Waste movements
- Delivery dispatch
- Security incidents
- Restricted area access
- Camera uptime and downtime
If an activity occurs daily, it must be logged daily.
OCM, State, and City Requirements Apply Together
Your record-keeping system must satisfy all applicable layers.
New York State Requirements
- Labor law compliance
- State and local tax rules
- New hire reporting
- Workers’ compensation and disability insurance
New York City Requirements (if applicable)
- Predictive Scheduling
- Paid Safe and Sick Leave
- Wage theft documentation
- Local reporting requirements
Compliance means meeting every layer at the same time.
What Inspectors Look For
Inspectors assess whether records are:
- Complete
- Accurate
- Consistent
- Accessible
- Current
- Supported by documentation
They routinely cross-check:
- POS versus METRC
- METRC versus physical inventory
- Payroll versus schedules
- Delivery logs versus manifests
- Training records versus job duties
- Security logs versus camera footage
Discrepancies trigger escalation.
Common Violations
Operators are frequently cited for:
- Missing sales records
- Incomplete METRC data
- No documentation for waste
- Outdated employee files
- Missing training records
- Payroll and schedule mismatches
- Camera footage not retrievable
- Missing access logs
- Incident reports not filed
- Contracts stored off-site
Each item counts as a violation.
Why This Matters
When records are incomplete, OCM assumes:
- Sales are inaccurate
- Inventory is unmanaged
- Deliveries are untracked
- Staff are misclassified
- Compliance cannot be proven
This leads to:
- Fines
- Re-inspections
- Stop-sale orders
- License delays or loss
Related Pages
Source Material
- MRTA Sections 78, 79, 87, 89
- 9 NYCRR Retail Regulations
- New York State Labor Law (Record Retention)
- New York City Administrative Code (Scheduling and Payroll)
