SEC Rule 17a-3 & FINRA Records Retention Requirements Explained (2024)

SEC Rule 17a-3 & FINRA Records Retention Requirements Explained

Financial industry recordkeeping regulatory requirements like the U.S. Securities and Exchange Commission (SEC) Rules 17a-3 and 17a-4, and the Financial Industry Regulatory Authority (FINRA) Rules 4511 and 2210, play a crucial role in maintaining the integrity of the U.S. financial markets. These regulations are not just bureaucratic formalities; their oversight involves ensuring that financial services firms adhere to stringent record retention requirements, essential for the transparency, accountability, and trust that underpin the financial system.

Not complying with these regulations could cost you millions of dollars in fines and more.

In this article, we’ll take a deep dive into SEC and FINRA ‘Books and Records’ requirements so you can understand and comply with US financial services recordkeeping regulations.

There's a lot of information in this guide — you can use the links below to jump to specific sections.

Table of Contents

1. What are the SEC and FINRA Recordkeeping Requirements?
2. What is SEC Rule 17a-3?
3. What is SEC Rule 17a-4?
5. What is SEC Rule 204-2?
6. What is FINRA Rule 4511?
7. What is FINRA Rule 2210?
8. Recordkeeping Requirements for the SEC Marketing Rule
9. Types of Records to Retain
10. Requirements for Format and Accessibility of Records
11. Record Retention Periods
14. How Pagefreezer Can Help

Overview of SEC Recordkeeping Rules

Primarily outlined in Rule 17a-3 and Rule 17a-4 under the SEC Act of 1934, SEC record retention requirements are a set of regulations that mandate which documents and communications financial firms must retain, for how long, and in what format.

They are designed to ensure that records are available for examination by regulators, which is vital for monitoring compliance, investigating potential violations, and protecting investors.

The requirements encompass a broad range of records, including emails, communications, trade confirmations, account statements, and other documents related to a firm's business activities. The rules specify not only the types of records that must be kept but also detail how they must be stored, ensuring they are secure, searchable, and readily accessible for inspection.

The SEC record retention requirements are meant to promote transparency, accountability, and integrity of the financial markets by ensuring that comprehensive and reliable records are maintained.

Overview of FINRA Recordkeeping Rules

While the SEC oversees the broader securities market, FINRA specifically regulates brokerage firms and registered securities representatives, enforcing rules to ensure they operate fairly and honestly.

FINRA Rule 4511 and SEC Rules 17a-3 and 17a-4 collectively shape the recordkeeping landscape for broker-dealers, ensuring that the securities industry maintains comprehensive, accurate, and accessible records.

SEC Rule 17a-3 “Records to be made by certain exchange members, brokers and dealers” mandates that broker-dealers create and preserve accurate, current, and detailed records of their securities business.

SEC Rule 17a-4 details how long records must be kept (typically three to six years, depending on the type of record), the format in which they must be stored (ensuring they are tamper-proof), and how they should be accessible for inspection by regulatory authorities.

This rule also addresses the electronic storage of records, requiring that records are preserved exclusively in a non-rewritable, non-erasable format, or WORM. Write Once, Read Many (WORM) technology allows for retrospective audits and the ability to track and hold parties accountable for any changes made.

Jump to Requirements for Format and Accessibility of Records.

Over the years, the SEC has made several amendments to Rules 17a-3 and 17a-4 to address the evolving landscape of the securities industry and technological advancements.

These amendments aim to ensure that the recordkeeping and retention requirements remain relevant, effective, and aligned with current industry practices.

Here are some of the key amendments made to SEC Rule 17a-3 and Rule 17a-4:

1. SEC Rule 17a-4: WORM Requirement Amendment

In 2022, the SEC amended the books and records rules to introduce more flexibility in how electronic records are maintained. In addition to the traditional WORM (write once, read many) format for records, firms now have the option to use an "audit-trail" alternative.

This alternative requires an electronic recordkeeping system to:

• Maintain a comprehensive, time-stamped audit trail of all modifications, deletions, and actions related to the records
• Ensure original records can be recreated if altered
• Ensure authenticity and reliability
• Have backup recordkeeping system or redundancy capabilities to ensure continued access to records in cases of system disruption or failure

This amendment from the SEC aims to make the rules more technology-neutral, accommodating the rapid evolution of electronic storage technologies. This amendment is intended to be flexible enough to accommodate future technological innovations in recordkeeping without necessitating further amendments.

Learn more about WORM Storage and why it’s important here.

2. Third-Party Recordkeeping Software & Services

Previously, broker-dealers were required to engage a third party who could access and download information from their electronic storage media where records were kept.

Amendments were introduced to offer an alternative where a broker-dealer can designate an executive officer to fulfill these responsibilities instead.

This executive officer is empowered to access and provide records maintained on the firm’s electronic recordkeeping system, enhancing flexibility in compliance and reducing dependency on external third-party recordkeepers.The requirement for broker-dealers to notify their designated examining authority before employing an electronic recordkeeping system has also been removed, streamlining the compliance process.

The SEC's updated rules also permit the use of cloud services for storing records, with the condition that firms can access these records independently, without needing the cloud provider's help to manage or retrieve them.

3. Accessibility of Records

Amendments have been made to ensure that records are easily accessible for a specified period and can be produced promptly to regulators.

Records must be stored in a manner that allows for easy, prompt retrieval, typically within 24 hours during regular business hours. This requirement ensures that the industry remains transparent, accountable, and prepared to facilitate regulatory investigations swiftly.

The amendments also emphasize that firms must provide records in a "reasonably usable electronic format" when requested, which means a format compatible with common systems for accessing and reading electronic records.

4. Regulation Best Interest Amendment to SEC Rule 17a-3

Always keen to keep compliance departments on their toes, the SEC also announced new recordkeeping requirements in Reg BI, which were implemented starting from June 2020, with new paragraphs applying under Rules 17-a3 and 17-a4.

They specifically relate to the need for the broker-dealer to record all information given to (and taken from) a retail customer. They must also record the identity of each registered representative responsible for the account in question.

As per the pre-existing regulations, these records need to be secured for a minimum period of six years, to the same high standards of detail and security that 17a-3 and 17a-4 places on the other data collected and preserved.

Reg BI was introduced with the intention of ensuring that any recommendations made by broker-dealers were made in the best interest of the customer in question, in an overarching principle known as the “general obligation.”

The specific obligations are as follows:

• Disclosure Obligation: Written disclosure of all facts about the scope and terms of its relationship with the customer must be given at the time of (or prior to) the recommendation. This disclosure should be kept updated if any substantial change occurs.
• Care Obligation: At the time of the recommendation, the broker-dealer must be acting in good faith and exercising all reasonable diligence to ensure that the customer’s best interest is being met.
• Conflict of Interest Obligation: Policies and procedures must be put in place to identify conflicts of interest when it comes to making recommendations to customers. Any conflicts that are identified should be disclosed, mitigated, or avoided. Specific conflicts such as motivational sales contests, quotas, and time-specific bonuses should be eliminated.
  
• Compliance Obligation: All reasonable measures should be put in place to achieve compliance with Reg BI. This relates to the resolution of any non-compliance as well as the rollout of controls, training, and ongoing reviews.

These amendments reflect the SEC's effort to maintain robust regulatory standards while adapting to technological changes. It's crucial to stay informed about these changes and integrate them into compliance practices to avoid regulatory issues.

As part of the Investment Advisers Act of 1940, SEC Rule 204-2, “Books and records to be maintained by investment advisers” mandates investment advisers maintain accurate, true, and current books and records relevant to their business. This rule encompasses a broad spectrum of records, including details of transactions, financial statements, SOPs, communications, and other business records.

The rule also specifies retention periods for such records, generally requiring that records be kept in an easily accessible place for a period of at least five years. It also requires that records must be readily accessible and produced promptly for inspection.

Rule 4511, “Books and Records Requirements: General Requirements” is short and straightforward. It is written as follows:

(a) Members shall make and preserve books and records as required under the FINRA rules, the Exchange Act and the applicable Exchange Act rules.

(b) Members shall preserve for a period of at least six years those FINRA books and records for which there is no specified period under the FINRA rules or applicable Exchange Act rules.

(c) All books and records required to be made pursuant to the FINRA rules shall be preserved in a format and media that complies with SEA Rule 17a-4.

FINRA Rule 2210, “Communications with the Public” mandates communication standards for financial services firms and brokers, including on social media, advertisem*nts, and websites. It also outlines requirements for content, approval, and recordkeeping of public communications.

Here are some key requirements:

• Recordkeeping: Member firms are required to maintain records of all communications, including both the original communication and any approval, modification, or rejection of the communication.
• Approval and Review of Communications: Firms must establish written procedures for the review and approval of communications with the public. These procedures should be designed to ensure that communications are fair, balanced, and not misleading. Procedures and approvals should be retained as records.
• Content Standards: Communications must be based on principles of fair dealing and good faith, and they should provide a sound basis for evaluating the facts about the specific security or service being promoted. Communications should not make exaggerated or unwarranted claims, nor should they predict or project performance. These communications must also be retained as records.
• Social Media and Electronic Communications: Firms are responsible for ensuring that their representatives' use of social media complies with regulatory standards. Firms are required to capture and archive electronic communications, including social media posts, for recordkeeping purposes.

The SEC marketing rules, particularly when considered in conjunction with Rules 17a-3 and 17a-4, specifically focus on ensuring that broker-dealers maintain transparent, fair, and compliant marketing practices, while also adhering to strict recordkeeping and retention policies.

While Rules 17a-3 and 17a-4 don’t directly address marketing practices, they create a foundational framework that impacts how marketing materials are recorded, stored, and retained within the regulatory environment set by the SEC.

Under Rule 17a-3, especially when considered alongside The SEC marketing rules, financial service providers must retain records of advertisem*nts, promotional materials, and communications with the public that relate to their business, including all website and social media content.

This ensures there is a detailed account of the firm’s promotional activities and the historical marketing practices of a firm can be reviewed for compliance with applicable advertising regulations, such as FINRA Rule 2210, which governs communications with the public.

Amendments to The SEC’s Marketing Rules

In 2020, the SEC introduced the new marketing rule, which amends Rule 206(4)-1 under the Investment Advisers Act. It significantly changed how investment advisers handle advertising and recordkeeping, particularly concerning marketing and promotional materials.

The rule expands the definition of "advertisem*nt," which now encompasses a broader range of communications, including those to more than one person or those containing hypothetical performance claims.

Importantly, the rule introduces principles-based prohibitions that prevent advertisem*nts from being misleading or including unsubstantiated claims. It allows for the inclusion of testimonials and endorsem*nts under certain conditions, requiring clear disclosures and compliance with specific standards to ensure that such content is not misleading.

Regarding recordkeeping, the updated Rule 204-2 mandates that advisers maintain records of all advertisem*nts disseminated.

This change reflects the SEC's intent to encompass a wider array of marketing communications under its regulatory oversight, ensuring that advisers retain comprehensive records to support the claims made in their advertisem*nts and to facilitate regulatory reviews and compliance checks.

Learn more about the SEC New Marketing Rule

An extensive variety of content is subject to the provisions of SEC and FINRA ‘Books and Records’ requirements. To find out whether specific content is subject to any of these rules, it is important to read the individual rules in full.

As a general overview, here is a list of the most common types of records that typically need to be retained under SEC Rules 17a-3 and 17a-4, FINRA Rules 4511 and 2210, SEC Rule 204-2, and the SEC Marketing Rule:

• Blotters (or Books of Original Entry): Records of original entry into the accounting system detailing daily transactions, including purchases and sales of securities, receipts, and deliveries of securities, including certificate numbers, and receipt and disbursem*nt of funds.
• Ledger Accounts (or Customer Ledgers): Detailed records of all assets and liabilities, income, and expense accounts, customer securities, and cash accounts showing each transaction affecting the account and the current balance.
• Order Tickets: Written (or electronic) record of each order to buy or sell securities, including terms and conditions of the order, the account for which the order was entered, and the broker-dealer's handling of the order.
• Trade Confirmations: Records of the terms and execution of transactions made on behalf of customers or for the broker-dealer’s own account.
• Trial Balances: Monthly computations of ledger account balances that show the financial condition of the firm.
• Securities Record or Stock Record: A record that details each security carried by the broker-dealer for its account or for the account of its customers.
• Associated Persons’ Records: Details of each associated person of the broker-dealer, including the person's name, address, and the capacity in which they are associated with the broker-dealer. An "associated person" typically includes any partner, officer, director, or employee of the broker-dealer, or any person directly or indirectly controlling or controlled by the broker-dealer, including any registered representatives or other individuals engaged in the broker-dealer’s securities business.
• Customer Account Information: Records containing the written information used to open a customer's account, update account information, and ensure the suitability of recommendations.
• Communications and Agreements: Copies of all written agreements or contracts between the broker-dealer and any customer or counterparty, as well as all written communications relating to the broker-dealer’s business.
• Compliance and Procedures Documents: Records of the broker-dealer's policies and procedures for ensuring compliance with SEC rules and regulations.
• Net Capital Calculations: Documentation of the broker-dealer's calculation of its net capital and reserve requirements under SEC Rule 15c3-1 and 15c3-3.
• Employment Records: Records of all associated persons, including their fingerprints, professional background, and disciplinary history.
• Emails and Electronic Communications: All electronic correspondences related to the broker-dealer’s business. This can include emails, text messages, instant messages sent on third-party apps like WhatsApp, and Microsoft Teams, Slack, or other Enterprise Collaboration Platform messages. It’s the content of the communications that dictates whether they need to be retained, not the platform used. Communications that relate to the firm’s business, advice, transactions, or regulatory matters should be retained.
• Retail Communications: Including advertisem*nts, sales literature, and correspondence with the public related to the broker-dealer’s business. This can include websites and social media accounts.
• Communications Approval and Reviews: Documentation of the approval of communications by a registered principal and records of any review and endorsem*nt of such communications.
• Advertisem*nts: Copies of all advertisem*nts disseminated, including performance information, testimonials, endorsem*nts, and third-party ratings.
• Claims Evidence and Methodology: Records supporting the basis for claims made in advertisem*nts, including the methodology of performance calculations and substantiation of statements.

Retaining all the documentation required to satisfy the SEC and FINRA books and records rules is a substantial undertaking. However, if these documents are not captured, preserved, or produced in the specific formats outlined by rules, they can cause major problems, delays, or even fines in the event of a regulatory examination, audit, or investigation.

In December 2016, the Financial Industry Regulatory Authority (FINRA) fined 12 firms a total of $14.4 million for what it called “failing to protect records from alteration.” Quite simply, these firms had failed to make use of the proper WORM storage.

“FINRA found that at various times, and in most cases for prolonged periods, the firms failed to maintain electronic records in “write once, read many,” or WORM, format, which prevents the alteration or destruction of records stored electronically,” said the official FINRA press statement.

“Federal securities laws and FINRA rules require that business-related electronic records be kept in WORM format to prevent alteration. The SEC has stated that these requirements are an essential part of the investor protection function because a firm's books and records are the ‘primary means of monitoring compliance with applicable securities laws, including antifraud provisions and financial responsibility standards.’”

Needless to say, how to capture, store, and produce records matters. Compliance with the format and accessibility rules outlined in SEC Rule 17a-4 and FINRA Rule 4511 ensure that records are kept in a manner that guarantees their integrity, accuracy, and accessibility, while also helping to avoid major fines by the governing bodies.

SEC Rule 17a-4 & FINRA Rule 4511 Format & Accessibility Requirements

• Non-Erasable and Non-Rewritable Format: Often referred to as the WORM (Write Once, Read Many) requirement, this stipulates that electronic records must be preserved in a format that cannot be altered or destroyed for a specified retention period.
• Indexing: Records must be indexed and readily accessible. The index must be maintained and preserved for the duration of the records retention period.
• Easily Accessible and Readable: The stored records must be easily accessible to the examination staff, readable, and capable of being reproduced in a printed format.
• Retention Periods: Specific types of records must be retained for particular time frames (generally three to six years, with the first two years in an easily accessible place).
• Prompt Production: Firms must be able to promptly produce required records and provide them in a readable format to the SEC, self-regulatory organizations, or other competent authorities.
• Third-Party Downloads: If using third-party services to store records (electronic storage media), firms must file an undertaking letter, essentially an agreement ensuring the SEC has access to the records even in the event of the firm’s non-cooperation or closure.
• Regular Verification: Firms are encouraged to regularly verify that their electronic storage systems comply with SEC and FINRA rules, including the capacity to readily download records in a readable and usable format.
• Audit Systems: Firms must have an audit system in place for inputting and accessing the stored records, ensuring the accountability and traceability of access and changes.
• Business Continuity Planning: Firms are expected to have adequate business continuity plans that ensure the preservation of records in the event of a significant business disruption or crisis.

The SEC and FINRA’s mandated record retention periods can vary depending on the records; usually the required retention period is between 3-6 years.

Generally speaking, under SEC Rules 17a-3 and 17a-4, the ‘general retention period’ mandates that most records specified under Rule 17a-3 be kept for at least three years, with an emphasis on keeping the first two years' records readily accessible.

Investment Advisers are generally required to maintain records for at least five years, with the first two years’ records easily accessible.

Specific categories of records have extended retention periods; for instance, blotters (or books of original entry) and ledgers, which detail assets, liabilities, income, expenses, and securities transactions, are required to be preserved for six years.

Records related to customer accounts, such as account statements and detailed ledgers, must also be maintained for six years following the account's closure.

The SEC's New Marketing Rule requires the retention of advertisem*nts, which includes marketing communications, website content, and social media posts, for at least five years, with the first two in an easily accessible place. Records supporting performance claims made in the advertisem*nts must also be retained for five years.

If a retention period for a specific book or record is not specified under FINRA or SEC rules, the default retention period is 6 years.

SEC and FINRA books and records requirements must be followed, but many individual firms should have internal policies in place as well, which may require longer retention periods.

The Securities and Exchange Commission (SEC) does not take violations of Rule 17a-3 lightly.

Non-compliance with the SEC's Rules 17a-3 and 17a-4 can have severe financial and reputational consequences for financial firms. Fines can range from thousands to millions of dollars depending on the severity and duration of non-compliance.

In addition to the financial penalty, non-compliant firms may also face suspensions or expulsion from securities exchanges, seriously jeopardizing their business operations.

But the damage isn't merely financial. The knock-on effect on your business reputation can be profound and long-lasting. Trust is vital in the financial industry. Clients want to know their money is in safe hands. The mere insinuation of non-compliance can lead to a loss of client trust, potentially resulting in a dwindling customer base and negative media attention.

Moreover, dealing with non-compliance can strain your internal resources as well. It often requires a comprehensive internal audit, potentially necessitating additional staff or external consultants, not to mention the possible adoption and implementation of new systems to ensure future compliance.

Recent Fines and Sanctions for Non-Compliance with SEC Rules

In November 2023, the SEC released an enforcement report that stated they took 784 enforcement actions resulting in $5 billion in financial remedies/penalties in 2023.

The previous year’s enforcement actions and penalties were also substantial:

As these astronomical sums suggest, non-compliance with SEC Rules 17a-3 and 17a-4 have meant extraordinary fines for financial services firms and banks.

Some of the most notable recent fines for non-compliance with recordkeeping regulations involve firms failing to preserve substantial majority of off-channel business communications including communications on personal devices and unapproved messaging platforms like WhatsApp, iMessage, and Signal.

These failures likely hindered the SEC investigations involving employees, including supervisors and executives.

But the SEC isn’t the only financial regulatory body issuing fines and penalties. FINRA and Commodity Futures Trading Commission (CFTC) have also issued substantial fines in the last few years for non-compliance with SEC & FINRA recordkeeping requirements.

Many fines were issued in addition to the fines and penalties from the SEC.

Recent Fines Issued by FINRA & CFTC

Clearly, the regulatory bodies are watching and ready to issue massive fines and penalties for non-compliance with SEC & FINRA recordkeeping rules and requirements.

The cost of being caught without necessary records could be many millions of dollars.

While meeting the stipulations of SEC & FINRA recordkeeping rules might seem like a daunting task, the cost of non-compliance can be significantly more burdensome. It's not just about the monetary penalties but the subsequent erosion of trust, potential loss of business, and the internal strain on your operations.

All of this is to say, SEC compliant recordkeeping is essential for financial firms interested in avoiding huge fines.

However, it’s clear after reviewing the cases above that most financial service firms are able to capture and retain most important records as needed. The heaviest fines that have been issued involve the inability to capture and retain tricky data sources like text messages, personal email accounts, and chat applications.

Incorporating compliant recordkeeping technology is not merely about avoiding penalties; it's a strategic investment in your firm's future, safeguarding its reputation, operational integrity, and the trust of your clients. As regulatory landscapes evolve, staying ahead with the right technology is crucial for ensuring ongoing compliance.

As discussed earlier in the SEC & FINRA Format & Accessibility Requirements section, there are many specifications for how compliant records must be captured, maintained, and retained.

As such, making sure any recordkeeping technology you employ can provide capabilities that meet these standards is essential.

Here are some key features you should look out for when considering a new recordkeeping technology:

1. Automation

Automation features that can automatically capture, categorize, index, and archive electronic communications, trades, and other business records in real-time are going to save you time and resources, while reducing the risk of manual errors and non-compliance.

Automation can also ensure your records are retained for a set duration and disposed of as needed at the end of the retention period, without having to set manual reminders or dispose of the records.

2. Advanced Encryption and Security

To safeguard sensitive information from unauthorized access and cyber threats, compliant recordkeeping technologies must employ state-of-the-art encryption methods and robust security protocols. Making sure your technology meets the WORM (Write Once, Read Many) requirement ensures that all records are securely stored and protected against potential breaches, aligning with the SEC and FINRA’s rules.

Practically speaking, look for advanced encryption like 256-bit encryption and security certifications like ISO/IEC 27001 and SOC 2 Certifications. Sites like SecurityScorecard can help.

3. Efficient Retrieval & Retention

Records are required to be easily retrievable for examination and auditing purposes. Compliant technologies will facilitate quick and efficient retrieval of records with advanced indexing and search functions, including options to export in readable formats and compatible with auditors’ standard recordkeeping technology like WARC.

4. Scalability and Flexibility

As firms grow and regulatory requirements evolve, recordkeeping systems must be scalable and flexible enough to accommodate increased data volumes and new compliance needs. Cloud-based solutions are particularly useful in this regard, offering scalability to handle expanding data sets and the agility to adapt to changing regulatory landscapes.

5. Integration Capabilities

Effective recordkeeping technology should seamlessly integrate with a firm’s existing systems, such as email, messaging platforms, websites, social media accounts, and transaction databases. This integration ensures that all relevant communications and transactions are captured and archived.

In this complex regulatory landscape, advanced recordkeeping technology is indispensable. Solutions like Pagefreezer offer a way to navigate these challenges effectively.

Pagefreezer offers compliant archiving solutions for website, social media, and enterprise collaboration platforms like Microsoft Teams and Slack.

Here are just a few of the ways Pagefreezer can help your firm stay compliant with SEC and FINRA recordkeeping requirements:

Automated Real-Time Capture and Archiving

Pagefreezer automates the capture of website, social media, and team messaging app platforms so none of your content is ever missed. This data is always accessible to users for browsing and export via our user-friendly dashboard.

Secure Data Archiving

Pagefreezer has achieved the SOC 2 Type 1 & Type 2 reports, as an attestation that our services comply with SOC’s standards for operational security. Our management system is also ISO 27001:2013 certified, meaning that we consistently meet the security goals outlined in ISO 27001. The data centers that we use are SOC 1, SOC 2, and ISO certified.

Easy Data Exports

The Pagefreezer dashboard allows administrators to export records in WARC, PDF, and CSV. All exports have the metadata, timestamps, and digital signatures needed to prove authenticity. Firms can also make use of a public access link to provide easy entrance into an entire archive for regulatory audits.