Skip to main content

SEC 17a-3/4

The Securities and Exchange Commission (SEC) Exchange Act Rules 17a-3 and 17a-4 govern the recordkeeping and electronic storage obligations for broker-dealers registered with the SEC. Rule 17a-3 requires the creation and maintenance of detailed records for the broker-dealer's business; Rule 17a-4 specifies the form and retention period (typically 3-6 years, with some records retained for the life of the enterprise). Falcon Veritas Intelligence (FVI) provides WORM-compliant audit trail storage and a complete recordkeeping pipeline for SEC-registered broker-dealers.

Scope and applicability​

SEC 17a-3/4 applies to:

  • All SEC-registered broker-dealers (Section 15)
  • OTC derivatives dealers (when registered)
  • Transfer agents registered with the SEC
  • Non-bank custodians of registered investment companies

FVI's recordkeeping module captures:

  • Order tickets and execution records
  • Trade blotters and confirmations
  • Customer account records
  • Customer communications (where required)
  • Audit trail of every access to customer data (Rule 17a-4(f)(3))
  • Anti-money laundering records (where applicable)

The retention period varies by record type:

  • Order tickets: 3 years (first 2 years readily accessible)
  • Trade blotters: 3 years (first 2 years readily accessible)
  • Customer account records: 6 years after account closure
  • Audit trail: 6 years
  • Some records (e.g., commodities records): life of the enterprise

Storage requirements​

Rule 17a-4(f) has strict electronic storage requirements:

  1. WORM compliance — records must be stored in a non-rewritable, non-erasable format. FVI uses Cloudflare R2 with Object Lock enabled (Compliance mode) for the master copy and AWS S3 Glacier with Vault Lock for the disaster recovery copy.

  2. Indexed and searchable — records must be indexed for easy retrieval. FVI's audit_trail table maintains a full-text index and supports sub-second retrieval by date range, tenant member, action type, or record ID.

  3. Audit-able — every retrieval, copy, or modification attempt must be logged. FVI's security_events table captures every read against the audit trail with user, timestamp, IP, and rationale.

  4. Duplicate storage — records must be stored in two geographically separated locations. FVI's Cloudflare R2 deployment is multi-region by default; the disaster recovery copy lives in a separate Cloudflare account in a different region.

  5. Notification of legal hold — records under legal hold must be preserved and flagged. FVI's legal hold module locks records under retention-pending status and surfaces them in the audit console.

How FVI supports SEC 17a-3/4​

FVI's audit trail module is purpose-built for SEC 17a-4 compliance. Every state change on a regulated record (order, trade, account) is captured in the audit_trail table with the actor, timestamp, before/after state, IP address, and rationale. Records are mirrored to R2 with Object Lock at ingestion and to S3 Glacier with Vault Lock on the next daily export.

Step-by-step: enabling SEC 17a-3/4 recordkeeping​

  1. Register the tenant. In FVI, navigate to Settings → Compliance → SEC 17a and enter the CRD number, the relevant MPIDs, and the registered broker-dealer classification. FVI validates the CRD against the SEC EDGAR system.

  2. Configure retention. Set retention periods per record type. FVI's default is the most conservative SEC 17a-4 period for each category (3-6 years or life of enterprise).

  3. Enable WORM storage. FVI enables R2 Object Lock (Compliance mode) for the master copy and S3 Glacier Vault Lock for the DR copy. Both buckets are non-rewritable, non-erasable.

  4. Configure legal hold. Enable the legal hold module and assign the regulatory counsel as the legal hold owner. FVI surfaces legal hold records in the audit console.

  5. Run a 90-day validation. FVI's compliance console runs a 90-day dry-run that exercises every retention and retrieval flow. Review the validation report and iterate.

  6. Enable production. Flip the tenant to live. FVI begins capturing every state change with full audit trail.

  7. Quarterly attestation. FVI generates a quarterly attestation report that the broker-dealer submits to the SEC examiner (when requested).

Code samples​

curl​

curl -X POST https://api.falconveritas.com/v1/compliance/sec17a/audit-trail \
  -H "Authorization: Bearer $FVI_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "tenantId": "'$FVI_TENANT_ID'",
    "crd": "12345",
    "fromDate": "2026-08-01",
    "toDate": "2026-08-22",
    "idempotencyKey": "sec17a-fvi-$RANDOM"
  }'

TypeScript​

import { FVI } from '@falconveritas/sdk';

const fvi = new FVI({
  baseUrl: 'https://api.falconveritas.com',
  bearer: process.env.FVI_JWT!,
  tenantId: process.env.FVI_TENANT_ID!,
});

const trail = await fvi.compliance.sec17a.exportAuditTrail({
  crd: '12345',
  fromDate: '2026-08-01',
  toDate: '2026-08-22',
});

console.log('Audit trail URL:', trail.url);

Python​

from falconveritas import FVI

client = FVI(
  bearer=os.environ["FVI_JWT"],
  tenant_id=os.environ["FVI_TENANT_ID"],
)

trail = client.compliance.sec17a.export_audit_trail(
  crd="12345",
  from_date="2026-08-01",
  to_date="2026-08-22",
)
print("Audit trail URL:", trail.url)

Troubleshooting​

Last updated: 2026-08-22 · Page owner: Documentation · Source: src/lib/compliance/sec17a/.