The Securities and Exchange Commission on October 12, 2022, adopted amendments to the electronic recordkeeping requirements for broker-dealers, security-based swap dealers (SBSDs), and major security-based swap participants (MSBSPs) (Amendments).1 Coming 25 years after the SEC originally adopted its “write once, read many” (WORM) requirement for the electronic storage of records pursuant to Rule 17a 4 under the Securities Exchange Act of 1934 (Rule), the Amendments are a long-overdue step towards modernizing broker-dealers’ recordkeeping requirements. The Amendments also revise corollary regulatory provisions applicable to SBSDs and MSBSPs that are not also registered broker-dealers.
Certain Compliance Challenges Prompting Amendments
The current electronic recordkeeping requirements for broker-dealers, codified under paragraph (f) of the Rule, have been in place since 1997. Prior to the Amendments, the Rule permitted records to be maintained and preserved electronically if they could immediately be produced or reproduced on “micrographic media” or “by other means of ‘electronic storage media.’”2 When adopted, these terms were intended to be technology neutral so they could adapt with technological advances, but they became obsolete quickly.
The Rule currently requires that records be maintained electronically in WORM format, which was meant to prevent the alteration of records. Due to the stringent technical requirements for WORM compliance, many broker-dealers have needed to implement a specific WORM-compliant system that “prevents the overwriting, erasing or otherwise altering of a record … through the use of integrated hardware and software codes.” These WORM systems are separate from the daily electronic recordkeeping systems used by broker-dealers for trading, risk management, and other business purposes, since such systems are dynamic and updated constantly (i.e., with each new transaction or position), and thus generally are incompatible with WORM requirements.
In addition to WORM, the Rule contains two undertaking requirements that create compliance challenges. First, in the case of a broker-dealer using electronic record storage, paragraph (f) of the Rule requires that a third party that has access to, and the ability to download from, the broker-dealer’s electronic storage media, must file an undertaking with the SEC that the third party will promptly furnish the downloaded information to the SEC, self-regulatory organizations of which the broker-dealer is a member, and any state regulator having jurisdiction over the broker-dealer. Second, paragraph (i) of the Rule requires a broker-dealer to obtain an undertaking from a third-party provider of electronic recordkeeping systems stating that the service provider will permit the SEC or the firm’s designated examining authority to examine the broker-dealer’s books and records and will promptly furnish true and correct copies of such records to the examining authority. This second undertaking has proven particularly difficult to obtain because, in many cases, especially when cloud storage is used, the broker-dealer itself, and not a service provider, controls access to its records.
Key Revisions to Rule 17a-4
Electronic Storage Media
Throughout the Rule, the SEC replaced the term “electronic storage media” with “electronic recordkeeping system.” An “electronic recordkeeping system” is defined as “a system that preserves the records in a digital format in a manner that permits the records to be viewed and downloaded.” The new terminology reflects the fact that electronic storage methods no longer are predominantly hardware-based. A change in terminology to “electronic recordkeeping system” also is made in Exchange Act Rule 18a-6 for SBSDs and MSBSPs not subject to prudential regulation (non-banks).3
Designated Examining Authority Notification
Consistent with the Rule as initially proposed (Proposal), the Amendments eliminate the current Rule’s requirement that a broker-dealer notify its designated examining authority before employing an electronic recordkeeping system. Under both the current Rule and the Amendments, SBSDs and MSBSPs are not required to notify a designated examining authority.
WORM Format
In the Proposal, the SEC noted that for business purposes, many broker-dealers use electronic recordkeeping systems that are dynamic and constantly updated, rather than a WORM-compliant system. The SEC proposed to revise the requirement in paragraph (f) of the Rule to require that a broker-dealer using an electronic recordkeeping system must preserve its records in a manner “that permits original records to be re-created if altered, over-written, or erased, or that prevents original records from being altered, over-written or erased.” The SEC adopted the Amendments substantially as proposed and the changes will allow broker-dealers to preserve records using an electronic recordkeeping system that meets either WORM requirements or an audit trail alternative. In order to meet the audit trail requirements, a broker-dealer’s electronic recordkeeping system will need to preserve and maintain records in accordance with applicable retention periods in a manner that “maintains a complete time-stamped audit trail that includes: all modifications to and deletions of a record or any part thereof; the date and time of operator entries and actions that create, modify, or delete the record; the individual(s) creating, modifying, or deleting the record; and any other information needed to maintain an audit trail of each distinct record in a way that maintains security, signatures, and data to ensure the authenticity and reliability of the record and will permit re-creation of the original record and interim iterations of the record.” Under the current Rule, SBSDs and MSBSPs are not required to use WORM-compliant systems, but under the Amendments, non-bank SBSDs and MSBSPs must use either WORM or the audit trail alternative.
Third-Party Undertaking
Rule 17a-4(f) was amended to provide an alternative to the third-party undertaking to permit either a “designated third party”4 or a “designated executive officer”5 to perform the function if they have access to and the ability to provide records either directly or through a “specialist”6 who reports directly or indirectly to the executive officer. The designated executive officer may appoint in writing up to two officers and three specialists to take the steps necessary to fulfill the designated executive officers’ responsibilities and to assist them in fulfilling their obligations set forth in the undertakings. Though the corollary provisions of Rule 18a-6 do not currently require a third-party undertaking, the Amendments have changed the Rule to now require compliance with the undertaking aspect of the rule for SBSDs and MSBSPs using an electronic recordkeeping system.
Alternative Undertaking for Electronic Record Storage
Due to the increase in the usage of cloud service providers for the maintenance of electronic recordkeeping systems, the Amendments provide flexibility to the undertaking requirement for broker-dealers that utilize servers or other storage devices that are owned or operated by a third party to remain in compliance. This revision was not part of the Proposal. The Amendments allow third parties (e.g., cloud service providers), which are unable to provide the undertaking required in the Rule, to use an alternative undertaking.7 The alternative undertaking is subject to certain conditions, primarily that the broker-dealer can access the records without the need for any intervention of the third party. This means that the alternative undertaking cannot be used if records are maintained by a third-party service bureau in paper format or if the third party is required to take an intervening step to make the records available (e.g., decrypting or transferring copies of records). Under the Amendments, the alternative undertaking also is permitted for SBSDs and MSBSPs who use third-party servers or storage devices.
Reasonably Useable Format
The SEC also revised paragraph (j) to require that any records of a broker-dealer that are required to be preserved under Rule 17a-4 be furnished in a “reasonably usable electronic format” when requested by the SEC. “Reasonably usable electronic format” is defined as a “format that is compatible with commonly used systems for accessing and reading electronic records.” The same change applies to SBSDs and MSBSPs.
Conclusion
The Amendments are a long-awaited step forward in modernizing broker-dealers’ recordkeeping obligations to reflect technological advances and address some of the frictions between a Rule that has been overdue for updating and ever evolving technology. The Amendments will become effective January 3, 2023 with May 3, 2023 as a compliance date for broker-dealers, and November 3, 2023 for SBSDs and MSBSPs.
*The authors would like to thank Olivia Sedita for her contributions to the OnPoint.
Footnotes:
1) Federal Register: Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants (Oct. 12, 2022), 87 Fed. Reg. 66412.
2) “Micrographic media” refers to “microfilm or microfiche, or any similar medium” and “electronic storage media” refers to a “digital storage medium or system.”
3) Note that Rule 18a-6(e) uses the term “electronic storage system” rather than “electronic storage media.”
4) “Designated third party” is defined by the Rule as “a person that is not affiliated with the security-based swap dealer or major security-based swap participant who has access to and the ability to provide records maintained and preserved on the electronic recordkeeping system.”
5) “Designated executive officer” is defined by the Rule as “a member of senior management of the security-based swap dealer or major security-based swap participant who has access to and the ability to provide records maintained and preserved on the electronic recordkeeping system either directly or through a designated specialist who reports directly or indirectly to the designated executive officer.”
6) Specialist is defined by the Rule as “an employee of the security-based swap dealer or major security-based swap participant who has access to, and the ability to provide records maintained and preserved on, the electronic recordkeeping system.”
7) Under the current Rule, a third party that prepares or maintains regulatory records of a broker-dealer must file an undertaking to address access to such records with the SEC signed by a “duly authorized person."
