_______________

BULLETIN

_______________

No. 2022-3 June 3, 2022

Subject: Criminal History Record Information (CHRI) Retention 

The NIGC processes fingerprints submitted by tribes for background investigations of primary 

management officials (PMO) and key employees (KE). Prior to issuing a gaming license to a 

PMO or KE, a tribe is required to perform a fingerprint check through the FBI1 records system as 

part of the background investigation on each applicant. The criminal history record information 

CHRI2 obtained as a result of the check assists the tribe in determining the applicant's eligibility 

for employment.

This bulletin addresses FBI CHRI retention obligations and how these obligations may 

intersect with the National Indian Gaming Commission (NIGC) regulatory mandates for 

retaining primary management official and key employee licensing applications, eligibility 

determinations, and investigation reports.

I. CHRI & CHRI Dissemination 

Initially, it is important to understand the functions and purpose of the CHRI. CHRI

comprises “information collected by criminal justice agencies on individuals consisting of 

identifiable descriptions and notations of arrests, detentions, indictments, information[ ], or other 

formal criminal charges, and any disposition arising therefrom, including acquittal, sentencing, 

correctional supervision, and release. The term does not include identification information such 

as fingerprint records if such information does not indicate the individual’s involvement with the 

criminal justice system.”3 CHRI is also information that is transferred or reproduced directly 

from CHRI or information that confirms the existence or nonexistence of CHRI.4 CHRI includes 

 1 Federal Bureau of Investigation.

2 Criminal History Record Information.

3 28 C.F.R. § 20.3.

4 See Next Generation Identification Audit, Noncriminal Justice Access to Criminal History Record Information, 

Policy Reference Guide (hereinafter NGI) at 1 (Apr. 6, 2020).
any media that contains CHRI, such as: letters, emails, documents, notes, conversations— in 

person or via phone/text, and spreadsheets or tables.5

In order to assist, TGRAs6 determine the eligibility of applicants for key employee (KE) 

or primary management official (PMO) positions in their gaming operation(s), the NIGC obtains

CHRI from the FBI on these applicants and disseminates it to the TGRAs. The NIGC provides 

this assistance pursuant to a joint MOU7 between the agency and TGRAs, which memorializes

the parties’ understandings and responsibilities regarding the submission of noncriminal justice 

fingerprints and the transmittal, receipt, storage, use, and dissemination of CJI8 and CHRI. As 

noted, this bulletin’s focus is retention of CHRI after its proper use.

II. CHRI Retention Obligations

A. CHRI retention 

So how long must TGRAs retain CHRI? CHRI may be destroyed as soon as practicable 

by TGRAs—potentially at the conclusion of a licensing appeal process or the CHRI audit 

process (whichever comes later), in accordance with the TGRA’s media sanitization and 

destruction policy. The FBI CJIS Security Policy instructs that CHRI “records shall be stored for 

extended periods only when they are key elements for the integrity and/or utility of case files 

and/or criminal records.”9 Further, the policy indicates that “[p]hysical media shall be securely 

disposed of when no longer required . . ..”10

B. CHRI & NIGC regulatory retention requirements

i. Investigation reports & sanitizing CHRI

NIGC regulations do not require that CHRI itself be retained,

11 just summary CHRI if it

is transferred into an investigation report.

12 Specifically, NIGC regulations, Sections 556.6 

(b)(2)(iii)(C) and (D) require that an investigation report include “every known criminal charge . 

. .” and “every felony . . ..” So TGRAs may put summary CHRI in an investigation report. Under 

NIGC regulations, an investigation report must be retained by a TGRA for three (3) years from 

the date of the primary management official (PMO) or key employee’s (KE) employment 

termination date.13

 5 Id.

6 Tribal Gaming Regulatory Agencies.

7 Memorandum of Understanding.

8 Criminal Justice Information is the term used for the FBI Criminal Justice Information Services (CJIS) provided 

data necessary for law enforcement and civil agencies to perform their missions including, but not limited to 

biometric, identity history, biographic, property, and case/incident history data. 9 See CJIS Security Policy, Section 4.2.4. 10 Id. at Section 5.8.4. 11 See 25 C.F.R. parts 556 and 558. 12 See 25 C.F.R. §§ 556.6 (a) & (b)(2)(iii)(C) and (D); 558.3(e). 13 25 C.F.R. § 558.3(e).
But TGRAs may avoid putting summary CHRI in investigation reports—and maintaining 

CHRI for a significant period of time with its required protections14—by sanitizing the CHRI. To 

sanitize CHRI, TGRAs use it as a lead to reach out to source record-owners, such as local courts 

or state criminal history record repositories, and obtain the original criminal history15. 

Importantly, both the process used to acquire the source record information and the resulting 

original criminal history information must not directly reference or be attributed to the national 

FBI check. This is because information is considered CHRI if it confirms the existence or 

nonexistence of CHRI. 

ii. Licensing applications & eligibility determinations

The other documents that NIGC regulations direct be held for three years after a KE or 

PMO’s termination do not necessitate the inclusion of CHRI or a summary of it.16 Applications 

for KE and PMO licensing explicitly contain only information from the applicant.17 NIGC 

regulations require that “[a] tribe shall request from each primary management official and from 

each key employee [certain] information . . . ,” including felony, misdemeanor, and criminal 

charges.18 Such information is not CHRI though, because it is not from a criminal justice 

agency.19 And fingerprints given as part of that application also are not CHRI.20 

Eligibility determinations simply require that the TGRA review a person’s criminal 

record and determine if they are suitable.21 So eligibility determinations should not include 

CHRI or a summary of it. Of course TGRAs need to be careful not to summarize, reproduce, or 

confirm the existence or nonexistence of CHRI in eligibility determinations, as that constitutes 

summary CHRI.22 If TGRAs do include CHRI in the eligibility determination, then it must be 

maintained for three (3) years from the date of the PMO or KE’s employment termination.

iii. Abbreviated background investigations 

Finally, CHRI results also may be destroyed as soon as practicable when TGRAs 

implement an abbreviated background investigation process. This occurs when after the 

 

14 See CJIS Security Policy, Sections 4 and 5; see also NIGC Bulletin No. 2020-2, Fingerprint processing — 

applicant Privacy Act rights and protecting CHRI at 3-4 (Feb. 18, 2020), 

https://www.nigc.gov/images/uploads/bulletins/Bulletin_-_Privacy_Act_rights_protecting_CHRI_-

_FINAL_FINAL.pdf 15 Or, in other words, source record information. 16 See 25 C.F.R. § 558.3(e). 17 See 25 C.F.R. § 556.6(a) (“the tribe shall maintain a complete application file containing the information listed 

under 556.4(a)(1) through (14)”).

18 See 25 C.F.R. § 556.4(a). 19 See 28 C.F.R. § 20.3(g)(2). 20 See National Identity Services Audit Noncriminal Justice Access to CHRI, Policy Reference Guide at 1 

(07/22/2019) (CHRI “does not include identification information such as fingerprint records if such information 

does not indicate the individual’s involvement in the criminal justice system.”). 21 See 25 C.F.R. § 556.5. 22 See National Identity Services Audit Noncriminal Justice Access to CHRI, Policy Reference Guide at 1 

(07/22/2019) (“Information is considered CHRI if it is transferred or reproduced directly from CHRI received as a 

result of a national FBI Check . . .. Information is considered CHRI if it confirms the existence or nonexistence of 

CHRI.”)).
submission of a completed application, CHRI is requested, evaluated, and then used to ask the 

applicant to withdraw their application. In those cases, TGRAs do not prepare an investigation 

report, make an eligibility determination, or create and submit a Notice of Results (NOR). 

Consequently, summary CHRI is not contained in any of those documents and may be destroyed 

upon the application’s withdrawal, in accordance with the TGRA’s media sanitization and 

destruction policy. 

III. Conclusion 

In sum, NIGC regulations do not require that CHRI results themselves be retained, and

such results may be destroyed as soon as practicable by a TGRA. Also, TGRAs must be careful 

to sanitize CHRI for purposes of investigation reports and avoid including summary CHRI or 

confirming its existence or nonexistence in eligibility determinations. Doing so ensures that 

CHRI is not subject to the NIGC regulatory retention requirements for investigation reports and 

eligibility determinations. 

Should you have any questions regarding the information covered in this bulletin, please 

contact a NIGC Region Office or the CJIS Audit Unit at cau@nigc.gov.