FINRA Rule 4511 is the general books-and-records rule for FINRA member firms. It does three things: it requires each firm to make and preserve the books and records that FINRA rules, the Securities Exchange Act, and SEC regulations call for; it sets a six-year minimum retention period for any FINRA-required record that doesn’t have its own timeframe; and it requires that records be preserved in a format and media that complies with SEC Rule 17a-4.1FINRA. FINRA Rule 4511 – General Requirements Because Rule 4511 incorporates 17a-4’s technical storage standards, it governs not only what firms keep but how they keep it and who can get at it.
What the Rule Actually Requires
Rule 4511 has three operative parts. Subsection (a) tells firms to make and preserve the books and records required by applicable FINRA rules, the Exchange Act, and SEC rules thereunder. Subsection (b) sets the six-year default retention period. Subsection (c) requires preservation in a format and media compliant with SEC Rule 17a-4.1FINRA. FINRA Rule 4511 – General Requirements
The content list sits mostly in SEC Rule 17a-3. Firms must keep trade blotters that itemize every daily purchase, sale, receipt, and delivery of securities and all cash movements. They must keep ledgers reflecting assets, liabilities, income, expenses, and capital. For every cash, margin, or security-based swap account, they must record each transaction, debits and credits, the beneficial owner’s name and address, investment objectives, and whether discretionary authority exists. They must keep order memoranda for every brokerage order whether executed or not, copies of customer trade confirmations, and securities-position records showing long and short positions as of each clearance date.2eCFR. 17 CFR 240.17a-3 – Records To Be Made by Certain Exchange Members, Brokers and Dealers
The reach goes well beyond trading data. Organizational documents (partnership articles, corporate minutes), employment applications for associated persons, disciplinary records, and all retained communications with the public are covered too.
The Six-Year Default and How Other Periods Fit
Rule 4511(b) is a backstop: any FINRA-required record that doesn’t have a different retention period specified elsewhere must be kept for at least six years.1FINRA. FINRA Rule 4511 – General Requirements Most specific timeframes come from SEC Rule 17a-4, which sorts records into tiers.
Six-Year Records
SEC Rule 17a-4(a) requires six-year retention for the most foundational records: trade blotters, asset-and-liability ledgers, customer account ledgers, and securities-position records. For the first two years of that window, these records must sit in an easily accessible place, meaning retrievable almost immediately rather than buried in offsite archives.3eCFR. 17 CFR 240.17a-4 – Records To Be Preserved by Certain Exchange Members, Brokers and Dealers
Three-Year Records
Under 17a-4(b), a wider category carries a three-year retention period, again with the first two years in an easily accessible place. This bucket includes order memoranda, checkbooks and bank statements, all business-related communications (incoming and outgoing), trial balances and net-capital computations, written agreements, powers of attorney, and copies of financial reports filed on Form X-17A-5.3eCFR. 17 CFR 240.17a-4 – Records To Be Preserved by Certain Exchange Members, Brokers and Dealers Firms that assume everything is six years often miss this tier. Trial balances and internal audit working papers live here, not with the blotters.
Life-of-the-Firm Records
Partnership articles, articles of incorporation, corporate charters, and minute books must be kept until the firm dissolves. There is no accessible-place shortcut for these; they simply never expire while the firm exists.
Electronic Storage: WORM or an Audit Trail
Rule 4511(c) requires electronic records to be preserved in a format meeting SEC Rule 17a-4. For years that meant WORM storage only. The SEC’s 2022 amendments, effective January 3, 2023, added a second option.4U.S. Securities and Exchange Commission. Frequently Asked Questions Regarding Rule Amendments to Broker-Dealer Electronic Recordkeeping Requirements
Under the traditional approach, electronic records are written to a write-once, read-many medium. Once written, a record cannot be altered, overwritten, or erased. The technology is blunt by design, which is why it works as an anti-tampering control but strains in modern cloud environments.
The audit-trail alternative lets firms use systems that permit modifications and deletions if the system maintains a complete time-stamped audit trail. That audit trail must capture every modification and deletion, the date and time of each creating, modifying, or deleting action, the identity of the person responsible (a unique identifier is acceptable), and any other data needed to reconstruct the original record if it is later changed or removed. The audit trail itself must be producible in a reasonably usable electronic format if regulators ask. The requirement applies only to final records the firm is required to keep, not to drafts or working iterations.5U.S. Securities and Exchange Commission. Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants
Whichever option a firm picks, it must keep a duplicate copy of each record on separate media from the original, and both the records and the indexes used to locate them must be accurately organized, indexed, and duplicated.3eCFR. 17 CFR 240.17a-4 – Records To Be Preserved by Certain Exchange Members, Brokers and Dealers
Third-Party Storage and the Designated Executive Officer
When a firm hands storage off to an outside provider, SEC Rule 17a-4 requires the provider to file a written undertaking agreeing to let regulators examine the firm’s records and to furnish copies on request.6U.S. Securities and Exchange Commission. Amendments to Electronic Recordkeeping Requirements for Broker-Dealers The undertaking gives the SEC a backup path to the data if the firm itself becomes uncooperative or fails.
The 2022 amendments added an alternative undertaking aimed at cloud providers. Under it, the third party acknowledges the records belong to the firm, the firm represents that it has independent access without needing the provider to decrypt or transfer anything first, and the provider commits not to impede regulatory examination or SIPA trustee access in a liquidation.6U.S. Securities and Exchange Commission. Amendments to Electronic Recordkeeping Requirements for Broker-Dealers
A firm can also skip a third-party undertaking by designating an executive officer. That officer must be a senior manager with access to the electronic recordkeeping system, directly or through a specialist who reports to them, and signs an undertaking to furnish records promptly to the SEC, any SRO, or any state securities regulator on request.3eCFR. 17 CFR 240.17a-4 – Records To Be Preserved by Certain Exchange Members, Brokers and Dealers
Texts, Chat Apps, and Social Media
The recordkeeping rules are technology-neutral. What matters is the content of a communication, not the device or app used to send it.7FINRA. Regulatory Notice 17-18 – Guidance on Social Networking Websites and Business Communications A text message, WhatsApp chat, or Slack thread about a client’s portfolio is a business communication, and the firm must capture, retain, and supervise it the same way as an email. If the firm allows a channel, it has to be able to archive everything flowing through it.
FINRA’s advertising rules don’t apply to a representative’s purely personal social media use. The moment a personal account is used for business, though, the firm has to be able to retain those communications. Third-party posts in a firm’s interactive online forum also trigger recordkeeping obligations and require review for customer complaints, instructions involving funds or securities, and other content needing supervisory attention.8FINRA. Social Media
All business-related communications must be preserved for at least three years under SEC Rule 17a-4(b)(4), with the first two years in an easily accessible place.3eCFR. 17 CFR 240.17a-4 – Records To Be Preserved by Certain Exchange Members, Brokers and Dealers This is where most compliance failures happen. Employees drift to personal devices or unapproved apps, and the firm loses the ability to capture the record.
Supervision and Regulatory Access
FINRA Rule 3110 requires each firm to establish, maintain, and enforce written supervisory procedures reasonably designed to achieve compliance with securities laws and FINRA rules. For recordkeeping, that means someone at the firm owns the question of whether records are being created, stored in the right format, and retained for the right period. Supervisory procedures must include review of incoming and outgoing correspondence (including electronic messages) by a registered principal, with the review evidenced in writing.9FINRA. FINRA Rule 3110 – Supervision
Producing records to regulators is not optional. FINRA Rule 8210 lets FINRA staff require any member or associated person to provide information orally, in writing, or electronically, and to inspect and copy books, records, and accounts related to any investigation, examination, or proceeding. No member or associated person may fail to comply.10FINRA. FINRA Rule 8210 – Provision of Information and Testimony and Inspection and Copying of Books The rule reaches records held by a third party if the firm controls them or has a right to demand them. Stonewalling an 8210 request is treated as a standalone violation and often results in a bar for the individual involved.
What Non-Compliance Costs
Recordkeeping violations carry real money. The SEC has made off-channel communications a signature enforcement priority. In January 2025, twelve firms agreed to pay a combined $63.1 million in civil penalties for failing to preserve electronic communications conducted outside approved channels. Individual penalties ranged from $600,000 (for a firm that self-reported) to $12 million, and each firm was censured and ordered to cease and desist.11U.S. Securities and Exchange Commission. Twelve Firms to Pay More Than $63 Million Combined to Settle SEC Charges for Recordkeeping Failures
FINRA’s Sanction Guidelines lay out the ranges adjudicators use for recordkeeping cases:
- Small firms: $5,000 to $16,000 in a baseline case, rising to $10,000 to $155,000 with aggravating factors.
- Midsize and large firms: $10,000 to $40,000 at baseline, escalating to $20,000 to $310,000 with aggravating factors. Where aggravating factors dominate, FINRA may suspend the firm from relevant business lines for 10 business days to two years, or expel the firm.
- Individuals: $2,500 to $40,000 in fines, with suspensions of 10 business days to three months. Serious cases can lead to a suspension of up to two years or a permanent bar.
FINRA sizes penalties on the materiality of the missing or inaccurate information, whether the failure was intentional or negligent, whether it ran over an extended period, and whether the recordkeeping gap let other misconduct go undetected.12Financial Industry Regulatory Authority. FINRA Sanction Guidelines That last factor is what turns a routine fine into a career-ending sanction.