Quick Answer
The SEC's records-retention rule covers five areas: manuals preserved at least 3 years after superseded; electronic storage via WORM or an audit-trail alternative, with an executive officer eligible for the access undertaking instead of a third party; retention continuing after the firm ceases business; independent access required at outside cloud providers; and prompt furnishing to the SEC on request.
The records-retention rule is the "preserving" half of the SEC recordkeeping pair. Together with the recordmaking rule, it forms the federal floor for broker-dealer recordkeeping.
Compliance, Supervisory, and Procedures Manuals
Firms must preserve compliance, supervisory, and procedures manuals, including any updates, modifications, and revisions.
| Requirement | Detail |
|---|---|
| What | Manuals describing the firm's policies and practices for compliance with applicable laws and rules, and for supervision of activities of each natural person associated with the firm |
| Retention | At least 3 years after the manual is superseded |
| Accessibility | Kept in an easily accessible place for the entire retention period (the full 3 years after the manual is superseded), not just the first 2 years |
| Updates | Updates, modifications, and revisions are themselves preserved (not just the latest version) |
Why "After Superseded" Matters
The retention clock does not start when the manual is created or adopted. It starts when the manual is superseded (replaced by a new version). This means a manual in active use, no matter how old, is still subject to ongoing retention; the 3-year clock does not begin until the firm replaces it.
- A 12-year-old written supervisory procedure (WSP) manual that has never been updated is still in active use; no 3-year clock has started
- A manual replaced in 2024 must be preserved through at least 2027 (3 years after supersession)
- Each version's clock is independent; updating a manual triggers a new 3-year clock for the version being replaced
Exam Tip: Gotchas
- The manuals clock starts when the manual is SUPERSEDED, not when it is created. A current manual has no clock running on it; only versions that have been replaced are counted. The exam may present a fact pattern asking when the firm can purge an old WSP manual; the answer is 3 years after the version was replaced, not 3 years after it was originally adopted.
- Updates and revisions are preserved as separate records. A firm cannot satisfy the manuals requirement by preserving only the latest version. Each prior version is a separate record subject to its own 3-year-after-superseded clock.
Electronic Storage Media
A broker-dealer may preserve required records on electronic storage media if the system meets one of two standards, and the firm chooses which one to use.
Two Permitted Standards (Pick One)
| Standard | What It Requires |
|---|---|
| WORM (Write Once, Read Many) | Preserve records exclusively in a non-rewriteable, non-erasable format |
| Audit-Trail Alternative | A system that permits recreation of an original record if it is modified or deleted, with a complete time-stamped audit trail of every change |
Under either standard, the storage system must also automatically verify the completeness and accuracy of the recording process, serialize and time-date the storage media where applicable, and be able to readily download them. These requirements apply to the whole system, not only to the WORM option.
The firm chooses which standard to apply. Both are acceptable. The audit-trail alternative is friendlier to modern cloud and database storage that natively supports versioning and audit logs.
Other Electronic-Storage Requirements
In addition to choosing a storage standard, the firm must:
- Backup or redundancy: The system must include a backup electronic recordkeeping system that keeps a redundant set of records, or have other redundancy capabilities designed to ensure access to the records
- Locating records: The firm must organize, maintain, keep current, and promptly provide on request all information necessary to access and locate the stored records. For micrographic media such as microfilm, the rule requires accurate indexes, a duplicate copy of the records and a duplicate of each index, each stored separately from the original
- Access undertaking: Either:
- A third-party access undertaking (a third party files a written undertaking with the firm's Designated Examining Authority (DEA), agreeing to download a requested record if the firm fails to), OR
- An executive officer designation: the firm may designate an executive officer of the firm in lieu of a third party for the same purpose
- DEA filing: The undertaking is filed with the firm's DEA. For most broker-dealers, FINRA is the DEA
No Advance DEA Notice Required
A firm may adopt an electronic recordkeeping system without notifying the DEA in advance, provided the system itself meets the electronic-storage standards above.
Exam Tip: Gotchas
- WORM and audit-trail are alternatives, not a required sequence. Either is acceptable; the firm picks one. The exam may probe whether WORM is the only path; it is not, but it remains a valid choice.
- The executive-officer-in-lieu-of-third-party option exists, but the firm still needs SOMEONE to give the access undertaking. A firm cannot skip the access undertaking entirely. It must designate either a third party or an executive officer to file the undertaking with the DEA.
Records After Ceasing Business
If a broker-dealer ceases to transact a securities business, the firm must continue to preserve records for the remainder of the applicable retention period.
The retention obligation does not extinguish at termination:
- A firm that ceases operations in Year 4 of a 6-year retention period must continue to preserve those records through Year 6
- The Form BDW filing does not itself end recordkeeping; the FINRA post-withdrawal custodian requirement handles the post-cessation custody mechanics
This is the substantive obligation that the FINRA custodian requirement implements at the FINRA level: the records survive the firm.
Exam Tip: Gotchas
- Filing Form BDW does not end the retention obligation. A withdrawing firm must preserve records for the remainder of the retention period, and FINRA requires the firm to designate a custodian on Form BDW to carry out the obligation. Withdrawal is a custody event, not a destruction event.
Independent Access to Outsourced Records
A broker-dealer using servers or storage devices owned or operated by an outside entity (e.g., cloud providers, third-party recordkeepers) has independent access to records only if it can regularly access the records without intervention of the outside entity.
What "Independent Access" Means
The firm must be able to pull its records without the cloud provider's permission, login approval, or assistance:
- The firm controls the credentials and the access path
- The vendor cannot block or condition access
- A SaaS arrangement that requires vendor login or approval does not satisfy the independent-access requirement
- The firm is functionally treated as the records' custodian even though the records physically live on the vendor's hardware
The firm must also keep the information needed to access and locate its records current and provide it promptly on request.
Think of it this way: If the firm needs to call the cloud vendor's support line to get its own records, the firm has not satisfied the independent-access requirement. The "independent" in independent access means the firm can act unilaterally.
Exam Tip: Gotchas
- A vendor portal that the vendor controls does NOT satisfy independent access. The firm must be able to pull records without the vendor's assistance or approval. The exam frames this as the outsourcing trap: a firm cannot rely on a SaaS arrangement that requires vendor cooperation for record retrieval.
Furnishing of Records to the SEC
Members must promptly furnish legible, true, complete, and current copies of records to a representative of the SEC upon request.
This requirement links to the electronic-storage third-party access undertaking. A third party (or designated executive officer) executes a written undertaking filed with the firm's DEA agreeing to furnish information the regulators request and to download a requested record if the firm fails to.
- For most broker-dealers, FINRA is the DEA
- The access undertaking backs up the furnishing obligation: the firm itself must produce requested records, and if it fails to download one, the third party (or executive officer) must
Exam Tip: Gotchas
- For most broker-dealers, FINRA is the DEA, so the access undertaking and furnishing duties run through FINRA. A firm with a NYSE primary affiliation may have a different DEA, but the typical Series 24 fact pattern assumes FINRA. The exam may use "DEA" without naming FINRA; the candidate should know FINRA fills the role for most members.
How the Records-Retention Pieces Connect
| Area | What It Governs | Period or Standard |
|---|---|---|
| Manuals retention | Compliance, supervisory, procedures manuals | Entire period, until 3 years after the manual is superseded (easily accessible the whole time, not just the first 2 years) |
| Electronic storage | Electronic storage media | WORM or audit-trail alternative; backup or redundancy; information to locate records; access undertaking |
| Ceased business | Records after ceasing business | Remainder of applicable retention period |
| Outsourced storage | Cloud and third-party recordkeepers | Independent access without vendor intervention |
| Furnishing to the SEC | SEC examination access | Promptly on request |
A firm satisfies the records-retention rule only when it satisfies all applicable provisions. Format compliance, retention durations, post-cessation custody, outsourcing controls, and SEC responsiveness are independent compliance items.
What Should You Check on Exam Day?
- Do you know when the 3-year manuals retention clock starts, at adoption or when the manual is superseded?
- Can you state the two permitted electronic-storage standards, and who may give the access undertaking besides a third party?
- Do you know that a records-retention obligation continues for the remainder of its period even after the firm ceases business?
- Can you state what makes access to outsourced records independent, and why a vendor-approval portal fails that test?