Off-channel messages, cold storage that takes days to retrieve, vendor contracts that say nothing about access: these are the things that turn a routine exam into a problem. Rule 17a-4 sets clear standards for how broker-dealers store and produce records, and the requirements are more specific than most firms realize.
TLDR:
- Rule 17a-4 requires broker-dealers to store electronic records in non-rewriteable, non-erasable format for three to six years.
- Since January 2023, firms can meet the standard with WORM storage or a qualified audit trail system.
- Archiving and supervision are separate obligations. Examiners want evidence of review, beyond storage alone.
- Off-channel communications on WhatsApp, iMessage, and personal email are the most cited exam deficiency.
- Greenboard's archiving uses WORM-based, SOC 2 Type 2 certified infrastructure across email, SMS, and messaging apps.
What rule 17a-4 is
Rule 17a-4 is a regulation issued under the Securities Exchange Act of 1934 and enforced by the SEC. It sets the standards for how broker-dealers must retain and preserve business records electronically.
The rule exists because regulators need to be able to reconstruct what happened at a firm, whether during a routine exam or a formal investigation. Without a consistent standard, firms could store records in ways that make retrieval slow, incomplete, or manipulable. Rule 17a-4 fixes that by defining what records must be kept and, equally, how they must be stored and for how long.
What records must be retained
Rule 17a-4 covers a wide range of records that broker-dealers generate in the ordinary course of business. The categories are broad by design, so most of what your firm produces day-to-day falls somewhere on this list.
- Order tickets and trade blotters
- Trade confirmations and account statements
- Customer account records, including new account forms and agreements
- Trial balances and general ledgers
- Electronic communications, including email, instant messages, and texts related to firm business
- Marketing materials and customer-facing content
- Compliance policies and written supervisory procedures
- Notices and correspondence with regulators
- Brokerage records and securities positions
The electronic communications category has drawn more SEC and FINRA enforcement attention than any other records category. Off-channel messaging on personal devices has been the central issue in every major sweep action since 2021. Any message sent by a registered person that relates to firm business counts, regardless of what app or channel it was sent through. That includes WhatsApp, Slack, and similar tools, which firms often assume fall outside the rule's reach.
How long firms must keep records
Rule 17a-4 sets two main retention tiers, and the difference matters for how you structure storage.
| Record type | Retention period | First two years |
|---|---|---|
| General correspondence, blotters, account records, trade confirmations | Three years | Easily accessible location |
| Partnership and corporate records, general ledger, customer complaints, written supervisory procedures | Six years | Easily accessible location |
| Records relating to a firm's lifetime (e.g., articles of incorporation) | Life of firm | N/A |
The "easily accessible" requirement for the first two years is a point firms sometimes miss. Records can't be buried in cold storage and retrieved only on request. Regulators expect prompt access during an exam, so those records need to be searchable and retrievable without delays.
The six-year tier covers what examiners are most likely to pull when reconstructing firm history or reviewing a supervisory failure. If your firm has had compliance team turnover, the written supervisory procedures history alone can become a compliance bottleneck.
What WORM storage is and why it matters for compliance
WORM stands for Write Once, Read Many. It's a storage architecture where data, once written, cannot be overwritten or deleted. A file is locked at the point of creation and stays that way for the duration of the retention period.
Rule 17a-4 requires that electronic records be stored in a non-rewriteable, non-erasable format. WORM storage satisfies that requirement directly. No one can alter a record after it's written, not a compliance officer, not a system administrator, and not a bad actor covering their tracks, a protection that matters as cybersecurity becomes a core compliance risk.
That last point is what makes the architecture meaningful to regulators. The SEC's concern is authenticity: when an examiner pulls a record from three years ago, they need confidence it reflects what actually happened. A searchable archive that also allows edits offers weaker guarantees than one where the record is frozen on creation.
A communications archive built on WORM storage also makes audit trails defensible. If your firm produces records under investigation, regulators will ask whether those records could have been modified after the fact. With a properly implemented WORM system, the answer is no, and you can prove it.
For broker-dealers, this is a baseline infrastructure requirement. Any electronic storage system your firm uses for books and records needs to meet this standard, or it doesn't satisfy the rule.
The 2022 amendments to rule 17a-4
In November 2022, the SEC published final amendments to rule 17a-4 updating electronic recordkeeping requirements for broker-dealers, security-based swap dealers, and major security-based swap participants. If your firm is working from guidance written before that date, some of it no longer reflects current requirements. The amendments made two substantive changes: they eliminated the requirement to formally designate a third party to hold duplicate records and maintain independent regulator access, and they introduced an audit trail system as an SEC-accepted alternative to WORM storage. Both changes took effect in January 2023.
Two changes took effect in January 2023: the SEC eliminated the third-party access designation requirement, and it introduced an audit trail alternative to WORM storage, giving firms a second path to compliance.
The audit trail alternative to WORM
The 2022 amendments let firms use an audit trail system instead of WORM storage, provided it meets specific requirements. Instead of making records physically immutable, the audit trail method tracks every access and modification to a record, creating a verifiable history that regulators can inspect.
To qualify, the audit trail must automatically record the date, time, and identity of anyone who accesses or alters a record, and it must preserve original versions so nothing is permanently lost. The system itself also needs to be non-erasable, meaning the trail can't be wiped clean after the fact.
WORM locks the record. An audit trail logs everything that touches it. Neither is inherently superior, but the right choice depends on your firm's existing infrastructure and how your records management system is built.
Who is covered by rule 17a-4
Rule 17a-4 applies to registered broker-dealers, security-based swap dealers, and major security-based swap participants. If your firm falls into any of those categories and operates in the U.S., the rule's storage and retention requirements apply to you.
Investment advisers are a frequent source of confusion. Advisers registered with the SEC fall under a separate rule, Rule 204-2 under the Investment Advisers Act, which carries its own retention requirements. The two rules share a similar purpose but differ in scope. Dual registrants, firms operating as both a broker-dealer and an investment adviser, need to satisfy both.
If you're a pure RIA with no broker-dealer registration, rule 17a-4 is not your primary obligation. But if your firm touches brokerage activity in any form, 17a-4 compliance is part of the picture.
Electronic communications and supervision requirements
Capturing records and supervising them are two separate obligations. Rule 17a-4 handles retention, but FINRA's books and records rules, including FINRA Rule 4511, layer on a supervision requirement: firms must review communications, not simply store them and move on. Regulators want evidence that someone actually looked.
The channel question is where many firms run into trouble. Per FINRA's books and records guidance, firms must retain business-related electronic communications regardless of the channel used. A registered rep who closes a deal over WhatsApp hasn't moved outside the rule's reach.
Archiving a message satisfies retention. Reviewing it, flagging it where appropriate, and documenting that review is what satisfies the supervision requirement. Examiners increasingly ask for both, and a firm that can produce records but can't show a review trail is only halfway there.
Designation of third parties and access requirements
Rule 17a-4 requires that records be available for prompt inspection by SEC or FINRA examiners. "Promptly" carries real practical weight here. Regulators are not obligated to schedule around your storage vendor's retrieval timelines.
When records are held by a third-party provider, the firm remains responsible for access under its third party compliance program. You can't outsource the obligation itself, only the infrastructure behind it. Your vendor needs to produce records in a readable, usable format without additional processing steps. Records that require proprietary software to open are a compliance problem.
Before the 2022 amendments, firms had to formally designate a third party to hold duplicate records and grant regulators independent access. The SEC removed that specific designation requirement, but the underlying expectation remains: if your records live outside your own systems, examiners still need to get to them. Vendor contracts should spell out access obligations explicitly, covering both output format and retrieval timelines.
Common compliance gaps and enforcement risks
Off-channel communication has been a leading deficiency in recent SEC and FINRA enforcement activity, surfacing repeatedly across sweep actions and exam findings. When registered personnel use personal devices or consumer messaging apps for business conversations, and those messages never enter the firm's archive, the firm has a records gap regardless of intent. The channel doesn't change the obligation.
Four gaps show up repeatedly in exam findings:
- Electronic communications sent over channels the firm's archiving system doesn't capture, including WhatsApp, iMessage, and personal email
- Supervision logs that show records were retained but no evidence a reviewer actually looked at them
- Records stored in formats that require proprietary software to open, making prompt production to examiners difficult
- Vendor acquisitions or infrastructure migrations that disrupt access to archived records, with no contractual protections requiring continuity of retrieval
The supervision log issue deserves attention on its own, and it's one reason firms are rethinking their operating model for securities compliance. Firms sometimes treat archiving and supervision as the same task. They are not. Examiners have grown more direct about asking for evidence of review, beyond evidence of storage alone. A complete archive with no documented review trail is an incomplete compliance record.
Vendor arrangements are a quieter risk. If your records provider goes through an acquisition, a service migration, or a format change, and your contract doesn't lock down access terms, you may find yourself unable to produce records on an examiner's timeline through no fault of your own. That's still your problem.
How to assess a recordkeeping system for 17a-4 compliance
When reviewing vendors, the marketing layer has largely settled on the same language. Nearly every provider claims to be 17a-4 compliant. The architecture underneath that claim varies considerably.
Start with the storage method. Ask whether the system uses WORM architecture or an audit trail approach, and get documentation confirming it. A vendor that can't produce a clear technical answer is a signal worth taking seriously.
From there, work through these criteria:
- WORM or qualified audit trail: The system must satisfy one of the two SEC-accepted methods. Ask for specifics on how immutability is implemented or how the audit trail is structured.
- SOC 2 Type 2 certification, a baseline for any firm compliance program: this confirms the vendor's security and availability controls have been independently tested over time, not checked at a single point.
- Regulator access and output format: Records must be producible in a readable format without proprietary software. Confirm the vendor can deliver this on a realistic timeline.
- Search and retrieval: Examiners expect prompt access. A system requiring manual extraction or batch requests doesn't meet that bar.
- Channel coverage: Your archiving system needs to capture every channel your registered personnel use for business, including email, Slack, Teams, SMS, and WhatsApp. Gaps in channel coverage create gaps in your records.
One overlooked question: what happens to your records if the vendor is acquired or migrates infrastructure? Contractual protections around data portability and access continuity matter as much as current capabilities.
How Greenboard approaches rule 17a-4 and WORM compliance
Greenboard's archiving infrastructure, part of our broader compliance products suite, is built on WORM-based, 17a-4 compliant architecture and is SOC 2 Type 2 certified. Records are locked at creation, so when an examiner asks for a three-year-old message, you can produce it and stand behind its integrity.
Channel coverage is where many firms find gaps they didn't know they had. We've built integrations across email, Slack, Microsoft Teams, SMS, iMessage, LinkedIn, WhatsApp, Telegram, and more, so the archive follows your registered personnel wherever they communicate.
What separates our approach from a standalone archive is that books and records don't sit idle. Through GreenboardGo, those records become searchable, citable, and usable across your compliance program. Policy guidance, pre-clearance decisions, and marketing reviews all draw from the same underlying data.
More than 600 financial firms run their compliance programs on Greenboard. If you want to see how the architecture fits your firm's setup, book a Greenboard demo and we're happy to walk through it.
Final thoughts on building a 17a-4 compliant recordkeeping program
Rule 17a-4 sets a clear bar: records must be retained, stored in a non-rewriteable format or with a qualified audit trail, and retrievable on an examiner's timeline. The firms that stay exam-ready are the ones that treat these as ongoing program questions, not one-time setup tasks. If your recordkeeping program has any of the common gaps covered here, that's a useful place to start.
FAQ
What's the difference between WORM storage and an audit trail for rule 17a-4 compliance?
WORM storage locks a record at creation so it can never be overwritten or deleted, while an audit trail logs every access and modification and preserves original versions without making the file physically immutable. Both satisfy the SEC's electronic recordkeeping requirements under the 2022 amendments to rule 17a-4, and neither is inherently better. The right choice depends on your firm's existing infrastructure.
How do I manage electronic communications archiving and supervision requirements for a broker-dealer?
Archiving and supervision are separate obligations: rule 17a-4 governs retention, while FINRA Rule 4511 requires that someone actually review communications and document that review. Your archiving system needs to capture every channel registered personnel use for business, including WhatsApp, iMessage, Slack, and personal email, and your supervision workflow needs to produce a review trail examiners can inspect, beyond a record of storage alone.
Does rule 17a-4 apply to RIAs, or only broker-dealers?
Rule 17a-4 applies to registered broker-dealers, security-based swap dealers, and major security-based swap participants. Investment advisers registered with the SEC fall under a separate rule, Rule 204-2 under the Investment Advisers Act. If your firm is a dual registrant operating as both a broker-dealer and an investment adviser, both sets of requirements apply.
What should I ask a vendor to confirm their system actually meets WORM storage compliance requirements?
Ask whether the system uses WORM architecture or a qualified audit trail, and request documentation on how immutability is implemented. From there, confirm the vendor holds SOC 2 Type 2 certification, can produce records in a readable format without proprietary software, and has contractual protections covering access continuity if the vendor is acquired or migrates infrastructure.
How do small broker-dealers keep up with SEC recordkeeping rule changes without a large compliance team?
The 2022 amendments to rule 17a-4 introduced the audit trail alternative and removed the third-party access designation requirement, and firms working from older guidance may have gaps they haven't caught. A unified recordkeeping system that covers channel capture, WORM-based storage, and documented supervision in one place reduces the compliance overhead of tracking those changes across separate point solutions.
