API Marketplace

Solutions

Resources

Our Company

Book a Demo

← Back to Glossary

SEC Rule 17a-4 Records Retention

United States

1934

Tax & Reporting

Cybersecurity

Overview

SEC Rule 17a-4, under the Securities Exchange Act of 1934, establishes the recordkeeping and retention requirements for broker-dealers. Enacted in 1997 and amended over time, it ensures that firms maintain and preserve electronic records in a manner that supports regulatory oversight and investor protection.

The rule applies to broker-dealers, investment banks, alternative trading systems (ATSs), and other registered securities firms operating in the United States. It complements SEC Rule 17a-3, which defines the types of records to be made, and requires firms to implement comprehensive digital record management systems with proper document verification and authentication protocols to ensure regulatory compliance and data integrity.

Key Obligations

Preserve specific records (e.g., communications, trade blotters, account documents) for defined retention periods
Store electronic records in a tamper-evident, non-rewritable, and non-erasable format (WORM)
Use a third-party access provider or designate a compliance officer for data retrieval

Ensure availability of records to the SEC upon request
Maintain backup systems and retrieval indexes for efficient record access
Notify the SEC of changes to recordkeeping systems

Stay ahead of risk with Signzy

Explore tools that help you onboard, monitor, and verify with confidence

Identity Verification

Use facial match and liveness checks paired with government ID verification to validate users while onboarding.

GRC

Governance, Risk, and Compliance solutions to streamline regulatory adherence and maintain operational security.

Bank Account Verification

Instantly verify bank account details to confirm account ownership and validity for secure financial transactions.

FAQ

What formats are acceptable under SEC Rule 17a-4?

Records must be stored electronically using WORM-compliant systems to prevent alteration or deletion.

How long must records be retained?

Retention periods vary by record type, with many requiring preservation for three to six years.

Can records be stored in the cloud?

Yes, if the cloud storage is WORM-compliant and meets SEC access and retention standards.

Does this apply to text messages and emails?

Yes, all electronic communications related to business operations must be archived and accessible.