Books and Records: Electronic Retention Under Rule 17a-4 and Rule 204-2

Two rules, two populations

Broker-dealers and investment advisers are under different recordkeeping rules that ask similar operational questions.

Broker-dealers. 17 CFR 240.17a-3 says what records to make; 17 CFR 240.17a-4 says how long to keep them and what an electronic recordkeeping system must do. FINRA layers Rule 4511 on top, which requires members to make and preserve books and records as required by FINRA rules, the Exchange Act, and its rules, and to preserve records with no specified period for at least six years.

Investment advisers. 17 CFR 275.204-2 covers both what to keep and how long. The general period is five years from the end of the fiscal year in which the last entry was made, with the first two years in an appropriate office of the adviser — a phrase that predates cloud storage and is usually satisfied today by immediate accessibility rather than physical location.

Dually registered firms answer to both. The practical approach is to configure to the longer period per category rather than maintaining two parallel schedules.

The 2022 change to 17a-4: WORM is no longer the only way

For years, “17a-4 compliant” was shorthand for write-once-read-many storage. The SEC’s 2022 amendments to the electronic recordkeeping rules (Release 34-96034) added an alternative. An electronic recordkeeping system may now either:

• preserve records in a non-rewriteable, non-erasable format — the traditional WORM approach; or
• maintain an audit trail that permits the recreation of an original record if it is altered or erased.

This matters because it made mainstream cloud platforms viable for records that previously needed specialised storage. It did not make the requirements lighter. Whichever option a firm relies on, the surrounding conditions still apply: the system must serialise and index records, verify the quality and accuracy of the recording process, permit downloading of indexes and records in a readable form, and the firm must have the required undertakings in place from whoever can access the system.

The operational consequence is that a firm should be able to answer, in one sentence, which option it relies on. Firms that cannot answer usually discover that they assumed their platform’s default was one thing when it is the other.

Off-channel communications is where firms actually fail

The recordkeeping enforcement wave of recent years was not about storage technology. It was about communications that never reached the archive because they happened on personal devices and consumer messaging apps. The records were required; the systems captured email; the business happened in text messages.

The control has three parts, and all three are necessary:

1. A stated list of approved channels. Specific applications, not “firm-approved systems.”
2. Technical capture on each approved channel. Journaling at the server, so a user deleting a message on their phone does not remove the record.
3. Enforcement against the rest. On managed devices, unapproved messaging applications are blocked or absent. A policy that says employees should not use them is not a control; it is a statement of preference.

The third part is the one firms skip, and it is the one that turns a policy violation by one person into a firm-level recordkeeping failure.

Prompt production

Rule 17a-4(j) requires a member, broker, or dealer to furnish promptly to a representative of the Commission legible, true, complete, and current copies of required records. Advisers face the equivalent expectation through examination requests.

Production is a capability, not a storage property, and it is tested the way an examiner would test it: name a person and a date range, and retrieve. Two failure modes recur.

• Search does not span the whole corpus. Email is searchable; the chat archive is a separate product with its own console; the mobile capture is a third. A “complete” response requires three separate exercises and someone forgets one.
• Only an administrator can run the search. The compliance user who receives the request has to route it through IT, which adds days and puts the record custodian outside the compliance function.

What to check before an exam

• Which 17a-4 option does the archive rely on, and can you show it?
• Can a compliance user search and export without an administrator?
• Does the channel inventory have any entry that is neither captured nor blocked?
• What happens to a departed employee’s messages — and to the mobile device they used?
• Does a legal hold actually stop deletion, tested rather than assumed?

Related sections

FINRA supervision and cybersecurity for the supervisory review that depends on captured communications, Advisers Act compliance for the 204-2(a)(17) record of the compliance program itself, and incident response and exam evidence for assembling a production under time pressure.

Pylon’s service view is on SEC & FINRA compliance.

Primary sources

• 17 CFR 240.17a-4 — Records to be preserved by certain exchange members, brokers and dealers
• 17 CFR 240.17a-3 — Records to be made by certain exchange members, brokers and dealers
• 17 CFR 275.204-2 — Books and records to be maintained by investment advisers
• SEC Release 34-96034 — Electronic Recordkeeping Requirements for Broker-Dealers (2022)
• FINRA Rule 4511 — General Requirements (books and records)
• FINRA books and records key topic