SEC Rule 17a-4 and WORM storage, explained

WORM stands for write once, read many. The SEC uses the term itself: when it amended the rule in 2022 it described the old requirement as keeping electronic records “exclusively in a non-rewriteable, non-erasable format (also known as a write once, read many (‘WORM’) format).” A record written to WORM storage can be read as often as anyone likes, but nobody can change it or erase it before its retention period ends. That includes the firm's own administrators.

Before the amendments, WORM was the only format the rule allowed for records a broker-dealer kept on electronic storage. That is why “WORM” and “17a-4 compliant” came to be used as if they meant the same thing. Since 2023 they do not. The rule now accepts a second method, a complete time-stamped audit trail, and WORM is one of two ways to meet it.

Rule 17a-4 is an Exchange Act rule for broker-dealers. Paragraph (f) lets a broker-dealer keep the records that Rules 17a-3 and 17a-4 require on an electronic recordkeeping system, which the rule defines as one that “preserves records in a digital format in a manner that permits the records to be viewed and downloaded”. FINRA sends its members to the same standard: Rule 4511(c) says FINRA books and records “shall be preserved in a format and media that complies with SEA Rule 17a-4.” Our guide to FINRA Rule 4511 covers the rest of that rule.

An SEC-registered investment adviser is a different case. Its electronic records fall under Advisers Act Rule 204-2(g), which has no WORM requirement, no audit-trail requirement and no undertaking. Those conditions belong to 17a-4(f) alone. A firm registered both ways keeps its broker-dealer records to 17a-4(f).

For the dual registrant, Rule 204-2(h)(1) says a record kept under 17a-3 or 17a-4 that “is substantially the same as the book or other record required to be made, kept, maintained and preserved under this section, shall be deemed to be made, kept, maintained and preserved in compliance with this section.” Which records meet that test is a question for your compliance counsel.

The SEC adopted the amendments in a release published on November 3, 2022. They took effect on January 3, 2023, and “The compliance date for the amendments to 17 CFR 240.17a-4 is May 3, 2023.”

The headline change is the audit-trail alternative, but it was not the only one. The release also dropped two filings a firm used to make before it could store anything electronically, and changed who gives the undertaking.

The release adds that the amended rule requires firms “to be able to produce a record in a human readable and reasonably usable electronic format.” The full text is on the Federal Register.

The amended rule gives a broker-dealer a choice for each electronic recordkeeping system. It can keep records where they cannot be changed at all, or keep them where they can be changed, provided every change leaves a trail from which the original can be rebuilt. Either one satisfies paragraph (f)(2)(i), and the rule does not rank them. Because the test is put to each electronic recordkeeping system, by our reading a firm may meet it one way in one system and the other way in another.

The WORM mode puts the control in the storage. A locked retention period refuses any change, so the proof is the lock itself, but the rule then asks for a separate audit system that accounts for the inputting of records and of any changes made to them. The audit-trail mode puts the control in the software. It suits a system that has to allow edits, such as a document store or a CRM that keeps records, as long as nothing is lost when someone edits. By our reading that is why storage products are sold for the first mode and archives and records systems for the second. The storage side is read provider by provider in the best SEC 17a-4 compliant cloud storage.

The mode is one line of paragraph (f)(2). The rest of (f)(2) and all of (f)(3) apply whichever mode the firm picks, and most of it is about getting records back out. The system must “Verify automatically the completeness and accuracy of the processes for storing and retaining records electronically”, keep a backup or “other redundancy capabilities”, and be able to “readily download and transfer copies of a record and its audit trail (if applicable) in both a human readable format and in a reasonably usable electronic format”, together with “the information needed to locate the electronic record”.

The firm itself must have facilities “for immediately producing the records”, be ready to “immediately provide” any record a regulator asks for, and keep current “all information necessary to access and locate records”. Rule 17a-4(j) adds the general duty to furnish copies promptly to the Commission. The finder below lists every duty for your firm type and mode, with its paragraph.

For an archive, the export line is the one worth testing before you sign. Archives built for message capture are compared in email archiving software and text message archiving.

Every broker-dealer that keeps records electronically must “Have at all times filed with the designated examining authority” an undertaking about those records, “signed by either a designated executive officer or designated third party”. The rule writes out the words of the undertaking itself. Its opening promise:

In plain terms, the signer is the fallback. If the firm cannot or will not produce a record, the signer commits to getting it out of the system in a form an examiner can read and work with. The same promise runs to the firm's SROs and to any state securities regulator with jurisdiction over it.

The adopting release explains the choice: “some firms may choose the Designated Executive Officer option for cyber-security reasons because these firms prefer to make this an internal function. Other firms may elect the Designated Third-Party Option because they prefer to outsource this function.” In a firm of a few people the executive officer is often the owner, so the appointment of up to two designated officers is what keeps the promise good when that person is unable to act.

Rule 17a-4(f) sets how records are kept, not for how long. The periods come from the rest of Rule 17a-4 and, for FINRA records that have no period of their own, from FINRA Rule 4511(b). A WORM store has to carry each period on each class of record, so the periods decide how the store is set up.

Two points trip firms up. First, 17a-4(a) and (b) give a length and a two-year easily accessible window but do not say what event the period runs from, so agree the start point with your compliance counsel before you set a lock. A lock that runs out before the rule's period does leaves the record erasable while the rule still requires it. Second, records kept “during the life of the enterprise and of any successor enterprise” have no end date for a lock to count down to. Our books and records retention calculator works out the keep-until date for each class.

Card 02

A firm with a handful of registered people usually has three or four systems that hold required records, and no one whose whole job is records. These nine steps cover the rule in the order a small firm meets it. The books and records checklist gives the list for step one, and the archiving requirements matcher maps each channel your people use for step two.

Steps four and six are the two a firm can check this week: can it hand over a record, and is someone on file who will if the firm cannot. Off-channel messages never reach any of these systems, which is why they are a records failure before they are anything else; see off-channel communications.

The duties in Rule 17a-4(f) fall on the broker-dealer. A vendor can make them easy to meet, but no vendor can meet them for you, and neither the SEC nor FINRA approves storage or archive products. FINRA also retired its Compliance Vendor Directory, effective March 19, 2024, so a listing there is no longer a check you can run. Ask each vendor for the documents instead.

An independent assessment is the vendor's evidence for part of the rule, not a regulator's approval. Read which mode it covers and what configuration it assumes. How six storage products answer these questions on their own pages is in our 17a-4 storage comparison.

Advisers often meet WORM in vendor material written for broker-dealers. An SEC-registered adviser keeps electronic records under Rule 204-2(g), on “any digital storage medium or system that meets the terms of this section.” Those terms overlap with 17a-4(f) in purpose but not in form.

That safeguarding line is the closest 204-2(g) comes to WORM, and it asks for procedures, not a format. An adviser may choose a locked store as one way to show records are safe from alteration, but the rule does not require it. The adviser's full list of records and periods is in Rule 204-2, the adviser books and records rule.

This guide explains the rule; it is not legal advice. Check your firm's set-up against the full rule text with your compliance counsel.