Skip to main content
Records Authority
Category: Laws and Regulations

SEC Rule 17a-4

Also known as: SEA Rule 17a-4, Rule 17a-4, SEC 17a-4
Simply put

SEC Rule 17a-4 is a regulation issued by the U.S. Securities and Exchange Commission that sets out how certain financial firms, such as broker-dealers, must preserve and retain their business records. It addresses how long records must be kept and how they should be indexed and made accessible, including records held in electronic form. It applies within the U.S. securities regulatory framework and complements related recordkeeping requirements such as SEC Rule 17a-3.

Formal definition

SEC Rule 17a-4 is a regulation promulgated by the U.S. Securities and Exchange Commission that specifies records preservation and retention obligations for registered broker-dealers and certain other exchange members. It addresses retention periods, indexing, and accessibility of preserved records, and its requirements extend to electronically stored information (ESI). According to the evidence, the rule requires that certain records be preserved for a period of not less than 6 years, though the applicable retention period may vary by record type; practitioners should consult the current rule text and related interpretive guidance for specific categories and durations. The rule operates alongside SEC Rule 17a-3, which addresses record creation, whereas 17a-4 governs the subsequent preservation and maintenance of those records. Its scope is limited to entities regulated under the U.S. securities framework and does not represent a universal recordkeeping standard across other jurisdictions or sectors.

Why it matters

SEC Rule 17a-4 is significant because it establishes preservation and retention obligations that registered broker-dealers and certain other exchange members must meet within the U.S. securities regulatory framework. For firms operating in this space, recordkeeping is not merely an administrative function but a supervised regulatory requirement, and the rule shapes how these organizations design their records preservation programs, particularly for electronically stored information (ESI). Because the rule addresses retention periods, indexing, and accessibility, it directly influences the systems and controls firms put in place to demonstrate that their records remain retrievable and reliable over time.

The rule matters especially for how firms handle electronic records. As business communications and transactional records increasingly exist only in electronic form, the requirements governing how ESI is managed, indexed, and made accessible have practical consequences for technology selection, archiving arrangements, and vendor relationships. The evidence indicates that the rule's requirements extend to electronically stored information and that certain records must be preserved for a period of not less than six years, though applicable periods may vary by record type. Firms typically need to consult the current rule text and related interpretive guidance to determine the correct treatment for specific categories of records.

It is worth emphasizing the scope boundary: Rule 17a-4 applies to entities regulated under the U.S. securities framework and does not represent a universal recordkeeping standard applicable across other sectors or jurisdictions. Organizations outside this regulatory perimeter should not treat its retention periods or preservation methods as generally binding, though some may reference its approach informally. Practitioners should confirm applicability to their specific circumstances rather than assuming the rule governs their records.

Who it's relevant to

Broker-dealers and exchange members
Registered broker-dealers and certain other exchange members regulated under the U.S. securities framework are the primary entities subject to Rule 17a-4. These organizations must preserve and retain business records in accordance with the rule's requirements for retention periods, indexing, and accessibility, including records held in electronic form.
Compliance and records management staff
Compliance officers and records managers within regulated financial firms are responsible for translating the rule's preservation and retention obligations into operational schedules and controls. Because applicable retention periods may vary by record type, these professionals typically need to consult the current rule text and related interpretive guidance to determine correct treatment for specific record categories.
Information technology and archiving teams
Teams responsible for managing electronically stored information play a central role, as the rule's requirements extend to ESI and address how preserved records must be indexed and made accessible. This affects decisions about archiving systems, storage arrangements, and the ability to retrieve records reliably over the required retention period.
Vendors and service providers
Technology vendors and service providers that supply archiving, records preservation, or ESI management solutions to regulated financial firms are relevant insofar as their offerings must support the indexing, accessibility, and retention requirements the rule imposes. Firms relying on such providers should verify that solutions align with the current rule requirements rather than assuming compliance from vendor claims alone.

Inside SEC Rule 17a-4

Scope of covered records
SEC Rule 17a-4 is a United States regulation that addresses the retention and preservation of certain books and records by broker-dealers registered with the Securities and Exchange Commission. It operates alongside related recordkeeping requirements and specifies how long particular categories of records must be kept and in what manner they must be maintained. The precise categories and retention periods depend on the specific record type and should be confirmed against the current text of the rule.
Retention periods
The rule typically prescribes minimum periods for which specified records must be retained, and often requires that records be readily accessible for an initial portion of that period. Exact durations vary by record category; practitioners should verify current periods against the authoritative regulatory text rather than relying on general summaries.
Non-rewriteable, non-erasable storage
A frequently discussed element is the historical expectation that electronic records be preserved in a format that prevents alteration or deletion, commonly characterized as a write-once condition. The regulation has been the subject of amendments over time addressing acceptable electronic storage approaches, so the specific technical criteria that satisfy the rule should be checked against the current version and any accompanying guidance.
Accessibility and reproduction
The rule generally contemplates that preserved records remain accessible and capable of being reproduced in a usable, legible form, supporting the ability to locate, retrieve, and produce records on request. This reflects the recordkeeping properties of usability and integrity as applied within this regulatory context.
Audit, indexing, and control mechanisms
Provisions of this type typically expect organized indexing so that stored records can be located, along with controls that support the authenticity and integrity of preserved records over their required retention. Related arrangements may involve third-party access or oversight capabilities; the specific mechanisms should be confirmed against the current rule.

Common questions

Answers to the questions practitioners most commonly ask about SEC Rule 17a-4.

Does compliance with SEC Rule 17a-4 require records to be stored on WORM (write once, read many) optical media?
Not necessarily. The rule has historically been associated with WORM optical storage because earlier versions emphasized non-rewritable, non-erasable formats. However, the requirement is generally framed around the outcome, that records be preserved in a way that prevents alteration or deletion for the required period, rather than mandating a single named technology. Amendments over time have broadened the acceptable approaches, and the specifics of what satisfies the non-alteration condition depend on how the requirement is interpreted and applied. Organizations should confirm the current text and any applicable interpretive guidance rather than assuming a particular medium is compulsory.
Is SEC Rule 17a-4 a general records management standard that any organization can adopt?
No. It is a sector-specific regulatory requirement applying to certain regulated entities within the United States securities industry, and its obligations flow from that regulatory context rather than from a voluntary standards framework. It is distinct in nature from consensus recordkeeping standards, which are designed for broad adoption across sectors and jurisdictions. While its principles around retention and record integrity may resonate with general recordkeeping practice, it should not be treated as a universal or portable standard. Its applicability depends on the type of entity and the jurisdiction in question.
How does an organization determine which records fall within the scope of the rule?
Scoping typically begins by identifying the categories of records the rule addresses and mapping them against the entity's actual business activities and systems. Because the obligation attaches to particular record types held by regulated entities, organizations often work with compliance and legal functions to classify records accurately and to distinguish records subject to the rule from other business information. The precise categories and how they map to modern communication and transaction systems can require careful interpretation, so entities generally validate their scoping against the current regulatory text and any guidance rather than relying on assumptions.
What retention periods apply, and how should they be operationalized?
The rule associates different record categories with different minimum retention periods, and some records must remain readily accessible for an initial portion of that period before they may be retained in a less immediately accessible manner. Operationally, organizations typically translate these requirements into retention schedules within their records systems, ensuring that categories are correctly assigned and that disposition does not occur before the applicable period elapses. Because the specific durations and accessibility conditions are set by the regulation and may change, entities should confirm current requirements rather than relying on remembered figures, and align internal schedules accordingly.
How should legal holds be reconciled with disposition under the rule?
Retention obligations under the rule establish minimum periods, but they do not authorize destruction of records subject to a legal hold, litigation, investigation, or other preservation obligation. In practice, organizations design their disposition processes so that any hold suspends scheduled destruction for affected records until the hold is lifted. Because preservation obligations can arise from multiple sources and vary by circumstance and jurisdiction, records and compliance teams generally coordinate to ensure that expiry of a regulatory retention period does not trigger automatic destruction where another obligation to preserve exists.
What supporting controls and documentation are typically expected alongside the stored records?
Beyond retaining the records themselves, entities generally maintain controls that support the authenticity, integrity, and retrievability of the records over the required period. This can include arrangements for accessing and reproducing records, indexing so that records can be located, and provisions addressing continued access should the entity be unable to do so itself. Documentation of the recordkeeping system and its controls is commonly part of demonstrating compliance. The exact form these controls and attestations take depends on the current regulatory requirements and the entity's systems, so organizations should verify present expectations rather than assume a fixed checklist.

Common misconceptions

SEC Rule 17a-4 is a general records management standard that applies broadly to any organization.
It is a sector- and jurisdiction-specific United States regulation directed at particular regulated entities, such as broker-dealers. It is not a universal recordkeeping framework, and organizations outside its scope are governed by their own applicable laws, regulations, and standards, which differ by jurisdiction and sector.
Complying with the rule is simply a matter of choosing a storage product marketed as compliant.
Meeting regulatory obligations involves policies, retention scheduling, indexing, accessibility, and controls over authenticity and integrity, not a single technology purchase. Vendor claims should be evaluated against the actual requirements of the current rule and any accompanying guidance rather than accepted at face value.
Retention under the rule is the same as archiving records.
Retention concerns keeping records for a required minimum period in an accessible and defensible manner. This is distinct from archiving as a preservation activity and from disposition, which may include destruction, transfer, or continued preservation once retention obligations are satisfied. Confirm current retention periods against the authoritative text before acting.

Best practices

Verify the specific record categories, retention periods, and storage criteria against the current text of the rule and any accompanying regulatory guidance rather than relying on summaries, as details may have been amended over time.
Confirm that this regulation actually applies to your organization and activities, recognizing that it is sector- and jurisdiction-specific and does not displace other applicable recordkeeping obligations.
Maintain organized indexing and retrieval capabilities so that preserved records can be located and reproduced in a usable, legible form when required.
Implement controls that support the authenticity and integrity of preserved records throughout the required retention period, and document how those controls operate.
Evaluate any storage technology against the actual requirements of the current rule rather than accepting vendor compliance claims at face value.
Distinguish retention obligations from disposition decisions, ensuring that records are only dispositioned after applicable retention periods and any legal holds have been satisfied, in line with organizational policy.