FRE 902(11) and 902(12): Certified Business Records, Explained

October 12, 2026 · Updated October 13, 2026

Bank statements, phone records, invoices, shipping logs, loan files: most cases run on business records, and getting each one in used to mean calling a records custodian to the stand. Federal Rule of Evidence 902(11) replaced that witness with a piece of paper. Its companion, 902(12), does the same for foreign records in civil cases.

This guide explains what Federal Rule of Evidence 902(11) requires, why one certification does two jobs at once, how 902(12) and its criminal-case counterpart work, and the places where the shortcut fails, from late notice to social media posts. For the full list of self-authenticating categories, see what is self-authenticating evidence.

The short answer

• Rule 902(11) makes a domestic record of regularly conducted activity self-authenticating “as shown by a certification of the custodian or another qualified person,” if the record meets the business-records requirements of Rule 803(6) and you give the other side written notice before the trial or hearing. It applies in civil and criminal cases.
• Rule 902(12) does the same for a foreign record, but only “in a civil case,” and the certification must be signed in a way that would expose the signer to criminal penalty in the country where it is signed. In criminal cases, foreign business records go through 18 U.S.C. § 3505 instead.
• One certification does two jobs. It authenticates the record and lays the foundation for the business-records exception to the hearsay rule.
• It may not cover what users wrote. A platform can certify its own records, but most federal appeals courts that have addressed it say that does not reach a user’s posts.

Why the rule exists

Rules 902(11) and 902(12) took effect on December 1, 2000. The Advisory Committee’s note gives the purpose plainly: to “authenticate certain records of regularly conducted activity, other than through the testimony of a foundation witness.” Before then, a party offering a bank’s records needed someone from the bank to testify about how the bank keeps them. Now, in most cases, a signed certification from that person does the same work, and nobody has to travel to court to say it.

What a Rule 902(11) certification has to show

1. A record that qualifies as a business record. The certification has to establish the conditions in Rule 803(6)(A) to (C), in substance:

• the record was made at or near the time of the event, by someone with knowledge or from information they passed on;
• it was kept in the course of a regularly conducted activity of a business or organization, profit or not;
• making that kind of record was a regular practice of the activity.

2. A qualified person to certify it. The rule allows “the custodian or another qualified person.” That person does not have to have made the record or know its contents personally. The Second Circuit put it this way in United States v. Komasa, 767 F.3d 151 (2d Cir. 2014): “The custodian need not have personal knowledge of the actual creation of the document.” What they need is knowledge of how the organization keeps its records. In United States v. Brown, 553 F.3d 768 (5th Cir. 2008), a qualified witness was described as “one who can explain the record keeping system of the organization,” and a statistics expert who understood a pharmacy’s software but not its record keeping did not qualify.

3. The right form. The certification has to comply with a federal statute or a Supreme Court rule. The Advisory Committee’s note says a declaration that satisfies 28 U.S.C. § 1746 meets the requirement, “as would any comparable certification under oath.” Section 1746 itself requires the declaration to be signed as true under penalty of perjury and dated.

4. Notice and inspection. “Before the trial or hearing, the proponent must give an adverse party reasonable written notice” of the intent to offer the record, and “must make the record and certification available for inspection” so the other side “has a fair opportunity to challenge them.” More on this below, because it is where the shortcut is most often lost.

One certification, two jobs

A business record offered for the truth of what it says faces two separate hurdles: authenticity under Rule 901, and hearsay. Rule 902(11) clears the first. Rule 803(6) clears the second, and its subsection (D) says its conditions can be “shown by the testimony of the custodian or another qualified witness, or by a certification that complies with Rule 902(11) or (12) or with a statute permitting certification.”

So the same document does both. That is why a well-drafted 902(11) certification is worth getting right: it can replace a witness for authenticity and for the hearsay foundation in a single page. One limit follows from the hearsay side: Rule 803(6) covers the business’s own regular entries. Statements by outsiders that happen to be recorded in a business’s files are not the business’s own record, though some courts accept them where the business verified them, for example by checking ID. The same limit is why user posts on a platform cause trouble, as explained below.

The opponent keeps one more argument. Under Rule 803(6)(E), as amended in 2014, the record still comes in only if “the opponent does not show” that its source or the way it was prepared indicates a lack of trustworthiness. The burden is on the opponent, because, in the committee’s words, “the basic admissibility requirements are sufficient to establish a presumption that the record is reliable.” The note’s own example of a record that may fail is one prepared in anticipation of litigation and favorable to the party that prepared it, and an opponent can make that showing without introducing evidence of its own. That concern is about the underlying record. The certification itself is always written for the litigation, and that is fine: the Fourth Circuit rejected exactly that objection in United States v. Hassan, 742 F.3d 104 (4th Cir. 2014).

Rule 902(12) and foreign records

Rule 902(12) applies the same approach to records kept outside the United States, with two differences.

• Civil cases only. The rule begins “In a civil case.”
• A signature with consequences. The certification must be signed “in a manner that, if falsely made, would subject the maker to a criminal penalty in the country where the certification is signed.” The notice requirements of 902(11) apply too.

In a criminal case, foreign business records come in under a statute instead, 18 U.S.C. § 3505. It has its own certification, defined as one that, “if falsely made, would subject the maker to criminal penalty under the laws of that country,” and its own timing: notice comes “at the arraignment or as soon after the arraignment as practicable.” Objections must be made by motion before trial, or they are waived unless the court grants relief for cause.

Notice: where the shortcut gets lost

The notice requirement looks like a formality. Courts do not treat it as one. The leading example, United States v. Wood, 109 F.4th 1253 (10th Cir. 2024), where a certificate produced after jury selection cost the government its convictions, is walked through in our self-authenticating evidence guide. Notably, the Tenth Circuit declined to make exclusion automatic for every late notice. The other decisions show where the line falls.

• Actual notice sometimes saves it. In Komasa, there was no written notice, but the defense had the certifications in discovery and had been told orally that the government would rely on them, and the conviction was affirmed. The court still warned that parties skip the written notice “at their own risk,” and the government accepted that one sentence in a cover letter would have done.
• Courts can refuse late affidavits. In Brown, the Fifth Circuit upheld the trial court’s refusal to give effect to a defendant’s untimely 902(11) affidavit.
• A mid-trial cure is risky. In United States v. Daniels, 723 F.3d 562 (5th Cir. 2013), notice came on the second day of trial. The court offered a continuance the defense did not take, and the Fifth Circuit found no abuse of discretion in admitting the records three days later, while calling that not the best practice.

The safe practice is simple: serve written notice, with copies of the records and the certification, as early as the case allows, and say in writing that you intend to rely on Rule 902(11).

The Confrontation Clause, in criminal cases

In criminal cases, the defense sometimes argues that a certification is testimony that must be confronted. The Supreme Court addressed this in Melendez-Diaz v. Massachusetts, 557 U.S. 305 (2009): “A clerk could by affidavit authenticate or provide a copy of an otherwise admissible record,” and business records “created for the administration of an entity’s affairs” are not testimonial. The Court distinguished a clerk’s certificate that a record does not exist, which can be testimonial. Following that reasoning, the Tenth Circuit held in United States v. Yeley-Davis, 632 F.3d 673 (10th Cir. 2011) that “Rule 902(11) certifications of authenticity are not testimonial,” and affirmed the admission of phone company call records on that basis.

Social media and platform records

Platforms are businesses, and they keep records: subscriber details, login logs, the fact that one account sent a message to another at a given time. Those are classic 902(11) material. What users write is different.

• Browne says user posts are not the platform’s business records. In United States v. Browne, 834 F.3d 403 (3d Cir. 2016), Facebook chats were held “not business records under Rule 803(6) and thus cannot be authenticated by way of Rule 902(11).” The chats still came in, under Rule 901, on other evidence tying them to the defendant.
• Most circuits agree. The Sixth Circuit followed Browne in United States v. Farrad, 895 F.3d 859 (6th Cir. 2018), holding it was error to treat Facebook photos as self-authenticating business records; the error was harmless because the photos came in under Rule 901 anyway. Farrad counted the Second, Third and Fifth Circuits on the same side.
• Hassan is the possible exception. In Hassan, the Fourth Circuit found no abuse of discretion where the trial court accepted certifications from Facebook’s and Google’s custodians and also required Rule 901 evidence tracing the accounts to the defendants by IP address. Browne disagreed with that part of Hassan in a footnote, and Farrad described the Fourth Circuit as “potentially in conflict,” but “not clearly the case.”

The practical answer is the same everywhere: use 902(11) for the platform’s own records, and prove who wrote the content under Rule 901. Our step-by-step guide to authenticating social media evidence covers how. For a web page or post as it appeared, the certification routes that fit are 902(13) and 902(14), covered in FRE 902(13) vs 902(14).

A 902(11) certification checklist

• Identify the records precisely, by Bates number or another unambiguous description.
• Name the certifier’s role and explain how they know the organization’s record-keeping system.
• State each 803(6)(A) to (C) element expressly, tracking the rule’s wording, then add specifics about this record system. In Komasa, the first certifications fell short of the rule and corrected ones had to be served.
• Sign under penalty of perjury under 28 U.S.C. § 1746, or a comparable oath, and date it.
• Serve written notice early, with copies, and make the records and the certification available for inspection.
• For foreign records, use 902(12)’s signature requirement in civil cases, or 18 U.S.C. § 3505 in criminal ones.
• Check your state’s rule if you are in state court. Most states have a version, with their own forms and deadlines; Texas, for example, requires serving a business-records affidavit at least 14 days before trial (Tex. R. Evid. 902(10)).
• Keep a Rule 901 witness in reserve, especially for anything a user, rather than the business, created.

Where Permavault fits

Permavault does not issue 902(11) certifications. Where it fits is the evidence a business-records certificate cannot carry: what a web page or post actually showed. A neutral automated system opens the page the way a signed-out visitor sees it, captures it as it rendered, records the address, time and process, fingerprints every file with cryptographic hashes at capture, and stores the result on a permanent decentralized network of roughly 300 independent nodes, funded by a long-term storage endowment. That is the raw material for a 902(13) or 902(14) certification, with the authorship question left, as it should be, to Rule 901. For posts that only show in full after signing in, our social media evidence guide explains the signed-in route.

Each capture is $4.99, down to $2.98 with a pack, and carries an independent Bitcoin-anchored timestamp. An optional $9 Certificate of Authenticity documents the capture process. The Legal certificate ($39) adds an RFC 3161 timestamp on the signed capture manifest, a chain-of-custody appendix, and a declaration template designed to support authentication under FRE 902(13) and 902(14). The Legal evidence package states whether the timestamp qualifies under eIDAS.

This article is general information about the Federal Rules of Evidence, not legal advice for any specific matter. Rule text and Advisory Committee notes are quoted from the current official edition; summaries are paraphrases and the rule text controls. Admissibility always depends on the facts, the jurisdiction, and the judge.