My policy is six months. Three weeks is way too short. Consider this scenario: A cutomer gets their bank statement in the mail on the 5th of the month. The first thing they see is an ATM withdrawal on the 10th of the previous month. They file a claim and you go to investigate only to discover that you no longer have video. Now what?
And that assumes the customer was prompt. Reg E gives your customer 60 days from the time they get the statement to file a claim. When you consider that the transaction could have taken place up to 30 days prior to the statement date you're up to 90 days.
For good measure I doubled it and said 6 months. I had one forgery investigation where the tape I needed was the next one in line to be re-recorded when the complaint came in. The tape saved the bank $5,000 and saved a teller her job. Seems worth it to me.
_________________________
If you approach life with pure logic you can avoid almost all of the fun.