United States: SEC Adopts Amendments To Electronic Recordkeeping Requirements For Broker-Dealers And Security-Based Swap Dealers

On October 12, 2022, the Securities and Exchange Commission (SEC or Commission) voted to adopt amendments to the electronic recordkeeping requirements for broker-dealers and security-based swap dealers contained in Rules 17a-4 and 18a-6, respectively. The adoption of these amendments is also intended to make SEC recordkeeping requirements more technology neutral than they currently are. The rules also aim to bring the recordkeeping requirements in line with industry practices regarding recordkeeping, which could reduce the need for firms to maintain separate recordkeeping systems for business purposes and regulatory purposes.

Among other things, the amendments allow broker-dealers to retain electronic records using an audit-trail methodology as an alternative to the current requirement to retain such records in a non-rewriteable, non-erasable format (also known as "write once, read many" (WORM)).¹ The amendments also establish a requirement for security-based swap dealers without a prudential regulator ("standalone security-based swap dealers") to comply with either the WORM or audit-trail requirements for electronic recordkeeping.² The amendments are intended to "modernize the Commission's recordkeeping requirements and to reduce recordkeeping duplication by affected entities."³

The amendments become effective 60 days after publication in the Federal Register. The compliance date for broker-dealers subject to Rule 17a-4 is six months after publication in the Federal Register. The compliance date for security-based swap dealers subject to Rule 18a-6 is 12 months after publication in the Federal Register.

Paragraph (f)(1) of revised Rule 17a-4 contains the new defined terms. Paragraph (f)(2) contains the requirements for an electronic recordkeeping system under the rule. Paragraph (f)(3) contains the requirements for a broker-dealer that uses an electronic recordkeeping system. Paragraph (i) describes the third-party undertakings to be filed with the Commission under the rule. Finally, paragraph (j) contains the requirement for a broker-dealer to promptly furnish copies of records to the Commission upon request.

Paragraph (e)(1) of revised Rule 18a-6 contains the new defined terms. Paragraph (e)(2) contains the requirements for an electronic recordkeeping system under the rule. Paragraph (e)(3) contains the requirements for a security-based swap dealer that uses an electronic recordkeeping system. Paragraph (f) describes the third-party undertakings to be filed with the Commission under the rule. Finally, paragraph (g) contains the requirement for a security-based swap dealer to promptly furnish copies of records to the Commission upon request.

Rule 17a-4 sets forth the record maintenance and preservation requirements for broker-dealers. Under the current rule, broker-dealers must preserve electronic records exclusively in a WORM format. Rule 18a-6 sets forth the record maintenance and preservation requirements for standalone security-based swap dealers and does not currently specify that a standalone security-based swap dealer must preserve electronic methods exclusively in a WORM format.

As amended, Rule 17a-4 will now include an audit-trail alternative to the WORM requirement for broker-dealers. Under the amended rule, a broker-dealer that uses an electronic recordkeeping system may preserve its electronic records either in a WORM format or in compliance with the audit-trail alternative. In order to comply with the audit-trail alternative, a broker-dealer will have to use an electronic recordkeeping system that maintains and preserves electronic records "in a manner that permits the recreation of an original record if it is modified or deleted."⁴ The rule will also require the audit trail to maintain records of the date and time of actions that create, modify or delete the record, as well as the identity of the person creating, modifying or deleting the record, if applicable. Firms will be permitted to use unique identifiers for individuals in the audit trail.

The audit-trail requirement notably applies only to final records that are required to be maintained pursuant to the rules, and not to drafts or iterations of records that would not otherwise be required to be maintained and preserved under Rules 17a-3 and 17a-4 or 18a-5 and 18a-6. For example, Rule 17a-3 requires a broker-dealer to make and keep current an itemized daily record of all purchases and sales of securities. The audit-trail requirement applies to this daily record, but does not apply to each iteration of information that may be updated throughout the day each time a new purchase, sale, receipt or delivery of a security occurs.

As amended, Rule 18a-6 will now require a standalone security-based swap dealer to maintain and preserve electronic records either in a WORM format or in compliance with the audit-trail alternative.

Whether using a WORM-compliant or audit trail-compliant electronic recordkeeping system, a broker-dealer or standalone security-based swap dealer must automatically verify the completeness and accuracy of its processes for storing and retaining records electronically.

The Commission notes in the adopting release that a broker-dealer or standalone security-based swap dealer may elect to use two separate recordkeeping systems for business purposes: one that complies with the audit-trail requirement and one that complies with the WORM requirement. This approach may make sense if the broker-dealer or standalone security-based swap dealer finds it appropriate to store certain records, such as emails, in a WORM-compliant format while also finding it appropriate to store other records, such as trade blotters, using the audit-trail requirement. Broker-dealers that are currently complying with the WORM requirement that wish to instead comply with the audit-trail requirement moving forward may also choose to retain legacy records on their existing WORM-compliant recordkeeping systems while employing the audit trail-compliant recordkeeping to preserve new records created after the new system is put in place.

Rule 17a-4 currently requires a broker-dealer to notify its designated examining authority (DEA) before employing an electronic recordkeeping system. The amended rule eliminates this requirement.

Rule 17a-4 currently requires a broker-dealer to engage a third party who has access to and the ability to download information from the broker-dealer's electronic storage media to any acceptable medium under the rule. The third party is required to execute and file with the broker-dealer's DEA written undertakings agreeing to promptly furnish the SEC and other securities regulators with the necessary information to download records kept on the electronic storage media to any medium acceptable under the rule. Under the amended rule, the undertakings have been modified to be more technology neutral. The amended rule also provides an alternative to engaging a third party to perform this function. Under the alternative, a broker-dealer may designate either a third party or an executive officer to execute the undertakings. Regardless of whether a broker-dealer switches to using a designated executive officer, switches to a new designated third party or continues to use the same designated third party it is currently using, filing this undertaking will be required in order to comply with the amended rules. Accordingly, even if a broker-dealer continues to use the designated third party that it is currently using, the broker-dealer will need to obtain an updated certification from that designated third party, as the final amendments modify the form of the undertakings.

If appointing an executive officer to execute the undertakings, the broker-dealer must ensure that the executive officer has access to and the ability to provide records maintained and preserved on the broker-dealer's electronic recordkeeping system. The executive officer may satisfy this condition either by having access directly or by having access through a specialist who reports, directly or indirectly, to that executive officer. The executive officer may appoint in writing up to three specialists to assist in fulfilling his obligations. The executive officer may also appoint up to two employees who are direct or indirect reports to fulfill his obligations if he is unable to, so long as those employees have the same ability as the executive officer to directly or indirectly access the records.

Rule 18a-6 does not currently contain an analogous requirement to Rule 17a-4 that requires a standalone security-based swap dealer to engage a third party who has access to and the ability to download information from the broker-dealer's electronic storage media to any acceptable medium under the rule and to have that party execute an undertaking with the Commission. As amended, the rule will contain both the third-party undertakings provision and the executive officer undertakings provision and will require the security-based swap dealer to comply with one of the provisions so that undertakings are filed with the Commission as described above.

Rules 17a-4 and 18a-6 both currently require a broker-dealer or standalone security-based swap dealer, respectively, to require a third party who prepares or maintains its regulatory records to file a written undertaking with the Commission agreeing to permit examination of the records by representatives or designees of the Commission and to promptly furnish to the Commission or its designee true, correct, complete and current hard copies of such records. The adopting release refers to the current undertaking as the "traditional undertaking." Both rules are being amended in order to account for the use of cloud service providers for electronic recordkeeping systems.

Under the amended rules, the third-party cloud service provider may provide an alternative undertaking, so long as certain conditions are met. Those conditions are (1) that the broker-dealer or standalone security-based swap dealer records are stored using an electronic recordkeeping system utilizing servers that are owned or operated by a third party and (2) that the broker-dealer or standalone security-based swap dealer has independent access to the records. These conditions may be met whether the third-party cloud service provider is an affiliate of the broker-dealer or security-based swap dealer or an independent entity. The rules define "independent access" as the ability of the broker-dealer or standalone security-based swap dealer to regularly access the records without the need of any intervention by the third-party cloud service provider, and through such access unilaterally take the actions that are contemplated by the third party in the traditional undertaking. If these conditions are met, the third-party cloud service provider may file the alternative undertaking with the Commission instead of the traditional undertaking. A third party may continue to rely on the traditional undertaking, assuming the third party continues to meet the conditions of that undertaking.

Based on the requirements in the undertakings, the Commission also confirms in the adopting release that any contractual provisions between a broker-dealer or standalone security-based swap dealer and a third-party cloud service provider that allow the latter to withhold, delete or discard records in the event of nonpayment by the broker-dealer or standalone security-based swap dealer are inconsistent with the Commission's recordkeeping rules.

Rules 17a-4 and 18a-6 both currently require a broker-dealer or standalone security-based dealer, respectively, to promptly furnish to the Commission legible, true, complete and current copies of the records required to be maintained and preserved under the rules and any other records subject to Commission examination. As amended, the rules will require the broker-dealer or standalone security-based swap dealer to furnish a record and its audit trail (if stored using the audit-trail alternative) in both a human readable and reasonably usable electronic format if requested by the Commission. The requirement to furnish the audit trail only applies to broker-dealers or standalone security-based swap dealers complying with the audit-trail alternative, not to those using WORM-compliant electronic recordkeeping systems

"Reasonably usable" here means in an electronic format that is compatible with commonly used systems for accessing and reading electronic records.⁵ A human readable format means a format that is common and compatible with commonly used systems for accessing and reading the types of electronic records used. While a broker-dealer or security-based swap dealer may not need to produce a record in both formats in every instance—for example, if an examiner is present in a firm's office, it may be easier to produce a hard copy record in a human readable format—the electronic recordkeeping system does need to be capable of producing records in both formats.

Both Rule 17a-4 and Rule 18a-6 will now require a broker-dealer or standalone security-based swap dealer, respectively, to either maintain a backup recordkeeping system or employ other redundancy capabilities. For example, a WORM-compliant system could create two copies of a record or a set of records on two different optical disks so that if one disk is corrupted, the second disk is still accessible. Similarly, an electronic recordkeeping system could include a second recordkeeping system that uses a different server so that if one server fails, the system could switch to the backup recordkeeping system on the second server in order to access the records. The Commission notes that geographic separation of the hardware components of the primary and secondary electronic recordkeeping systems may be an aspect of achieving the required redundancy. In this regard, the Commission stated, "However a firm meets the redundancy requirement, the backup electronic recordkeeping system must serve as a redundant set of records if the original electronic recordkeeping system is temporarily or permanently inaccessible because, for example, it is impacted by a natural disaster or a power outage."⁶

Finally, the amendments also designate a broker-dealer's examining authorities as Commission designees for the purposes of the provisions of Rule 17a-4 that refer to Commission designees. The amendments do not make a similar designation in Rule 18a-6 since standalone security-based swap dealers do not have self-regulatory organizations that serve as examining authorities.

Broker-dealers will have to decide whether they want to continue to store regulatory records in a WORM-compliant format, move to an audit trail-compliant format or employ both options for different types of records. Standalone security-based swap dealers, who previously did not have the same requirements as broker-dealers regarding WORM storage, will have to decide whether to store regulatory records in a WORM-compliant format, an audit trail-compliant format or a mix of both types of systems.

Both broker-dealers and security-based swap dealers will also have to make decisions regarding whether to utilize a designated third party to execute their undertakings or comply with the designated executive officer option. Additionally, both broker-dealers and security-based swap dealers will have to decide whether or not to use a third-party cloud service provider for their electronic recordkeeping systems, and if so, determine whether that service provider is eligible for the alternative undertaking. Regardless of the decisions made in those scenarios, firms will have to file undertakings with the Commission and ensure that their contractual arrangements with third-party service providers conform with the rule.

Finally, firms will have to ensure that their electronic recordkeeping systems, whether WORM-compliant or audit trail-compliant, comply with the new requirements imposed under the rule. This includes the requirement to automatically verify the completeness and accuracy of the recordkeeping system as well as the requirement for the recordkeeping system to have the ability to produce records in both a reasonably usable and human readable format upon request by the Commission or a designee.

Footnotes

1 Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants, Securities Exchange Act Rel. No. 96034 (Oct. 12, 2022), available at https://www.sec.gov/rules/final/2022/34-96034.pdf (Adopting Release).

2 Id.

3 Id. at 106.

4 Id. at 5.

5 Id. at 9.

6 Id. at 35.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.