SEC Rule 17a-4

Two routes, not one#

The rule is commonly described as requiring WORM media. It does not. It permits either a non-rewriteable, non-erasable medium, or an audit-trail arrangement that evidences records have not been altered or erased. The second route is what makes compliant cloud storage possible, and it is why an immutable audit trail matters more in this sector than in any other.

Easily accessible#

Records must be kept for three or six years depending on type, with the first two years in an easily accessible place. That creates two retention tiers rather than one, and a system that treats retention as a single period cannot express the requirement.

Prompt production#

The rule expects records to be produced promptly on request. That is a retrieval requirement, and it is where organisations with documents spread across network shares fail an examination regardless of how well they store things.

The related rules#

FINRA Rule 4511 sets a six-year default for books and records where no other period applies, which makes an "unclassified records" report an operational necessity: a document type with no retention rule attached defaults to a gap.

Attestation#

Examiners frequently expect a third-party attestation that the storage arrangement meets the rule. That is a question to ask a vendor early, because obtaining one late in a procurement is slow.