(a) Entities required to report. Each issuer that is not otherwise exempt from the requirements of this part under §235.5(a) and each payment card network shall file a report with the Board in accordance with this section.

(b) Report. Each entity required to file a report with the Board shall submit data in a form prescribed by the Board for that entity. Data required to be reported may include, but may not be limited to, data regarding costs incurred with respect to an electronic debit transaction, interchange transaction fees, network fees, fraud-prevention costs, fraud losses, and transaction value, volume, and type.

(c) Record retention.

(1) An issuer subject to this part shall retain evidence of compliance with the requirements imposed by this part for a period of not less than five years after the end of the calendar year in which the electronic debit transaction occurred.

(2) Any person subject to this part having actual notice that it is the subject of an investigation or an enforcement proceeding by its enforcement agency shall retain the records that pertain to the investigation, action, or proceeding until final disposition of the matter unless an earlier time is allowed by court or agency order.