SEC Rule 17a-4 Amended: Taking the WORM Requirement Out of our Misery

The Securities Exchange Act of 1934 established record maintenance and preservation requirements applicable to all broker-dealers via Rule 17a-4. In 1997, the SEC adopted a rule that required all “books and records” (records) to be preserved exclusively in a non-rewriteable, non-erasable format to ensure that electronic records could be accurately reproduced for later reference by maintaining the records in an unalterable or immutable form.

Initially, the Write Once Read many (WORM) rule was written to specify only optical storage technology to meet the immutability requirement. But, the SEC opted not to require the type of storage technology to be used and instead created less specific standards.

At the time, the only possibility of storing large quantities of SEC-regulated data was on backup tapes or spinning disk. (This is not to say that some smaller companies did not use optical media, but it was not a practical solution for more significant amounts of data.)

Backup tapes were not a real option due to the SEC’s requirement that all regulated data be (relativity) quickly accessible, and backup tapes were not known as a media allowing for specific data to be quickly retrievable. On the other hand, data on disk arrays (spinning disk) was designed to ensure that data could be deletable and re-writable. Because of this, WORM optical media was seen as the only compliant solution from 1997 to 2003.

However, in 2003, storage manufacturers developed a way to make special disk arrays systematically immutable using policies and MD5 hashes, thereby complying with the SEC Rule 17a-4 WORM requirement. However, these compliant disk arrays were costly.

These WORM-capable on-premises disk arrays and, later, WORM cloud tiers became the solutions of choice for organizations in the Financial Services industry that required immutable storage.

WORM is buried

On October 12, 2022, SEC Commissioner Hester M. Peirce published a statement titled: Burying the Technologically Primitive WORM: Open Meeting on Broker-Dealer Electronic Recordkeeping Requirements announcing that the SEC was considering the adoption of a rule that would allow broker-dealers to retire the long relied on WORM technology that the current SEC Rule 17a-4 requires.

The current Rule 17a-4 requires a broker-dealer to maintain and preserve specific electronic records exclusively in a non-rewriteable, non-erasable format.

On November 18, 2021, the SEC proposed an amendment to Rule 17a-4(f). The proposed amendment floated the possibility of offering an alternative to the WORM storage requirement.

Eleven months later, on October 12, 2022, the commission adopted the proposed amendment, a huge surprise for many of us who have been involved with email archiving for the financial services industry over the last several decades. The new rule will offer an alternative to storing and managing books and records on WORM or immutable media.

Given the technological changes over the last two decades, this amended rule is designed to modernize recordkeeping requirements and account for emerging electronic information management technologies.

The new amendment to Rule 17a-4 adds an alternative to the WORM storage requirement - saving regulated records with an audit-trail capability.

Thus, under the amendment to Rule 17a-4, a broker-dealer utilizing an archive or electronic records management system will need to ensure that the system meets either the audit-trail requirement or the WORM requirement.

If using the audit-trail alternative, a broker-dealer will instead need to use a records management system that preserves regulated records in such a way that permits (guarantees) the recreation of an original regulated record if it is corrupted, modified, or deleted.

What this means for brokers/traders and WORM suppliers in the short term

WORM storage capabilities, both on-premises and in the cloud, are long-established and very reliable. The WORM storage tier in the cloud is comparable to standard storage pricing. In fact, the Azure Cloud does not charge a premium for WORM blob storage.

This SEC regulatory change to immutability will not affect many in the financial services industry in the short term. The fact is most organizations already have WORM systems they currently use and rely on. Many in the industry see no operational or cost reason to change their current SEC Rule 17a-4 solutions. However, this rule change will be utilized by new organizations in the industry in the future.

Several experts in the Financial Services industry have told us that they will wait and see how this update to SEC Rule 17a-4 storage requirements will affect the industry in the long run.