The Modernization of SEC Rule 17a-4

Listen to article highlights.

What changed and why

Other changes

The market impact

As the SEC noted, the rule has evolved from "electronic storage media" to defining the obligation as maintaining an "electronic recordkeeping system," that encompasses systems and controls to preserve records in a digital format. Despite audit trail being another technological approach that will be made obsolete by the next generation of technology, the revised rule emphasizes the responsibility for firms to have the expertise – and to work with appropriate third parties – to fulfill the requirements. While the impact to the industry is unclear, here are some of the considerations that firms should keep in mind in evaluating the new rule. What is the benefit to the business? While the update does provide additional flexibility, the determination of better-faster-cheaper is a fair question for firms to assess. For very small firms with very basic requirements (e.g., approved use of email only, infrequent access to their compliance archive), this could allow them to 'check the box' at a lower cost. The updated rule will likely cause an evaluation of potential cost savings against the feasibility of modifying a core business communications platform to meet the audit-trail requirements and the cost of moving existing compliance records from a worm storage system. For large firms, better is the operative phase to use in comparing alternatives. Their use of electronic recordkeeping systems typically supports multiple purposes, serving as the system of record to provide:

• Supervisory oversight
• The ‘source of truth’ for e-discovery and investigation
• Power conduct surveillance processes

How is the rule update impacted by today's collaborative platforms? The original SEC 17a-4 was written when firms were moving from paper to email. Now, they are doing business on a variety of collaborative platforms that include persistent chats, voice, video, bots and collaborative authoring. What’s key for firms to consider is the complexity of attempting to account for all modifications, interim iterations, or deletions to an individual record within a single collaborative tool – much less across multiple heterogenous products across an entire organization. The comparison in the release to trade blotters to account for all activities that have impacted a record can significantly understate the time and effort to meet the requirement. For example, not only must records be complete and accurate, they also must be transferred to regulators in both human- and machine-readable formats that allow regulators to carry out their oversight responsibilities. In short, if your business runs on Microsoft Teams, Slack, and Zoom, determining the most effective approach to preserving and producing a complete record of today’s communications should not be a decision taken without careful analysis. How will this impact cloud providers? As more firms leverage public cloud infrastructure, the rule update can potentially impact their choice of service providers as the requirement indicates that the third party "will not impede or prevent the examination, access, download, or transfer of records by a regulator." The added language here can also be noteworthy if firms are currently backing up or have redundant storage that doesn't provide equivalent capabilities, such as operation only in an active/passive configuration. The ability to provide self-service on highly available infrastructure is now the standard that firms will need from their cloud service providers. How does this reconcile with recent SEC enforcement actions surrounding off-channel communications? This may be the most important – and ironic – aspect of the SEC 17a-4 update. The SEC has stated unequivocally in recent enforcement actions that firms must move toward a posture that "recordkeeping is sacrosanct," and simply checking-the-box will be harder to demonstrate the supervisory oversight and culture of compliance that regulators expect.

The final thought