Books and Records Retention

Once records are MADE under the SEC's "records to be made" rule, the SEC's "records to be preserved" rule sets the preservation periods, the storage format, and the "easily accessible" requirement.

What Are the Three Core Retention Tiers?

The SEC recordkeeping framework has three retention tiers. Each tier covers a different category of broker-dealer record, and two of the three tiers carry the "first 2 years easily accessible" subrequirement:

Two additional triggers apply to customer-account records specifically:

• Account-opening and maintenance records: Retained for 6 years after the account closes
• Detailed customer-information records (the know-your-customer file): Retained for 6 years from the earlier of account closure or the date the information was collected, provided, replaced, or updated

Two additional retention rules that often appear alongside the three core tiers:

• Associated-person records (questionnaires, employment applications, and office/identification listings): Retained for 3 years after termination of association
• Customer-complaint records: Retained for 4 years under the FINRA customer-complaint recordkeeping rule. The SEC also requires these records (made and preserved under its own rules, in the 3-year tier), but the stricter FINRA 4-year period is the operative retention for a member firm

Exam Tip: Gotchas

• The 6-year tier covers ledgers and customer-account records, NOT order tickets or communications. Order tickets and communications sit in the 3-year tier. The exam loves swapping these.
• Organizational documents have the LONGEST retention period in the rule: life of the enterprise and of any successor enterprise. A fixed 6-year window for articles of incorporation is wrong, and there is no set number of years after termination.
• Customer-complaint records are 4 years, not 3 or 6. The SEC's own rules also require complaint records (in its 3-year tier), but FINRA requires at least 4 years, and that stricter FINRA period is the operative retention for a member firm. It is one of the most heavily tested retention periods on every FINRA exam.
• Associated-person records run 3 years after termination of association, not 3 years from creation. The clock starts when the person leaves the firm.
• Customer-account records have their own triggers, separate from the flat 6-year tier. Account-opening and maintenance records run 6 years after the account closes; detailed customer-information records run 6 years from the earlier of account closure or the date the information was last collected, provided, replaced, or updated.
• "Organizational documents" also covers registration records, not only articles of incorporation and minute books. Both categories share the life-of-the-enterprise-and-any-successor period.

What Does "Easily Accessible" Mean?

For both the 6-year and 3-year tiers, the first 2 years of the retention period must be kept in an "easily accessible" place. The 2-year window is the same regardless of the tier:

• "Easily accessible" means available for production to the SEC or FINRA promptly, without re-retrieval delays
• A record buried in cold archival storage that takes days to recall is NOT easily accessible
• After the first 2 years, records may be moved to less-accessible storage but must remain preserved through the full retention period
• The window does not change with the tier: for most records a 6-year record sits in easily-accessible storage for years 1 and 2 and may move to archival for years 3 through 6
• Exception: a separate SEC provision requires certain records to stay easily accessible for their ENTIRE retention period, not just the first 2 years. The detailed customer-information (know-your-customer) records must remain easily accessible for the full 6 years, and associated-person records for the full period after the person's termination. Ordinary account-opening and maintenance records are simply preserved for 6 years after the account closes

Think of it this way: Imagine a filing cabinet next to the compliance officer's desk and a warehouse in New Jersey. Years 1 and 2 of every record live in the cabinet (or its electronic equivalent, with prompt retrieval). Years 3 through 6 can live in the warehouse, but they cannot be destroyed. Only after year 6 does the destruction clock kick in for a 6-year record.

Exam Tip: Gotchas

• "Easily accessible" is the first 2 YEARS, not 6 months and not the full retention period. A 6-year record sits in easily-accessible storage for years 1 and 2 and may move to archival for years 3 through 6.
• The first-2-years window is the general rule, but two record types are the exception. For most records the 2-year easily-accessible window applies to both the 6-year and 3-year tiers and does not scale with the retention period. The detailed customer-information (know-your-customer) records and associated-person records, however, must stay easily accessible for their ENTIRE retention period.
• "Easily accessible" is about retrieval time, not about retention. Storage that takes days to recall is non-compliant even if the record itself is preserved.

How Long Must Communications Be Retained?

The SEC's communications-retention requirement covers every business-related communication the broker-dealer sends or receives. The categories are listed broadly so that the rule keeps up with whatever new medium the industry adopts:

• Retention requirement: Originals of all communications received AND copies of all communications sent by the broker-dealer relating to its business
• Covered media include:
  • Letters and faxes
  • Internal memoranda
  • Emails
  • Instant messages
  • Text messages
  • Business-related social media communications
• Retention period: 3 years, with the first 2 years easily accessible
• Deal-file correspondence with issuers, co-managers, syndicate members, the selling group, and investors falls under this regime

Exam Tip: Gotchas

• Electronic communications (email, instant message, text, business social media) are 3 YEARS, not 6. Order tickets are also 3 years. Customer-account records and ledgers are 6 years. Exam questions often swap these.
• Both originals received AND copies sent must be preserved. A one-way archive (outgoing only, or incoming only) is non-compliant.
• Business-related social media is covered, even if the platform itself is consumer-facing. The "business as such" test focuses on the content, not the channel.

What Storage Format Does the Rule Require?

The SEC's communications-retention rule gives broker-dealers two acceptable ways to preserve electronic records:

• Non-rewriteable, non-erasable (WORM) format: The original standard. The firm must preserve the records exclusively in this non-rewriteable, non-erasable format; once written, the record cannot be modified or deleted, and this is the "write once, read many" approach
• Audit-trail alternative: An electronic recordkeeping system that maintains a complete, time-stamped audit trail capable of recreating the original record if it is later altered. This option reflects modern cloud-storage architectures that cannot easily implement true WORM
• Broker-dealers must give either a senior firm executive (a "designated executive officer") or an unaffiliated "designated third party" access to the records, with an undertaking signed by that same designated executive officer or designated third party and filed with the designated examining authority to furnish the records to regulators on request

Think of it this way: The rule originally required broker-dealers to store electronic records on hardware that could not be rewritten (literally write-once optical disks in the early days). The rule now accepts cloud storage with full audit trails as well, so long as the system can prove no record was tampered with. The access requirement makes sure regulators can still get to the records even if the broker-dealer is uncooperative; it can be met by a senior executive of the firm or by an unaffiliated third party.

Exam Tip: Gotchas

• The audit-trail alternative was added to the rule. Electronic records originally had to be in non-rewriteable, non-erasable format (WORM). Now they can be in either WORM OR an audit-trail-compliant electronic system.
• A firm using electronic records must give either a designated executive officer (a senior firm insider) OR an unaffiliated designated third party access, plus an undertaking to produce the records for regulators. The 2022 amendment lets a designated executive officer, a firm insider, satisfy this role, so an unaffiliated third party is not mandatory. A designated third party, if the firm chooses that route instead, must still be unaffiliated.

How Do "Records to Be Made" and "Records to Be Preserved" Differ?

The two SEC rules work as a pair. The "records to be made" rule tells you what must EXIST; the "records to be preserved" rule tells you how long to KEEP IT and in WHAT FORMAT:

Exam Tip: Gotchas

• The "records to be made" rule is daily; the "records to be preserved" rule is multi-year. One is a daily creation duty; the other is a multi-year retention duty. Failing to make a record today is a different violation from failing to preserve a record made five years ago.
• Format mandates are split: the "records to be made" rule controls per-record-type structure; the "records to be preserved" rule controls electronic-format compliance (WORM or audit-trail alternative). Exam questions that ask "which rule governs the electronic-storage format?" are pointing at the "records to be preserved" rule.

What Should You Check on Exam Day?

• Match each record type to its tier: ledgers and customer-account records run 6 years, order tickets and communications run 3 years, and organizational documents run for the life of the enterprise, with no fixed end date.
• Confirm the "easily accessible" window is a fixed first 2 years for most records, but remember customer-account records and associated-person records must stay easily accessible for their entire retention period.
• Keep customer-complaint records (4 years, a FINRA rule) and associated-person records (3 years after termination) separate from the three SEC core tiers.
• Confirm electronic records may use WORM storage or an audit-trail-compliant system (not locked to one format), and that a designated executive officer alone can satisfy the access-and-undertaking requirement, with an unaffiliated designated third party as an alternative, not mandatory.
• Do not assume the rule imposes a general pre-deployment notification duty to FINRA before adopting an electronic recordkeeping system; the cited text does not state one.