ATF Ruling 2016-1 & 2022-01 Checklist for Electronic FFL Records
By Dana Fales · Published
No. ATF does not approve, certify or endorse any commercial FFL software. In ATF's words, the Bureau "does not issue blanket approvals for commercially available software programs nor does it endorse any particular product." (ATF, Prescribed Requisites for Computerized A&D Software, ATF's older guidance from the era when electronic books needed an individual variance.) Instead, ATF Ruling 2016-1 lets any licensee keep acquisition and disposition (A&D) records electronically, without applying for a variance, if their system and practices follow every condition below. ATF Ruling 2022-01 does the same for keeping Forms 4473 electronically.
Not legal advice. This page explains what the rulings say in plain English. Read the full rulings at atf.gov and confirm your own setup with your ATF Industry Operations Investigator (IOI) or area office before you rely on it. Verified against atf.gov on September 25, 2026.
Do you need a variance? No, if you follow the conditions
Ruling 2016-1 (approved April 29, 2016) replaced Ruling 2013-5. It's a standing authorization: a dealer, importer, manufacturer or collector who follows all of its conditions may keep A&D records electronically without asking ATF for their own variance. Paper bound books are still allowed. The catch is in the ruling's last section: if you stop following any condition, you're no longer authorized to keep the records electronically until you follow all of them again.
How to read the tables
Each row has four parts:
- What the ruling says, in plain English, with nothing added.
- What you do: the steps that are on you, whatever software you use.
- What to look for in software: the questions to ask any vendor.
- What FFL Command Center does: features only, next to the condition they relate to. Following each condition is the licensee's responsibility; this page doesn't claim any feature satisfies one. A dash (—) means we don't list a feature for that condition.
Ruling 2016-1: the 14 conditions in plain English
| # | What the ruling says | What you do | What to look for in software | What FFL Command Center does |
|---|---|---|---|---|
| 1 | Record all required A&D information (27 CFR 478.121–.125, 479.131), including both manufacturer and importer. Extra columns are fine if they're separate and the required information stays readily apparent. A 4473 serial number can stand in for a non-licensee's address if 4473s are filed numerically. | Enter complete data on every line. | Separate manufacturer and importer fields; required information clearly apparent. | A&D entries capture the required fields; a firearm received on a purchase order can't enter the book without a serial. |
| 2 | Track corrections using one of three methods: (a) keep each correction as a new entry and let you view originals only, corrections only, or both; (b) print corrections as a separate report with the same information as the book; or (c) for spreadsheets, a notes column saying what changed, who changed it and why. | Use the correction tool; never overwrite. | Which of the three methods it uses. | Every A&D correction requires a reason and keeps a before-and-after trail; the audit log records who changed what and when. |
| 3 | No relying on invoices or paper for required information. If any A&D record is electronic, all must be, including gunsmithing, sales and NFA. | Move every book into the system, including repair and NFA. | Room for every book type you keep. | A separate Repair Bound Book in the same system; NFA records in the same database. |
| 4 | Must allow queries by serial number, acquisition date, manufacturer or importer name, purchaser name, purchaser or transferee address, and 4473 transaction number. | Nothing, beyond knowing how to run them. | All six searches, not just serial. | Server-side bound book search by serial, make or model, plus a serial history page. The 4473 list searches by buyer, serial, NTN and form number. |
| 5 | Download all records to a physical storage device at your premises (or print them): (a) at least every six months, or daily if downloaded from a host facility, always unencrypted with the required information readily apparent; (b) within 24 hours of an ATF officer's request; (c) before changing software, database or host; (d) before discontinuing business. Downloads list inventory and transfers sequentially by acquisition date. | Run the downloads on schedule and on each trigger. | An unencrypted export in acquisition-date order; a printable book. | The live database is not the download. For the download, export your A&D bound book to CSV or PDF any time (ATF, Inspection Export), save it to a drive at your premises, and repeat on schedule and on each trigger. |
| 6 | Keep each download until the next one; be able to present the current records in print at ATF's request. | Keep the last download. | On-demand printing. | Export your A&D bound book to CSV or PDF any time (ATF, Inspection Export), plus sales, inventory and other reports to CSV. |
| 7 | If you print instead, keep each printout until the next. | Keep the last printout. | n/a | n/a (a dealer step). |
| 8 | Downloads and printouts may include antique firearms, identified as antiques in the type column, but no other merchandise. | Keep accessories out. | Firearms-only book output. | Accessories never enter the A&D record; purchase order receiving and the ATF records both exclude them. |
| 9 | Records may be on your own server or device, or at a contracted host facility (remote server or cloud), if they're readily accessible from a device at the premises during business hours, and your server is in the U.S. or the host facility has a U.S. business premises and is subject to U.S. legal process. Encryption is strongly encouraged. | Keep the PC at your licensed premises; check any host. | Where the records physically are. | The live database runs on a PC you own and operate, which should sit at your licensed premises. Daily encrypted backup with off-site copies (a folder, NAS, USB drive or Backblaze B2). If you use off-site or cloud backup, ATF Rulings 2016-1 and 2016-2 require notifying your ATF Area Office of the host facility within 30 days. We'll give you the details to include. |
| 10 | If you contract with, lease from or change a host facility, notify your ATF area office of its name and address within 30 days. | Send the notice. | Who the host is. | If you use off-site or cloud backup, ATF Rulings 2016-1 and 2016-2 require notifying your ATF Area Office of the host facility within 30 days. We'll give you the details to include. |
| 11 | Each license's records on a separate or partitioned database, not intermingled with another license's. | One book per license. | How multiple licenses are kept apart. | Multiple licenses share one database, partitioned by license: a gun acquired under license A isn't in license B's book. |
| 12 | Back up at least daily. | Leave backups on. | Automatic daily backup. | Daily encrypted backup. If you use off-site or cloud backup, ATF Rulings 2016-1 and 2016-2 require notifying your ATF Area Office of the host facility within 30 days. We'll give you the details to include. |
| 13 | Keep records as 27 CFR 478.129 requires. ATF strongly recommends that records reaching 20 years be kept permanently or sent to ATF's records center for discontinued businesses. | Don't delete. | Nothing auto-purges. | The uninstaller never deletes the bound book, 4473s or backups. |
| 14 | On discontinuing business, send records to ATF's records center for discontinued businesses under 27 CFR 478.127, as a printout and/or download that includes an ASCII text file of all A&D records plus a file description. | Send them within the deadline. | ASCII text export with a file description. | A&D bound book export to CSV or PDF (ATF, Inspection Export). The software doesn't produce the ASCII text file and file description; plan to prepare those separately. |
Source: ATF Ruling 2016-1.
Backups and downloads: the part dealers miss
Daily backups and downloads are different things. A backup protects against a crash. A download is ATF's way of making sure a complete, unencrypted copy of the book sits at your premises. Here's the calendar the ruling sets:
| When | What | Condition |
|---|---|---|
| Every day | Back up the records | 12 |
| At least every six months (daily if pulled from a host) | Download to a device at the premises, unencrypted, in acquisition-date order, or print | 5(a) |
| Within 24 hours of an ATF officer's request | Download or print | 5(b) |
| Before changing software, database or host | Download or print | 5(c) |
| Before discontinuing business | Download or print | 5(d) |
| Always | Keep the latest download or printout until the next one | 6, 7 |
If you use off-site or cloud backup, ATF Rulings 2016-1 and 2016-2 require notifying your ATF Area Office of the host facility within 30 days. We'll give you the details to include.
If you're switching products, condition 5(c) is the step to do before you cancel anything. Plan the move with your ATF Area Office. ATF Rul. 2022-01 requires written notice 60 days before you implement electronic 4473 storage, and 2016-1 requires a full download of your bound book before changing software. See how to switch FFL software.
Cloud-hosted records: extra conditions
If your records live with a host facility, meaning a remote server or cloud provider:
- The records must be readily accessible from a computer or device at your licensed premises during regular business hours.
- The host facility must have a business premises in the United States or its territories and be subject to U.S. legal process.
- ATF strongly encourages encryption for the stored data.
- Within 30 days of contracting with, leasing from or changing a host, notify your ATF area office of the host's name and address.
- Downloads to your premises happen at least daily.
Ruling 2022-01: keeping 4473s electronically
Ruling 2016-2 lets you complete a 4473 electronically but still requires a printed copy. Ruling 2022-01 (approved August 17, 2022) lets you keep electronically completed 4473s electronically instead of on paper, if you follow its 18 conditions. For how the 4473 itself works in FFL Command Center, see electronic 4473 software.
| Group | # | What the ruling says | Who | What FFL Command Center does |
|---|---|---|---|---|
| Before you start | 1 | Written notice to your local ATF Industry Operations area office 60 days before you start keeping 4473s electronically. | You | n/a (a dealer step). Plan the move with your ATF Area Office. ATF Rul. 2022-01 requires written notice 60 days before you implement electronic 4473 storage, and 2016-1 requires a full download of your bound book before changing software. |
| 2 | Forms must first be completed electronically under Ruling 2016-2, and all forms kept electronically. | You + system | Electronic 4473 completed on a buyer kiosk and your PC (completion relates to ATF Rul. 2016-2). | |
| Storage | 3 | Unalterable format. The original can't be deleted or changed; corrections go on a copy attached to the original. | System | A completed 4473 is sealed. Corrections are recorded as permanent annotations with who, when, and why, and the original is never overwritten. |
| 4 | Supplemental forms (multiple-sale reports, nonimmigrant alien exception documents) attached at the end of the 4473. | System | — | |
| 9 | Back up each form when a transaction is completed or stopped. | System | The software backs up daily, not at the moment a form is completed or stopped. If you use off-site or cloud backup, ATF Rulings 2016-1 and 2016-2 require notifying your ATF Area Office of the host facility within 30 days. We'll give you the details to include. | |
| 13 | When a transaction is stopped, pending or completed, save the form immediately, unencrypted, to a storage device at the premises (hosted systems also update an onsite copy the same day). | System | A PDF is saved on your PC when a transaction is completed or denied. Delayed, pending, cancelled and stopped forms don't get that immediate copy today. | |
| Inspection | 5 | ATF gets uninterrupted, read-only access to the database. | You + system | Read-only ATF inspector login. |
| 6 | At least one terminal per 500 forms from the previous 12 months; no more than five required. | You | One Windows PC holds your records. A second register or the 4473 tablet can connect over your shop network in a browser. It is not a multi-server or synced multi-PC system. | |
| 7 | Any form can be printed, and you print on ATF's request. | You + system | A PDF of any completed or denied form, on demand. | |
| 8 | Forms kept in alphabetical, chronological or numerical order; searchable by buyer name, transfer date, transaction number, firearm type, model, manufacturer or importer, caliber or gauge, and serial number. | System | 4473 list search by buyer, serial number, NTN and form number. | |
| 10 | Toggle between a 4473 and the A&D record. | System | Each 4473 links to its bound book entry. | |
| 11 | Flag or set aside forms for review during an inspection. | System | — | |
| 12 | Sort forms during an inspection. | System | — | |
| Paper and scanning | 14 | If the system is down and you use paper forms, keep the originals (unless scanned under this ruling); deliver them to ATF or a successor on closing. | You | You can record the buyer's section from a paper form and carry on to the background check. |
| 16 | Paper forms more than 3 years old may be scanned and kept electronically under the storage and inspection conditions above. | You + system | Historical paper 4473s can be scanned in. | |
| 17 | Scans must be exact, complete images, not alterable without tracking, and saved onsite; destroy paper only after verifying the scan. | You + system | — | |
| Closing | 15 | On discontinuance or succession, deliver electronic forms to ATF's records center for discontinued businesses as TIFF, JPEG or PDF images, with text recognition off and images flattened, in name, date or transaction-number order. | You + system | — |
| 18 | File names for scanned paper forms sent to the Records Center contain no personal information. | You + system | — |
If any condition isn't met, the ruling says you're no longer authorized to keep 4473s electronically and must go back to paper. Until you've confirmed every row, including the 60-day notice, keep printing under 2016-2. Source: ATF Ruling 2022-01 · ATF Ruling 2016-2.
What's changing: proposed rules (not final)
ATF has proposed rules pending that touch these records, including:
- Firearms Electronic Record-Keeping, RIN 1140-AA94 (FR doc 2026-09158, May 8, 2026; comments closed August 6, 2026).
- Revising Firearms Transaction Record, "Form 4473" (91 FR 25432, May 8, 2026; comments closed August 6, 2026).
As of September 25, 2026 neither is final. Nothing changes until a final rule is published; Rulings 2016-1 and 2022-01 still apply.
How FFL Command Center fits (and what's on you)
Some of these conditions are yours no matter what software you run: the 60-day notice, terminal access for inspectors, host notices, keeping downloads and printouts, and sending records on closing. Others depend on what the software does. FFL Command Center keeps the bound book and 4473s on a Windows PC you own at your premises, with a read-only inspector login, a reason and before-and-after trail on every A&D correction, A&D bound book export to CSV or PDF any time (ATF, Inspection Export), a records export encrypted with your backup password, 4473 scan files encrypted with a key that opens only on that PC, an encrypted snapshot of the book every hour, and a daily encrypted backup. If you use off-site or cloud backup, ATF Rulings 2016-1 and 2016-2 require notifying your ATF Area Office of the host facility within 30 days. We'll give you the details to include.
It also has gaps, and we'd rather you hear them here: it backs up daily rather than at each completed form; delayed, pending, cancelled and stopped 4473s don't get an immediate onsite copy; and it doesn't produce the ASCII file and file description for discontinuance. Plan around those, and confirm your own setup with your IOI.
More detail: electronic bound book software · electronic 4473 software · ATF bound book requirements · how long to keep 4473s · key ATF rulings explained · book a demo
FAQ
Is FFL software ATF approved?
No. ATF does not approve, certify or endorse any commercial FFL software. ATF Ruling 2016-1 sets the conditions a licensee's electronic acquisition and disposition records must follow, and the licensee is responsible for following them.
Do I need an ATF variance to keep my bound book electronically?
No, as long as you follow every condition in ATF Ruling 2016-1. The ruling authorizes licensees to keep electronic A&D records without applying for their own variance, and failing to follow a condition ends that authorization until all conditions are met again.
How often do I have to back up and download electronic A&D records?
Ruling 2016-1 requires a backup at least daily and an unencrypted download to a device at your licensed premises at least every six months, or daily if the records are downloaded from a host facility. You must also download within 24 hours of an ATF officer's request, before changing software, database or host, and before discontinuing business. If you use off-site or cloud backup, ATF Rulings 2016-1 and 2016-2 require notifying your ATF Area Office of the host facility within 30 days. We'll give you the details to include.
Do I have to tell ATF if my records are hosted in the cloud?
Yes. Ruling 2016-1 requires you to notify your ATF Area Office of the host's name and address within 30 days of contracting with or changing a host facility. The host must have a business premises in the United States and be subject to U.S. legal process, and the records must be readily accessible from your premises during business hours.
What does ATF Ruling 2022-01 require?
Ruling 2022-01 lets licensees keep electronic Forms 4473 without printing them. Conditions include 60 days' advance written notice to the local ATF Industry Operations Area Office, unalterable storage, uninterrupted read-only access for ATF, enough terminals for inspection, search and sort features, and an unencrypted copy of each form on a storage device at the licensed premises.
Are ATF's electronic recordkeeping rules changing?
ATF proposed a Firearms Electronic Record-Keeping rule (RIN 1140-AA94) in May 2026, and the comment period closed on August 6, 2026. As of September 25, 2026 it is not final, so Rulings 2016-1 and 2022-01 still apply.
Not legal advice. Read the full rulings at atf.gov and confirm your setup with your ATF Industry Operations office. Verified against atf.gov on September 25, 2026.
Quick answers
Is FFL software ATF approved? No. ATF does not approve, certify or endorse commercial FFL software; it states that it "does not issue blanket approvals for commercially available software programs." Instead, ATF Ruling 2016-1 lets any licensee keep acquisition and disposition records electronically, without applying for a variance, if they follow 14 conditions. These include complete required fields, tracked corrections, search by serial and purchaser, daily backups, and unencrypted downloads to a device at the premises at least every six months and within 24 hours of an ATF request. Ruling 2022-01 separately allows 4473s to be stored electronically after 60 days' written notice to ATF.