Short answer
SEC Rule 17a-4 sets record retention requirements for broker-dealers, including how long records such as communications and account records must be kept and how electronic records must be stored. Since 2022 amendments, firms can use either non-rewriteable (WORM) storage or a system with a complete audit trail.
SEC Rule 17a-4 explained
The rule requires many records to be kept for three or six years, with the first two years easily accessible. Electronic records must be preserved so they cannot be altered without detection, and firms must be able to produce them promptly to regulators. Investment advisers have a parallel books-and-records requirement under Advisers Act Rule 204-2.
Recent SEC enforcement on off-channel communications, such as business texts on personal phones, has made capturing every client communication a priority.
How Vantage Point helps: we connect Salesforce and HubSpot to archiving providers and design field history and audit controls to support retention requirements.
Frequently asked questions
What does WORM mean?
Write once, read many: storage that prevents records from being changed or deleted during the retention period.
Does Rule 17a-4 apply to CRM data?
If CRM records or communications are required business records for a broker-dealer, they must be retained in a compliant way. Many firms archive CRM emails and activity to a dedicated archive.