On October 12, 2022, the SEC adopted amendments to the electronic recordkeeping, prompt production of records, and third-party recordkeeping service requirements that are applicable to broker-dealers. The broker-dealer compliance date for the new requirements is six months after the date of the publication of the adopting release in the Federal Register.
Some key highlights of the amendments to Rule 17a-4:
- Adds an audit-trail as an alternative to the existing WORM requirement for electronic recordkeeping systems.
- Under the audit-trail alternative, a broker-dealer will need to use an electronic recordkeeping system that maintains and preserves electronic records in a manner that permits the recreation of an original record if it is modified or deleted.
- Electronic regulatory records may be preserved using an electronic record keeping system that meets either the audit-trail or the WORM requirement.
- Adds an option for a designated executive officer (DEO) of the firm to make the required undertakings instead of a designated third party (D3P) when using an electronic recordkeeping system.
- DEO must be a member of the broker-dealer’s senior management.
- Subject to the organization’s reporting structure, DEO can designate in writing a limited number of other broker-dealer employees who have the knowledge, credentials, and information necessary to access and provide the records.
- Adds an alternative undertaking for third parties who hold electronic regulatory records for the broker-dealer (e.g., cloud service provider) in lieu of the traditional undertaking under 17a-4(i).
- Records must be preserved by electronic recordkeeping system as defined in Rule 17a-4(f), utilizing servers or other storage devices that are owned or operated by a third-party (including an affiliate) and the broker-dealer must have independent access to the records.
- Adds a requirement for electronic recordkeeping systems to be able to produce copies of a record and its audit trial (if applicable) in a reasonably useable electronic format.
- Such formats would be common and compatible with commonly used systems for accessing and reading electronic records.
- Eliminates 90-Day DEA notice requirement before employing an electronic recordkeeping system.
- Designates a broker-dealer’s DEA as a SEC designee for the purposes of the various provisions of the Rule that refer to “representatives and designees of the Commission.”
Important things for broker-dealers to note moving forward:
- Existing WORM-compliant electronic recordkeeping system can continue to be used, but firms will be subject to the requirement to be able to produce a record in both a human readable format and a reasonably useable electronic format.
- Existing designated third parties can continue to be used, however, updated undertakings will need to be filed with DEA.
- If cloud storage providers are being used for electronic regulatory records and a traditional undertaking has not already been filed with DEA, firms must either file a traditional or alternative undertaking.
CRC believes that the best approach to regulatory compliance is a proactive one. Staying ahead of the curve by taking note of this rulemaking activity can help ensure that a firm is prepared for a regulatory exam. Rather than scrambling to rectify issues or meet deadlines, a thorough, active compliance program that considers and incorporates regulatory developments is in a better position to satisfy regulators and preserve operations so they can best serve their clients.
For more information, please contact:
Mitch Avnet
p. (646) 346-2468
mavnet@compliance-risk.com
David Amster
p. (917) 568-6470
damster@compliance-risk.com
