SEC · Rule 17a-4 / FINRA 4511
Books and Records Readiness: WORM Retention and Comms
SEC Rule 17a-4 and FINRA Rule 4511 govern how broker-dealers preserve their books and records. Together they require that many records be kept for defined periods, in a format that cannot be altered or deleted, and produced promptly when a regulator asks. These are among the most heavily examined obligations in the industry.
The hard part today is not storage capacity. It is scope. Business now happens across email, chat platforms, collaboration tools, and mobile messaging, and regulators expect firms to capture and preserve those communications the same way they preserve email. This page explains the retention and format rules and how to keep your recordkeeping continuously evidenced.
Or call us directly: (877) 945-7177
What the rule requires
Rule 17a-4 sets out how long broker-dealers must retain specified records and in what condition. Records covered by the rule must generally be preserved for a defined period, with the earliest portion of that period kept readily accessible so the firm can retrieve records quickly on request. FINRA Rule 4511 layers on that member firms must make and preserve books and records as required and, where FINRA does not specify a period, retain them for at least six years.
A defining feature is the format requirement. Electronic records must be preserved in a non-rewriteable, non-erasable condition, commonly described as WORM (write once, read many) or an equivalent audit-trail approach that prevents alteration or deletion. The core retention benchmark most firms work to is six years, with the first two years readily accessible.
- Records preserved in a non-rewriteable, non-erasable (WORM) or equivalent immutable format
- Six-year retention as the common benchmark, with the first two years readily accessible
- Complete, unaltered records producible promptly on regulatory request
- Coverage of business communications regardless of the channel they occur on
Where firms fall short
Off-channel communications are the defining recordkeeping risk of the moment. When employees discuss business on personal messaging apps, or on Teams and Slack channels that are not captured, those records fall outside the firm's preservation system and cannot be produced. This has been a repeated and costly enforcement theme.
The second gap is treating archiving as a one-time setup. Firms deploy new collaboration and AI tools without confirming that the content they generate is captured in an immutable, retrievable form, and only discover the gap when an examiner asks for records the system never collected.
- Off-channel business communications on personal or uncaptured apps
- New platforms like Teams and Slack rolled out without archiving in place
- Archives that retain content but are not genuinely immutable or WORM-equivalent
- Slow or incomplete production because records are not readily accessible
How Centience helps
Centience helps firms treat recordkeeping as a continuously monitored control rather than an assumption. It tracks which communication channels and tools are in use, whether each is mapped to an immutable retention system, and whether your retention and accessibility posture matches what the rules expect, keeping a standing evidence trail for exams.
The free Governance Score is the fastest way to see where you stand. It highlights unarchived channels, off-channel exposure, and retention gaps, so you can close them and keep your books and records exam-ready and continuously evidenced.
FAQ
Frequently Asked Questions
How long do broker-dealers have to keep records?+
It depends on the record type, but six years is the common benchmark, with the first two years kept readily accessible. FINRA Rule 4511 requires at least six years where no other retention period is specified.
What does WORM mean and is it required?+
WORM stands for write once, read many. Rule 17a-4 requires electronic records to be preserved in a non-rewriteable, non-erasable condition, and the rule also permits an equivalent audit-trail approach that reliably prevents alteration or deletion of records.
Do chat and collaboration tools count as business records?+
Yes. If business is conducted over Teams, Slack, text messages, or similar channels, those communications are business records and must be captured and preserved on the same terms as email. Failure to capture off-channel communications has been a major enforcement focus.
What is off-channel communication risk?+
It is the risk that employees conduct firm business on messaging platforms that are not captured by the firm's archiving system, leaving records that cannot be preserved or produced. Regulators have penalized firms significantly for these recordkeeping failures.
See where your firm stands — in minutes.
The free Governance Score gives you a 0–100 readiness score, a peer benchmark, and your priority gaps mapped to the rules that matter.
Get Your Free Governance ScoreOr call (877) 945-7177