How long must a broker-dealer retain business communications under Rule 17a-4?

At least three years, with the first two in an easily accessible place. Blotters, general ledgers, and certain other records must be kept for six years.

Does Rule 17a-4 still require WORM storage?

Not exclusively. A 2022 amendment added an audit-trail alternative, allowing firms to use electronic systems that maintain a complete, time-stamped record of every modification and deletion sufficient to recreate the original record.

Are text messages on personal phones subject to SEC recordkeeping rules?

Yes. Business-related communications on any channel, including personal devices, are subject to Rule 17a-4(b)(4) retention if they constitute business communications of a registered firm.

Has the SEC off-channel enforcement sweep reached smaller firms?

Yes. The 2022 and 2023 sweeps targeted major broker-dealers and banks. The August 2024 wave explicitly expanded to investment advisers and smaller registrants, signalling that size is not a defence.

SEC Recordkeeping Requirements for 2026: What Firms Must Retain, and How

A working reference to the 2026 recordkeeping obligations for broker-dealers, from the amended Rule 17a-4 audit-trail option to the off-channel communications sweep.

Sarah MitchellUS agencies correspondent · New York

January 12, 2025 · 9 min read

Stacked coins beside a ledger, illustrating broker-dealer financial recordkeeping. · Image: Girder Group

In September 2022 the Securities and Exchange Commission collected more than $1.1 billion from 15 broker-dealers and one affiliated adviser for a single category of failure: the firms could not produce their own business text messages (SEC Release 2022-174). No fraud was alleged. The charge was recordkeeping. That figure is the clearest possible statement of what the recordkeeping rules are worth in 2026, and of how expensive it has become to treat them as a back-office formality.

Key takeaways

Rule 17a-3 governs which records you must create; Rule 17a-4 governs how long you must keep them and in what form. A firm can create every record and still fail 17a-4.
The 2022 amendment added an audit-trail alternative to the WORM storage requirement. It gives more flexibility while raising the bar on provable control.
Business communications sit on a three-year retention clock, which is why unarchived messaging apps are a recordkeeping violation, not merely a supervision gap.
Enforcement is moving down-market: the 2024 sweep reached investment advisers and smaller registrants.

What the primary sources say

The obligations themselves are not new, and for 2026 they are best understood as two rules working together, plus one 2022 amendment that changed how records may be stored.

Two Exchange Act rules do most of the work. Rule 17a-3 governs which records a broker-dealer must create, from blotters and ledgers to order tickets and associated communications. Rule 17a-4 governs how long those records must be preserved and in what form. The distinction matters operationally: a firm can generate every required record and still fail 17a-4 if it cannot retain, index, and produce them.

The retention clocks are specific. Certain records, blotters and general ledgers among them, must be kept for at least six years. A large second tier, including most business communications under Rule 17a-4(b)(4), must be preserved for at least three years, with the first two years in an easily accessible place. Business communications sit squarely inside that three-year clock, which is why unarchived messaging apps are a recordkeeping violation rather than merely a supervision gap.

“The recordkeeping failure of this era is not analysis; it is reconciliation. Firms rarely know, at any moment, whether every channel in use is being captured into a compliant store.”

The amendment that changed storage

On 12 October 2022 the SEC adopted amendments to Rule 17a-4’s electronic recordkeeping requirements (Release 34-96034; broker-dealers had to comply within roughly six months of Federal Register publication, a deadline that fell in 2023). For years the rule had effectively required WORM storage, write once read many, so a record could not be altered or deleted once written.

The amendments kept WORM as an option but added an audit-trail alternative: a firm may instead use an electronic recordkeeping system that maintains a complete, time-stamped audit trail of every modification and deletion, sufficient to recreate an original record. The rule also continues to require that firms give regulators an independent path to the records, historically through a designated third party able to furnish them to the SEC and self-regulatory organisations on request.

That single change is the most consequential recordkeeping development a firm faces in 2026. WORM is a storage guarantee; the audit-trail alternative is a systems guarantee. Choosing the latter shifts the burden of proof from “the medium cannot be changed” to “we can prove exactly who changed what, and when”, a promise a firm can only keep if its capture and logging are genuinely complete.

The enforcement pattern is consistent, and it is moving

The 2022 action was not isolated. In August 2023 the SEC charged 11 firms and collected $289 million for the same conduct (Release 2023-149). In August 2024 it announced $390 million in penalties across 26 firms, a group that reached beyond the bulge-bracket banks to include investment advisers and smaller registrants (Release 2024-144).

The direction is unambiguous: the recordkeeping expectation applied to the largest institutions is being applied to progressively smaller ones. Firms watching from the mid-market should read the 2024 wave as a preview, not an exemption, a point we develop in our reporting on FINRA off-channel rules reaching smaller firms and on why most WhatsApp archives are incomplete.

What this means operationally

Decide, and document, your 17a-4 storage basis. A firm should be able to state in one sentence whether it relies on WORM or the audit-trail alternative, and show the controls that back the claim. An undocumented mix of both is the weakest position in an examination.

Map every channel to a retention clock. Email is rarely the problem. Chat, SMS, collaboration tools, and mobile messaging are. Inventory each channel your staff actually use, then confirm each one lands in a system that satisfies the three-year and six-year clocks.

Treat capture completeness as the audit-trail’s foundation. The audit-trail alternative only proves what reached the system. Records that never arrived, a message on a personal WhatsApp account for example, are invisible to it. Completeness of capture is now a recordkeeping control, not an IT preference.

Rehearse production before an examiner asks. The rules require records to be producible, indexed, and, for the first two years, readily accessible. A quarterly drill that retrieves a named person’s messages across every channel is the cheapest way to find the gap yourself.

How AI could address the gap

The recordkeeping failure of this era is not analysis; it is reconciliation. Firms rarely know, at any given moment, whether every channel in use is being captured into a compliant store. That is a matching problem, reconciling the roster of people and devices against the roster of what is actually being archived, and it is the kind of continuous, unglamorous check that machine systems do well and humans do late.

Used carefully, AI-assisted tooling can flag when a newly provisioned device or workspace has no corresponding archive feed, surface communications that reference channels the firm does not capture (“text me on my personal number”), and pre-index retained records so a production request resolves in minutes rather than weeks. None of that removes a human’s accountability for the storage basis under 17a-4, and none of it substitutes for capture that is complete at the source. What it can do is turn a periodic, manual reconciliation into a standing one, which is exactly where most of the penalised firms fell short.

Building the platforms, portals, and systems that make these obligations provable is what Girder Group does.

Sources

1.SEC Charges 16 Wall Street Firms with Widespread Recordkeeping Failures, Release 2022-174, 27 September 2022.U.S. Securities and Exchange Commission
2.SEC Charges 11 Wall Street Firms with Widespread Recordkeeping Failures, Release 2023-149, 8 August 2023.U.S. Securities and Exchange Commission
3.Off-channel communications settlements, Release 2024-144, 14 August 2024.U.S. Securities and Exchange Commission
4.SEC Adopts Amendments to Electronic Recordkeeping Requirements for Broker-Dealers, Release 34-96034, 12 October 2022.U.S. Securities and Exchange Commission
5.17 CFR § 240.17a-4 (records to be preserved by certain exchange members, brokers and dealers), current text.Electronic Code of Federal Regulations

Common questions

How long must a broker-dealer retain business communications under Rule 17a-4?: At least three years, with the first two in an easily accessible place. Blotters, general ledgers, and certain other records must be kept for six years.
Does Rule 17a-4 still require WORM storage?: Not exclusively. A 2022 amendment added an audit-trail alternative, allowing firms to use electronic systems that maintain a complete, time-stamped record of every modification and deletion sufficient to recreate the original record.
Are text messages on personal phones subject to SEC recordkeeping rules?: Yes. Business-related communications on any channel, including personal devices, are subject to Rule 17a-4(b)(4) retention if they constitute business communications of a registered firm.
Has the SEC off-channel enforcement sweep reached smaller firms?: Yes. The 2022 and 2023 sweeps targeted major broker-dealers and banks. The August 2024 wave explicitly expanded to investment advisers and smaller registrants, signalling that size is not a defence.

Sarah Mitchell

US agencies correspondent · Girder Group · New York

Sarah Mitchell covers US federal regulators, the SEC and FINRA, the FTC, and the FCC, with a focus on recordkeeping and data obligations, from Girder Group's New York desk.

Meet the desk