SEC Rule 17a-4: Recordkeeping, Retention, and WORM Storage

SEC Rule 17a-4 is the federal regulation that tells registered broker-dealers which business records they must preserve, how long to keep each type, and how to store them electronically. Retention runs from three years for most communications and operational records to the entire life of the firm for organizational documents. Since 2021, the SEC has aggressively enforced the rule, particularly against firms that failed to capture business messages sent through personal devices and unapproved apps.

Who the Rule Covers

Rule 17a-4 applies to any entity registered as a broker-dealer under Section 15 of the Securities Exchange Act of 1934, along with members of national securities exchanges who trade directly with non-members.¹ Firm size does not matter. If you hold a broker-dealer registration and execute trades for clients or your own account, the rule reaches you.

Security-based swap dealers and major security-based swap participants are covered only when they are also registered as broker-dealers.¹ A standalone swap dealer without a broker-dealer registration has its own recordkeeping obligations under a separate rule, not 17a-4.

Almost every broker-dealer is also a FINRA member, which adds a parallel obligation. FINRA Rule 4511 requires member firms to make and preserve books and records as required by both FINRA rules and the Exchange Act, in a format that complies with Rule 17a-4.² Rule 4511 also imposes a default six-year retention for any FINRA-required record that lacks a specified period, which can extend the timeline beyond what Rule 17a-4 alone would require.

What Records Must Be Preserved

Rule 17a-3 tells broker-dealers what records to create; Rule 17a-4 tells them how long to keep those records.³ The categories preserved cover the firm’s trading activity, its communications, its personnel files, and its customer complaints.

Trading and Financial Records

Daily trade blotters recording every purchase and sale, general ledgers covering assets, liabilities, income, and expense accounts, and securities records tracking each position held by the firm or its customers all must be maintained. Order tickets documenting every instruction to buy or sell a security, including time of entry and execution, and trade confirmations sent to customers are also required.¹

Communications

Every piece of business correspondence the firm sends or receives must be preserved, whether internal or external.¹ The SEC treats text messages, WhatsApp chats, and other digital messaging used for business purposes as communications subject to full capture and retention. If an employee discusses firm business on a personal phone using an unapproved app, the firm is still responsible for preserving that conversation. This is where the largest recent penalties have hit.

Personnel Records

Employment applications, internal trial balances, and records related to employee fingerprinting and background checks fall within the preservation mandate. Fingerprinting records must be kept for at least three years after the employee’s termination.¹

Customer Complaints

FINRA Rule 4513 adds a separate obligation: written customer complaints and records of the action taken on each must be preserved for at least four years.⁴ Each office of supervisory jurisdiction must maintain either a dedicated complaint file or a separate record with clear references to the relevant correspondence. A customer complaint under this rule means any grievance involving the firm’s activities related to soliciting or executing transactions, or handling the customer’s securities or funds.

How Long You Have to Keep Each Record

Rule 17a-4 sets three retention tiers, with an accessibility overlay that applies to the first two.

Six Years

Core accounting records, including daily trade blotters, general ledgers, and securities position records, must be preserved for at least six years.¹ The longer window lets regulators investigate patterns that unfold over multiple years.

Three Years

Communications, order tickets, trade confirmations, and most other operational records carry a three-year retention period.¹ Remember that FINRA’s default six-year floor can override this for FINRA-required records that lack their own specified period.²

The Two-Year Accessibility Overlay

For both six-year and three-year records, the first two years must be kept in an “easily accessible place.”¹ In practice, the firm should be able to produce those records almost immediately if a regulator asks, without retrieving archived tapes or contacting an off-site vendor. After the two-year window, records can move to deeper archival storage as long as they remain retrievable within a reasonable time.

Life of the Firm

Certain foundational documents must be preserved for the entire life of the firm and any successor entity: articles of incorporation or partnership agreements, minute books, stock certificate books, all Forms BD and BDW, and any licenses showing the firm’s registration with securities regulators or the CFTC.¹ LLCs and other non-corporate entities carry the same permanent retention obligation for their equivalent organizational documents.

After the Firm Closes

Ceasing operations does not end the obligation. A broker-dealer that stops transacting or withdraws its registration must continue preserving all records for the remainder of the applicable retention periods.¹ A firm that closed with three years remaining on its six-year blotter retention still owes those three years.

Electronic Storage Requirements

Most broker-dealers store records electronically, and Rule 17a-4 prescribes detailed technical requirements. Amendments adopted in 2022 and effective January 3, 2023, modernized the options.⁵ Firms now choose between two approaches.

WORM Format

The traditional method requires storing records in a non-rewriteable, non-erasable format, commonly called Write Once, Read Many.¹ Once data is written, no one at the firm can alter or delete it.

Audit-Trail Alternative

The 2022 amendments added a second option that gives firms more flexibility, provided the system maintains a complete time-stamped audit trail. That trail must capture every modification or deletion, the date and time of each action, and, where applicable, the identity of the person who made the change.⁶ The system must also preserve enough information to reconstruct the original record if it is later modified or deleted. Firms pick one approach for their electronic system rather than mixing methods within it.

Indexing and Backup

Whichever storage method a firm chooses, the system must organize and accurately index all records so they can be searched and retrieved quickly. Indexes must be duplicated, stored separately from the originals, and preserved for as long as the records they reference.⁷ A backup electronic recordkeeping system must hold a redundant set of all records in case the primary system fails.¹

Producing Records and the Undertaking

When the SEC, FINRA, or a state securities regulator requests records, the firm must furnish them “promptly.” The rule does not define a specific number of hours or days.⁸ Examiners expect records in the two-year accessibility window to be available almost immediately; deeper archival records may take longer. The regulator’s request dictates whether the firm must produce just the record, its audit trail, or both.

Every firm using electronic storage must file a written undertaking with its designated examining authority, typically FINRA. The undertaking can be signed by a designated third party or a designated executive officer, and it commits the signer to furnish records to regulators if the firm itself fails to do so.⁶

Before the 2022 amendments, this role had to be filled by an independent third party. The updated rule allows a designated executive officer to sign the undertaking instead, provided that officer has the ability to access and produce records from the electronic storage system, either directly or through a specialist who reports to them. The officer can also designate up to two backup employees and up to three technical specialists to assist if the officer becomes unavailable.⁶ For smaller firms, that change cut the cost of contracting with a third-party storage vendor solely to satisfy the undertaking.

Penalties for Failing to Comply

The SEC treats recordkeeping failures as a substantive enforcement priority, not a paperwork technicality. Since 2021, the agency’s “off-channel communications” initiative has produced cumulative penalties well into the billions of dollars across dozens of actions targeting business messages sent through personal devices and unapproved apps.

In January 2025, the SEC charged nine investment advisers and three broker-dealers for failing to preserve electronic communications, with combined civil penalties of $63.1 million. Individual penalties in that single action ranged from $600,000 for a firm that self-reported its violations to $12 million for firms where the failures were more widespread. Each firm was also censured and ordered to cease and desist from future violations.⁹

In more serious cases, the SEC can suspend or revoke a firm’s registration entirely. The pattern in recent settlements is consistent: self-reporting and prompt remediation lead to significantly reduced penalties, while delayed compliance fixes invite the harshest outcomes.

1
eCFR. 17 CFR 240.17a-4 – Records to Be Preserved by Certain Exchange Members, Brokers and Dealers
2
FINRA. FINRA Rule 4511 – General Requirements
3
U.S. Securities and Exchange Commission. Electronic Storage of Broker-Dealer Records
4
FINRA. FINRA Rule 4513 – Records of Written Customer Complaints
5
Federal Register. Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants
6
U.S. Securities and Exchange Commission. Amendments to Electronic Recordkeeping Requirements for Broker-Dealers
7
eCFR. 17 CFR 240.17a-4 – Records to Be Preserved by Certain Exchange Members, Brokers and Dealers
8
U.S. Securities and Exchange Commission. Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants
9
U.S. Securities and Exchange Commission. Twelve Firms to Pay More Than $63 Million Combined to Settle SEC Charges for Recordkeeping Failures