Records to Be Preserved

The records-retention rule is the "preserving" half of the SEC recordkeeping pair. Together with the recordmaking rule, it forms the federal floor for broker-dealer recordkeeping.

Compliance, Supervisory, and Procedures Manuals

Firms must preserve compliance, supervisory, and procedures manuals, including any updates, modifications, and revisions.

Why "After Superseded" Matters

The retention clock does not start when the manual is created or adopted. It starts when the manual is superseded (replaced by a new version). This means a manual in active use, no matter how old, is still subject to ongoing retention; the 3-year clock does not begin until the firm replaces it.

• A 12-year-old WSP manual that has never been updated is still in active use; no 3-year clock has started
• A manual replaced in 2024 must be preserved through at least 2027 (3 years after supersession)
• Each version's clock is independent; updating a manual triggers a new 3-year clock for the version being replaced

Exam Tip: Gotchas

• The manuals clock starts when the manual is SUPERSEDED, not when it is created. A current manual has no clock running on it; only versions that have been replaced are counted. The exam may present a fact pattern asking when the firm can purge an old WSP manual; the answer is 3 years after the version was replaced, not 3 years after it was originally adopted.
• Updates and revisions are preserved as separate records. A firm cannot satisfy the manuals requirement by preserving only the latest version. Each prior version is a separate record subject to its own 3-year-after-superseded clock.

Electronic Storage Media

A broker-dealer may preserve required records on electronic storage media if the system meets one of two standards. The 2022 amendments modernized the regime by adding the audit-trail option and by changing the access-undertaking mechanic.

Two Permitted Standards (Pick One)

The firm chooses which standard to apply. Both are acceptable. The audit-trail alternative is friendlier to modern cloud and database storage that natively supports versioning and audit logs.

Other Electronic-Storage Requirements

In addition to choosing a storage standard, the firm must:

• Duplicate copy: A duplicate copy of the records must be stored separately from the originals
• Indexes: An accurate index of all preserved records must be created and preserved with the records, plus a duplicate of the indexes
• Access undertaking: Either:
  • A third-party access undertaking (a third party files a written undertaking with the firm's Designated Examining Authority (DEA), agreeing to download records on demand), OR
  • An executive officer designation (added 2022) - the firm may designate an executive officer of the firm in lieu of a third party for the same purpose
• DEA filing: The undertaking is filed with the firm's DEA. For most broker-dealers, FINRA is the DEA

What the 2022 Amendments Eliminated

The 2022 amendments removed the prior requirement to notify the DEA before adopting an electronic recordkeeping system. A firm may now adopt an electronic recordkeeping system without prior DEA notification, provided the system itself meets the electronic-storage standards.

Exam Tip: Gotchas

• WORM and audit-trail are alternatives. Either is acceptable; the firm picks one. The 2022 amendments did NOT eliminate WORM; they added a parallel option. The exam may probe whether WORM is still required; it is not the only path, but it remains valid.
• The executive-officer-in-lieu-of-third-party option exists, but the firm still needs SOMEONE to give the access undertaking. A firm cannot skip the access undertaking entirely. It must designate either a third party or an executive officer to file the undertaking with the DEA.

Records After Ceasing Business

If a broker-dealer ceases to transact a securities business, the firm must continue to preserve records for the remainder of the applicable retention period.

The retention obligation does not extinguish at termination:

• A firm that ceases operations in Year 4 of a 6-year retention period must continue to preserve those records through Year 6
• The Form BDW filing does not itself end recordkeeping; the FINRA post-withdrawal custodian requirement handles the post-cessation custody mechanics

This is the substantive obligation that the FINRA custodian requirement implements at the FINRA level: the records survive the firm.

Exam Tip: Gotchas

• Filing Form BDW does not end the retention obligation. A withdrawing firm must preserve records for the remainder of the retention period, and FINRA requires the firm to designate a custodian on Form BDW to carry out the obligation. Withdrawal is a custody event, not a destruction event.

Independent Access to Outsourced Records

A broker-dealer using servers or storage devices owned or operated by an outside entity (e.g., cloud providers, third-party recordkeepers) has independent access to records only if it can regularly access the records without intervention of the outside entity.

What "Independent Access" Means

The firm must be able to pull its records without the cloud provider's permission, login approval, or assistance:

• The firm controls the credentials and the access path
• The vendor cannot block or condition access
• A SaaS arrangement that requires vendor login or approval does not satisfy the independent-access requirement
• The firm is functionally treated as the records' custodian even though the records physically live on the vendor's hardware

Indexes must permit easy location, access, and retrieval.

Think of it this way: If the firm needs to call the cloud vendor's support line to get its own records, the firm has not satisfied the independent-access requirement. The "independent" in independent access means the firm can act unilaterally.

Exam Tip: Gotchas

• A vendor portal that the vendor controls does NOT satisfy independent access. The firm must be able to pull records without the vendor's assistance or approval. The exam frames this as the outsourcing trap: a firm cannot rely on a SaaS arrangement that requires vendor cooperation for record retrieval.

Furnishing of Records to the SEC

Members must promptly furnish legible, true, complete, and current copies of records to the SEC and other authorized regulators upon request.

This requirement links to the electronic-storage third-party access undertaking. A third party (or designated executive officer, post-2022) executes a written undertaking filed with the firm's DEA agreeing to download records to an acceptable medium on demand.

• For most broker-dealers, FINRA is the DEA
• The furnishing obligation is what makes the access undertaking operationally meaningful: the SEC can demand records, and the third party (or executive officer) must produce them

Exam Tip: Gotchas

• For most broker-dealers, FINRA is the DEA, so the access undertaking and furnishing duties run through FINRA. A firm with a NYSE primary affiliation may have a different DEA, but the typical Series 24 fact pattern assumes FINRA. The exam may use "DEA" without naming FINRA; the candidate should know FINRA fills the role for most members.

How the Records-Retention Pieces Connect

A firm satisfies the records-retention rule only when it satisfies all applicable provisions. Format compliance, retention durations, post-cessation custody, outsourcing controls, and SEC responsiveness are independent compliance items.