Compliant archiving is the retention of business-related electronic communications — email, text, and chat — in a preserved, tamper-evident, and readily retrievable form. For broker-dealers it is required chiefly by SEC Rules 17a-3 and 17a-4 and FINRA Rule 4511; investment advisers have a parallel duty under Advisers Act Rule 204-2. Records must be captured across channels, kept for set periods, and producible to regulators.
What compliant archiving requires
Financial firms must keep the records of their business — and communications are records. The obligation has four practical parts: capture business communications across every permitted channel; preserve them so they cannot be altered or destroyed during the retention period; retain them for the required number of years; and make them readily retrievable and producible to regulators on request. On top of that, firms must be able to supervise those communications under FINRA Rule 3110(b)(4).
The governing rules
| Rule | What it does | Applies to |
|---|---|---|
| SEC Rule 17a-3 | Specifies the records a broker-dealer must create. | Broker-dealers |
| SEC Rule 17a-4 | Specifies how long records must be preserved and in what form, including electronic storage conditions. | Broker-dealers |
| FINRA Rule 4511 | Requires members to make and preserve books and records per FINRA and Exchange Act rules; sets a 6-year default period. | FINRA member firms |
| FINRA Rule 3110(b)(4) | Requires review (supervision) of electronic correspondence and internal communications. | Broker-dealers |
| Advisers Act Rule 204-2 | The parallel books-and-records rule for investment advisers, including advertisements and communications. | Registered investment advisers |
Retention periods
Retention periods vary by record type. Common benchmarks under SEC Rule 17a-4 and FINRA Rule 4511:
- Business communications (originals received, copies sent): at least 3 years, with the first 2 years in an easily accessible place.
- Many core broker-dealer records (e.g., blotters, ledgers): at least 6 years.
- FINRA default: records with no otherwise-specified period must be kept at least 6 years under Rule 4511(b).
- Certain records (such as some account and organizational documents) must be kept for the life of the firm or account plus a period after closing.
WORM vs. the audit-trail alternative
For decades, SEC Rule 17a-4(f) required firms storing records electronically to use WORM — write once, read many — a format that keeps records non-rewriteable and non-erasable so they cannot be altered during the retention period.
In 2022 the SEC amended Rule 17a-4 to modernize this requirement. Firms may now satisfy the rule using either:
- an electronic recordkeeping system that preserves records in a non-rewriteable, non-erasable (WORM) format; or
- an electronic recordkeeping system that maintains a complete, time-stamped audit trail of all changes to, and deletions of, the records.
The amended rule also carries conditions common to electronic storage: the ability to readily download and transfer records, and either a designated third party with independent access to the records (able to provide them to regulators) or a permitted senior-officer alternative, together with required undertakings.
Off-channel communications risk
Off-channel communications are business messages sent through unapproved or unmonitored channels — personal texts, WhatsApp, Signal, or personal email — that the firm cannot capture. Because the recordkeeping rules are channel-neutral, a business message on a personal app is still a record the firm is required to preserve.
Since 2021 the SEC and CFTC have run a sustained enforcement campaign on this exact gap, resulting in billions of dollars in penalties across dozens of firms for failing to maintain and preserve business communications. The practical takeaway: either capture a channel or credibly prohibit it — a written policy alone, without enforcement or capture, is not a defense.
Archiving compliance checklist
- Every permitted business channel (email, text, chat) is captured into the archive.
- Records are preserved in WORM format or with a complete time-stamped audit trail.
- Retention periods meet or exceed the applicable rule (3-year comms; 6-year default).
- The first two years of communications are easily accessible and quickly retrievable.
- The archive is indexed and searchable, and records are producible to regulators.
- A designated third party (or permitted alternative) can access records independently.
- Supervisory review under Rule 3110(b)(4) runs against the archive and is documented.
- Off-channel use is either captured or prohibited and actively enforced.
- Investment advisers meet the parallel Rule 204-2 requirements, including advertisements.
Frequently asked questions
What is compliant communications archiving?
Compliant archiving is the retention of business-related electronic communications — email, text messages, and chat — in a preserved, tamper-evident, and readily retrievable form. For broker-dealers it is required primarily by SEC Rules 17a-3 and 17a-4 and FINRA Rule 4511; investment advisers have a parallel obligation under Advisers Act Rule 204-2.
How long must firms retain communications?
Under SEC Rule 17a-4, originals of communications received and copies of communications sent relating to the firm's business must be preserved for at least three years, with the first two years in an easily accessible place. Many other broker-dealer records must be kept for six years. FINRA Rule 4511 sets a default retention period of at least six years for records that do not otherwise have a specified period.
What is WORM storage?
WORM stands for write once, read many — a storage format that preserves records in a non-rewriteable, non-erasable state so they cannot be altered or deleted during the retention period. For decades SEC Rule 17a-4(f) required electronic records to be stored in WORM format. In 2022 the SEC amended the rule to add an alternative: an electronic recordkeeping system that maintains a complete, time-stamped audit trail of all changes.
Do text messages have to be archived?
Yes, if they relate to the firm's business. The recordkeeping rules are channel-neutral: a business communication must be captured and retained regardless of whether it was sent by email, SMS, or a chat or messaging app. Firms that permit business texting must have a way to capture and preserve those messages, or must prohibit the channel and enforce that prohibition.
What are off-channel communications?
Off-channel communications are business messages sent through unapproved or unmonitored channels — such as personal texts, WhatsApp, or personal email — that the firm cannot capture. Failing to preserve them violates the recordkeeping rules. Since 2021 the SEC and CFTC have brought a series of enforcement actions resulting in billions of dollars in penalties for recordkeeping failures tied to off-channel communications.
What must a compliant archiving system be able to do?
A compliant system must capture business communications across permitted channels, preserve them in a non-rewriteable format or with a complete audit trail, retain them for the required period, index them so they are readily retrievable and producible to regulators, and support the supervisory review required by FINRA Rule 3110(b)(4). Firms using electronic storage must also meet the rule's access and third-party undertaking conditions.
How does archiving relate to supervision?
Archiving and supervision are two sides of the same obligation. FINRA Rule 3110(b)(4) requires firms to review electronic correspondence for compliance issues; the archive is what makes that review — and the evidence that it happened — possible. A system that captures communications but cannot support or document review leaves a supervision gap.
Primary sources
- SEC Rule 17a-4 (Records to be preserved by certain exchange members, brokers and dealers) via eCFR: 17 CFR 240.17a-4
- SEC Rule 17a-3 (Records to be made) via eCFR: 17 CFR 240.17a-3
- SEC final rule, "Electronic Recordkeeping Requirements for Broker-Dealers…" (2022 audit-trail amendment): sec.gov/rules/final/2022/34-96034.pdf
- FINRA Rule 4511 (General Requirements): finra.org/rules-guidance/rulebooks/finra-rules/4511
Capture everything. Retrieve it in seconds.
Hadrius captures email, text, and chat, preserves them to the recordkeeping standard, and connects the archive to the supervision reviews the rules require.