If you work at a broker-dealer, SEC Rule 17a-4 is probably on your radar already. If it isn’t, you might still have been handed it as a project, which is how most people meet it.

In simple terms, SEC Rule 17a-4 tells broker-dealers which records they have to keep, how long they have to keep them, and how those records must be stored so nobody can change or lose them. It’s a rule made under the Securities Exchange Act of 1934, and the electronic storage requirements people usually mean when they say “17a-4” were adopted in 1997.

The point is quite simple; regulators need to be able to look back at what a firm did and said, and trust that what they’re looking at is the real thing.

Which records does SEC Rule 17a-4 cover?

Quite a lot, honestly. Rule 17a-4 works alongside Rule 17a-3. The second says which records a broker-dealer has to make, and the first says how long they have to be kept. That covers daily blotters and ledgers, written agreements, bank statements and cancelled cheques, account-opening records, and business communications such as emails and messages.

Most records have to be kept for three or six years, a few for the life of the firm, and account-opening records for six years after the account closes. For the three and six-year records, the first two years have to be somewhere easily accessible.

Communications are where the SEC has made its loudest point. In September 2022 it announced charges against 16 firms (15 broker-dealers and one affiliated investment adviser) that agreed to pay combined penalties of more than $1.1 billion. The SEC found that employees at all of them had routinely used text messaging apps on personal devices to discuss business, and that the firms hadn’t kept most of those messages. The firms admitted the facts. The SEC’s position is that business communications belong on official channels, where they can be kept.

What does SEC Rule 17a-4 actually require?

Strip away the legal language and a handful of expectations remain.

Records have to be protected from tampering. The rule gives firms two ways to do that, which we’ll come to in a moment.

Records have to be verifiable. The system should automatically check that what it stores is complete and accurate.

Records have to be findable, which means firms must keep the information needed to locate any record and hand it over promptly. Indexes are one way to do that, but the rule doesn’t insist on them.

Records have to be downloadable. Firms must be able to produce a record, and its audit trail if it has one, in a human-readable format and in a reasonably usable electronic format.

Records have to survive a failure. The system needs either a backup recordkeeping system or other redundancy that keeps records accessible if the main one goes down.

Finally, a firm needs either a designated executive officer or a designated third party who has signed an undertaking to give regulators access to the records and download them if the firm itself fails to.

What changed in 2022?

This is the bit people search for, and it’s good news. From 1997, the only way to protect electronic records was WORM storage (write once, read many). That means a non-rewriteable, non-erasable format. Think of a document sealed in an envelope that you can open and read as often as you like, but never edit.

In 2022 the SEC added a second option. The amendments were published in November 2022, took effect in January 2023, and had a compliance date of 3 May 2023. Under the audit-trail option, your system keeps a complete, time-stamped log of every modification and deletion, the date and time of each action, and the identity of the person behind it where that applies. The test is whether you could recreate the original record from that log if it were changed or deleted. It applies to the final records the rules require, not to every draft along the way.

Firms can choose either route. They can also use both. A firm can keep its older records on a WORM system and use audit-trail storage for anything created after it’s put in place, or use WORM for some types of record and audit trail for others.

The SEC’s reasoning is worth knowing. Many firms were running a separate archive that existed purely to satisfy the WORM requirement, away from the systems the business actually used. The audit-trail route lets records stay in the working system, as long as it can prove what happened to them. The amendments also dropped the requirement to notify your examining authority before using electronic recordkeeping, which removed a bit of admin.

Where document and records management systems come in

You can try to meet 17a-4 with shared drives, email folders and good intentions. People do. It usually ends with someone spending a week before an audit trying to prove nothing was changed, and that’s a bad week.

A document management or enterprise content management system takes much of that pain away, because the rule’s requirements line up closely with what these systems already do.

Take tamper protection. A system that locks a final record against overwriting, erasing and alteration for its whole retention period can support the WORM route, and the SEC has said a software solution can meet that requirement. A system that keeps a time-stamped history of every action, with earlier versions retained so the original can be recreated, supports the audit-trail route. Either way, check with your compliance team and your vendor how the specific system meets the rule. The test is the outcome, not the feature name.

Retention is the next big one. Records management features let you attach a retention schedule to a type of record, so account-opening records are held for six years after the account closes and communications for three, rather than sitting in someone’s folder indefinitely or vanishing after six months. Legal holds work the same way, freezing records during an investigation so they can’t be disposed of by accident.

Then there’s finding things. Under pressure from a regulator, “we know it’s in there somewhere” isn’t an answer. With consistent metadata, unique record IDs and full-text search, you can pull up a client’s complete file in minutes and export it, with its audit history, in both a readable format and a machine-usable one. Scanned paper gets the same treatment through OCR, so the old filing cabinet doesn’t become a blind spot.

Access control matters too. Permissions decide who can view, edit or approve a record, and those decisions are logged. When an auditor asks who could see a document last March, you can answer with evidence rather than a guess.

And because everything sits in one place, backup and redundancy become something you configure once and check, rather than something that depends on people remembering.

Learn more about how Document Management Systems help organisations meet their compliance requirements by reading our blog on the topic.

Choosing a system for SEC Rule 17a-4

A few questions are worth asking any vendor before you commit. Can final records be locked against change? Is the audit trail automatic, complete and exportable? Can retention rules be applied by record type without someone manually moving files around? What happens to your records if you leave the platform?

That last one gets overlooked. Whatever the vendor agreement says, the responsibility for the records stays with the firm.

At Generis, our CARA platform is built for regulated environments where records have to stand up to scrutiny, with audit trails, retention controls and secure access built into how content is managed. If you’d like to see how that applies to broker-dealer recordkeeping, get in touch and we’ll walk you through it.

Read the SEC Rule 17a-4 yourself

If you’d rather go to the source, these are the official documents.

The SEC’s final rule release (Release No. 34-96034) contains the 2022 amendments and the SEC’s reasoning behind each requirement. The same release is the official Federal Register publication on govinfo.gov.

For the rule as it reads today, see 17 CFR 240.17a-4 on the eCFR. The eCFR is kept up to date but is not an official legal edition, so use the Federal Register for anything you need to cite formally.

The SEC’s press release on the 2022 recordkeeping charges sets out what the 16 firms admitted to.

This article is a general introduction and doesn’t constitute legal advice. Check your firm’s specific obligations with your compliance team or legal counsel.