WORM Compliance: Rule 17a-4, Cloud Modes, and Off-Channel Risk

WORM compliance is the requirement that certain regulated firms store records in a Write Once, Read Many format — data locked the moment it is saved so that it cannot be altered or deleted. For broker-dealers and security-based swap dealers, the rules sit in SEC Rules 17a-4 and 18a-6. Since January 2023, WORM storage is no longer the only acceptable method: firms can choose between traditional WORM and a time-stamped audit trail that can reconstruct any original record if it is modified or deleted.¹ Getting this wrong is expensive. The SEC has collected more than $2.3 billion in recordkeeping penalties since fiscal year 2022, with most of that tied to failures around electronic communications rather than storage hardware.²

Your Two Options Under Rule 17a-4

Broker-dealers preserving records electronically under SEC Rule 17a-4 can pick either path. The first keeps records in a non-rewriteable, non-erasable (WORM) format. The second maintains a complete time-stamped audit trail capable of recreating any original record that gets modified or deleted.³ Security-based swap dealers and major security-based swap participants without a prudential regulator face the same choice under SEC Rule 18a-6.⁴

Whichever option you pick, the system must automatically verify the completeness and accuracy of its storage processes. It also has to be able to download and transfer copies of any record, along with its audit trail where applicable, in both human-readable and usable electronic formats whenever the SEC, a self-regulatory organization, or a state securities regulator asks.³

The WORM Path

True WORM storage is rigid by design. Once data lands on the medium, it stays exactly as written: no corrections, no updates, no clean-up. That works for records created once and never revised. It is harder to live with when the firm runs modern databases, cloud platforms, and collaboration tools where data moves fluidly. Firms choosing WORM still have obligations tied specifically to this option, including serializing storage media and time-dating the retention period, triggered where applicable to the WORM method.³

The Audit-Trail Path

The audit-trail alternative is the bigger shift. Instead of locking records so they can never be touched, the system keeps every version along with a log of what changed, when, and who changed it. If someone modifies or deletes a record, the system must be able to recreate the original.⁵ The audit trail must capture all modifications and deletions of the record or any part of it, the date and time of each action, and the identity of the person responsible where applicable, plus any information needed to maintain the record’s security, signatures, and authenticity.³ Firms that cannot demonstrate the reconstruction capability on demand have effectively chosen neither option.

How Long Records Must Be Kept

Rule 17a-4 sets two main retention tiers, and in both cases the first two years must be kept somewhere easily accessible:

Six years for trade blotters and other records of original entry, certain ledger accounts, and other records specified under Rule 17a-3(a)(1) through (3), (5), (21), and (22).⁶
Three years for customer account records, organizational documents such as partnership articles, trade confirmations, and records under Rule 17a-3(a)(4), (6) through (11), (16), (18) through (20), and (25) through (31).⁶

FINRA Rule 4511 fills the gaps. Any FINRA-required books and records without a specific retention period under FINRA rules or Exchange Act rules must be preserved for at least six years, and all records must be kept in a format and media that complies with Rule 17a-4.⁷

“Easily accessible” is not a suggestion. During an examination, the firm has to produce those recent records quickly, not pull them from archived tapes or submit retrieval requests to a vendor. Cold-storage solutions for records still inside the two-year window invite problems during routine audits.

Who Produces Records to Regulators

Under the old rules, firms had to engage an outside third party to file a written undertaking with the SEC. The 2023 amendments added a choice: firms can still use a third party, or they can designate an executive officer from senior management to fill that role.¹

Third-Party Undertakings

When an outside service — a cloud vendor, depository, bank, or other recordkeeping provider — maintains records for the firm, that entity files a written undertaking with the SEC. The undertaking states that the records belong to the broker-dealer, will be surrendered promptly on request, and that the entity will permit examination by SEC representatives at any time during business hours.³ Where the broker-dealer has independent access to the records, a streamlined version applies: the outside entity agrees to facilitate and not impede examination, access, download, or transfer of the records.

The Executive Officer Alternative

A designated executive officer must have access to the electronic recordkeeping system, either directly or through a specialist who reports to them. The officer can appoint up to two backup employees in writing to step in when unavailable, plus up to three specialists to assist with the technical side of retrieval.¹ This option avoids onboarding an external party, but it concentrates accountability inside the firm. If that executive officer leaves and the designations are not updated, the gap becomes a compliance exposure.

Keep a copy of the third-party undertaking or executive officer designation ready for inspection. Examiners expect to see the documentation on request, not after a call to the legal department.

The 90-Day DEA Notification Is Gone

Older compliance guides often reference a requirement to notify the firm’s designated examining authority at least 90 days before using electronic recordkeeping. That requirement no longer exists. The 2023 amendments eliminated the advance notification entirely, and FINRA’s own summary of the rule changes confirms that firms are not required to notify their DEA before employing an electronic recordkeeping system.¹⁸ No 90-day waiting period, no Letter of Intent, no formal pre-approval submission. A compliant system and the required undertakings still have to be in place, but the bureaucratic step is gone. A guide that still references the notification requirement predates the 2023 amendments and should be treated accordingly.

Backups and Redundancy

A single copy of records on a single system — even a WORM-compliant one — is not enough. Rule 18a-6 requires a backup electronic recordkeeping system that meets the same technical requirements as the primary system and retains records as a redundant set in case the original becomes temporarily or permanently inaccessible. Alternatively, firms can implement other redundancy capabilities designed to ensure access to required records.⁴ In practice, that means geographic or logical separation between primary and backup archives. A firm relying on a single cloud region without replication to a second region is non-compliant even if the storage itself meets every other requirement.

Where Firms Actually Get Penalized: Off-Channel Communications

The largest recordkeeping enforcement wave in SEC history has not been about faulty WORM hardware or misconfigured archives. It has been about text messages, WhatsApp conversations, and personal email: what regulators call off-channel communications. When employees discuss firm business on platforms the firm does not capture, those conversations vanish, which violates the preservation requirements directly.

The totals are large. Since fiscal year 2022, the SEC has brought 95 enforcement actions and imposed $2.3 billion in combined penalties for off-channel recordkeeping failures.² In a single 2024 action, twenty-six firms paid a combined $392.75 million, with individual firms paying between $400,000 and $50 million each.⁹ In January 2025, twelve more firms paid $63.1 million, with individual penalties running from $600,000 to $12 million.¹⁰

FINRA has followed, with enforcement escalating to the point of barring individuals from the industry rather than only fining firms. The supervisory angle is tied in: FINRA Rule 3110 requires firms to have procedures for reviewing incoming and outgoing written correspondence, including electronic correspondence, and internal communications related to their securities business. Those reviews must be conducted by a registered principal and documented in writing.¹¹ If conversations happen on platforms the firm does not monitor, those reviews cannot occur.

Self-reporting changed the penalty math in both enforcement rounds. Firms that self-reported received significantly lower penalties. PJT Partners, which self-reported, paid $600,000, well below what comparably-sized firms paid.¹⁰

Cloud WORM: Compliance Mode vs. Governance Mode

Traditional WORM meant optical disks or specialized tape media that physically could not be overwritten. Modern cloud platforms replicate the concept in software. Amazon S3 Object Lock is the most widely adopted example and offers two modes that map to different compliance needs:

Compliance mode. No user, including the root account holder, can overwrite, delete, or shorten the retention period of a protected object. The only way to remove an object before its retention date expires is to delete the entire AWS account. This mode mirrors true WORM behavior for regulatory purposes.¹²
Governance mode. Standard users cannot overwrite or delete objects, but administrators with special permissions can. Useful for testing retention configurations or internal policies, but it does not satisfy regulatory WORM requirements because a privileged user can override the protections.¹²

This is where firms make expensive mistakes. Governance mode sounds sufficient because it prevents most users from touching the data, but regulators evaluating WORM compliance want to see that nobody can alter records, not that most people cannot. For SEC compliance under the WORM path, firms need the strictest available lock. Similar immutable storage features exist on Microsoft Azure and Google Cloud, each with their own terminology.

Records also have to remain searchable and retrievable throughout the retention period. A compliant storage system that buries records in an unindexed archive fails the readily download and transfer requirement.³ When switching storage providers or migrating platforms, the firm has to verify that the new system meets the same requirements. The old DEA notification step is gone, but the underlying obligation to maintain a compliant system through any transition remains.

Adjacent Rules That Are Not WORM Compliance

Two other federal regimes get grouped with WORM compliance in casual conversation but operate on different terms. The IRS, under Revenue Procedure 97-22, requires electronic storage systems for tax records to include controls that prevent and detect unauthorized creation, alteration, deletion, or deterioration of stored records, with ongoing inspection and quality assurance. The system cannot be subject to any contract or license that restricts the IRS’s ability to access or use it during an examination, and if a taxpayer stops maintaining the hardware and software needed to read the stored records, the IRS treats those records as destroyed.¹³ The procedure never uses the word WORM.

The HIPAA Security Rule’s integrity standard at 45 CFR 164.312(c)(1) requires covered entities and business associates to protect electronic protected health information from improper alteration or destruction, with an addressable implementation specification calling for mechanisms to verify that information has not been altered or destroyed without authorization.¹⁴ HIPAA does not mandate WORM storage by name; it calls for reasonable and appropriate safeguards and leaves the technology choice to the organization.

1
U.S. Securities and Exchange Commission. Amendments to Electronic Recordkeeping Requirements for Broker-Dealers
2
U.S. Securities and Exchange Commission. SEC Announces Enforcement Results for Fiscal Year 2025
3
eCFR. 17 CFR 240.17a-4 – Records to Be Preserved by Certain Exchange Members, Brokers and Dealers
4
eCFR. 17 CFR 240.18a-6 – Records to Be Preserved by Certain Security-Based Swap Dealers and Major Security-Based Swap Participants
5
U.S. Securities and Exchange Commission. Frequently Asked Questions Regarding Rule Amendments to Broker-Dealer, Security-Based Swap Dealer, and Major Security-Based Swap Participant Electronic Recordkeeping Requirements
6
eCFR. 17 CFR 240.17a-4 – Records to Be Preserved by Certain Exchange Members, Brokers and Dealers
7
FINRA. FINRA Rule 4511 – General Requirements
8
Financial Industry Regulatory Authority. Exchange Act Rule 17a-4 Amendments – Chart of Significant Changes
9
U.S. Securities and Exchange Commission. Twenty-Six Firms to Pay More Than $390 Million Combined to Settle SEC Charges for Widespread Recordkeeping Failures
10
U.S. Securities and Exchange Commission. Twelve Firms to Pay More Than $63 Million Combined to Settle SEC Charges for Recordkeeping Failures
11
FINRA. FINRA Rule 3110 – Supervision
12
Amazon Web Services. Locking Objects With Object Lock
13
Internal Revenue Service. Rev. Proc. 97-22
14
eCFR. 45 CFR 164.312 – Technical Safeguards