SEC and FINRA Communications Recordkeeping: What Technology Does Your Firm Need?

Over the last five years, US regulators have been hot on broker-dealer communications preservation. Beginning in 2021, the SEC pursued roughly three years of sweeping enforcement action regarding regulated communication violations. Passing the baton to FINRA for further scrutiny in recordkeeping and supervision failures in 2025, the joint focus has resulted in multi-million-dollar penalties for firms across the industry.

Compliance depends, partly, on whether firms can accurately capture, analyse, preserve and retrieve communications messages across all of the channels. 

For CCOs and compliance teams, the devil is in the details: building sound procedures and partnering with technology providers that can meet the practical requirements. Most teams already know the recordkeeping compliance obligations, the more difficult challenge is in evaluating the tech providers and operationalizing the systems.

Key takeaways

• Technology requirements require mapping back to applicable regulatory obligations
• Relevant business communications need reliable capture across approved channels
• Records need appropriate preservation, retention, metadata and auditability
• Search, retrieval and regulatory production are fundamental capabilities
• Recordkeeping and communications surveillance perform different functions

What Do SEC and FINRA Require Firms to Record?

Unlike in other jurisdictions, rules in the US are intentionally fragmented between different regulators, which means that compliance teams must pay heed to separate frameworks.

Fortunately, the overarching principles relating to various communications recordkeeping remain similar: they exist to enforce transparency and maintain accountability when firms communicate with their internal staff or the public.

But the exact requirements vary. For example, the SEC’s 17a-4 sets a minimum retention period and accuracy preservation requirements for electronic communications, alongside procedures for producing them on request.

FINRA Rule 2210 focuses more on the fairness of communications, requiring an appropriately qualified person to review and file communications before their use, but also includes minimum retention periods for recordkeeping. 

And FINRA Rule 4511 sets preservation requirements for the books and records framework more generally, applying a default retention period of six years.

For firms, the important part is about ensuring your technology is able to meet the secure, immutable record requirements of both regulators.

What Should Communications Recordkeeping Technology Be Able to Do?

When evaluating recordkeeping technology, most compliance teams look for platform or software capabilities that were built with the regulatory requirements in mind. This enables GRC professionals to set up automated comms capturing and e-Discovery channels, rather than constantly going back and forth to immutably store and manually retrieve the data when regulatory examinations pop up.

We’ve created a ten-step checklist to use when evaluating communications recordkeeping technology.

Does the solution…  

1. Automatically capture required communications?

Automatic records capture at source is arguably the most important capability. But the mechanisms used across the market differ significantly in both source channel and reliability, so compliance teams must perform their own due diligence to ensure suitability.

For example, API-based capturing can hit rate limits, and containerized in-app capture may depend on staff action, meaning that adoption rates can significantly impact reliability. 

2. Cover relevant communication channels?

Consider all of the approved communication channels that might find a place in your channel inventory. You’ll need to ensure that the technology you choose works across each of those channels.

Considering banned (shadow) channels is also important. For example, while Whatsapp may not be approved for external client communications, it may still be actively used. Where a specific channel is unsupported for capturing, teams will have to consider whether and how they prohibit usage, or perhaps orchestrate a workaround instead.

3. Preserve records and associated metadata?

A regulatory exam may require compliance teams to produce information like:

• The conversation participants
• Timestamps, device and, channel
• Thread or parent relationships
• Edit and delete history
• Geolocation
• Links or attachments

When evaluating the market, it can be useful to check that conversations are shown with this context, rather than as isolated messages, as it’s ultimately what the regulators care about.

4. Support applicable immutable recordkeeping requirements?

WORM compliance, or an approved electronic audit alternative, is key for immutability. Standing for write once, read many, it prevents records from being deleted or overwritten, and allows access to anybody with the approved credentials.

For legal teams, it will be important to evaluate how legal holds interact with immutable retention, and whether you can ever shorten a lock set in error. Independent assessors exist to verify technology providers under SEC and FINRA requirements.

5. Apply retention policies?

While the first thought around retention policies might be the length of time, GRC professionals must also consider whether they can set retention based on record type, channel, user type, and jurisdiction, for example.

While single jurisdiction firms may benefit from simple, auditable defaults, those working across multiple locations need region-aware policies and controls.

6. Search and retrieve records efficiently?

Small firms will typically only require the ability to reliably retrieve records for internal reviews and irregular exams, but larger organizations may need to prioritize the scale and speed in their eDiscovery.

With enterprise-grade solutions like Global Relay, it’s possible to retrieve these in seconds, keeping your organization in control of sensitive matters.

7. Maintain appropriate auditability and record integrity?

SEC and FINRA compliance requires audit logging, with visibility over who has accessed which records, and what actions they’ve taken. Vendors should be able to prove capture integrity, including that nothing was, or could be accessed on their back end.

This area is where vendor risks are brought more into focus. When picking a vendor, can you rely on vendor attestations alone, or do you require a full third-party risk assessment?

8. Support supervision workflows where required?

The main consideration in this area will be comparing the analysis to alert to detection approaches between providers. For example, are alerts presented with all contextual, enriched meta-data to help reviewers make an informed decision? The ability to set access controls based on jurisdiction, role seniority and automate supervision may also be important to teams with more complex firm structures.

9. Produce records in response to regulatory requests?

Speed, format and completeness are three of the most important factors to evaluate for this capability. Under 17a-4, firms must have a Designated Executive Officer (DEO) or a third-party undertaking so regulators can get access. Check that the vendor will sign and honor it, and whether a read-only regulator role is supported.

For firms that are frequently examined, a more mature tooling suite, with a dedicated eDiscovery platform, is likely to be the most suitable option.

10. Adapt as communication channels evolve?

Finally, communications recordkeeping firms may take on some of the regulatory burden themselves, especially in automatically updating their capabilities as regulations change.

Alongside verifying third party dependence and tooling architecture, it can be useful to evaluate how quickly the vendor has added new channels in the past. For example, how quickly did they build the ability to capture AI assistant communications? This should provide a useful indication around their future roadmap compared with your own.  

Which Communication Channels Should Firms Consider?

Not every channel must be captured, obligations depend on business usage and the applicable rules for your organization. The question is whether the communications on the channel fall into your requirements.

Importantly, all of the below channels can be included in the scope of regulatory provision, regardless of device ownership or whether they are approved as communication channels, as long as they contain business-related communications.

Compare the various channels in the table below:

Channel	Examples	Practical considerations
Email	Corporate email addresses, shared group emails and personal email accounts used to send business communications	A personal email address used for business communications presents a common gap in oversight. Moreover, capturing should record CC and BCC recipients.
Voice calls	Phone calls, WhatsApp calls, desk phones,	Where calls are not recorded, they still require memoranda where applicable.
SMS	iMessage, standard text message	Personal devices present the main risk area, with firms choice to ban them or approve with workaround apps.
Messaging apps	WhatsApp, Telegram, Slack	Ephemeral (disappearing) messages present a large risk – firms should consider blanket rules to prevent these.
Video call platforms	Zoom, Teams, Google Meet	AI notetakers create new records which require governance, and screen-sharing capabilities are often missed but require capture.
Social media communications	Facebook, X (Twitter), Instagram, TikTok	FINRA distinguishes between static content and interactive content for pre-approval. Direct messages also require oversight.

Does SEC Rule 17a-4 Still Require WORM Storage?

SEC Rule 17a-4 does not explicitly require WORM storage, but if you don’t use it, then you will need to use an approved digital audit trail alternative. In late 2022, the SEC updated its rules in favor of technology neutrality, meaning that firms can choose between WORM procedures or a suitable, equally protective procedure.

The SEC produced its own guidance regarding this part of the rule, which was last reviewed in January 2026, “under the audit-trail alternative, a broker-dealer must use an electronic recordkeeping system that maintains and preserves electronic records in a manner that permits the recreation of an original record if it is modified or deleted.”

Recordkeeping vs Communications Surveillance: What’s the Difference?

Recordkeeping is the capture, preservation, retention and retrieval of communications

Surveillance is the analysis and supervision of captured communications for potential risks or misconduct

While recordkeeping is focused on accurately capturing the communications at source, surveillance requires ongoing monitoring – checking what is contained in those comms and whether it meets risk frameworks and regulatory requirements.

You could compare it to taking a photo. Recordkeeping is like the pressing of the shutter button – the act of capturing the view. Surveillance is like inspecting what’s in the picture once it’s been developed.

Even though these are two separate concepts, the technologies for both can intersect. As Global Relay’s Director of Regulatory Intelligence, Rob Mason notes, “any self-respecting surveillance professional knows that good outcomes are only ever the result of good data”, and garbage in equals garbage out. Therefore, the recordkeeping side requires a ‘golden record’ – completely immutable and accurate, for surveillance solutions to work effectively. For example, centralized storage areas should hold original communications, with voice or video transcribed and translated language versions (if they are not in the surveillance teams’ natural language). This supports the accurate capture of comms while also integrating the surveillance workflow.

Which Questions should you Ask a Communications Recordkeeping Vendor?

As you work through a vendor comparison, there are some critical questions to ask before making a final decision. Remember that the right answer for another company might not suit yours – so consider what types of criteria you’ll need to put in place to assess your options.

• Which channels do you capture natively today, and where do you rely on third party integrations?
• Do you capture both company-owned and employee-owned devices?
• What does your automatic reconciliation process entail to prove capture of all relevant comms?
• How do you capture edits and reactions?
• How do you handle ephemeral messages?
• Can you enrich records with identity data?
• How granular are your retention rules, and do they vary based on user controls?
• How are records destroyed securely after the retention period ends?
• How do you detect tampering?
• What backup and recovery procedures exist?
• What search capabilities exist, and how fast do they return the correct results?
• How fast can you produce records in regulatory-ready formats?
• What independent assurance can you provide?

For more support in your evaluation process, including how to choose an operationally resilient vendor, click here.

Wear your regulatory hat, not your rose-tinted glasses

When selecting a communications technology vendor, you should always begin with regulatory requirements and the required capabilities, not the shiny features. Polished dashboards and done-for-you analytics can sound great on the surface, but if they are not supported by the correct data, they’re essentially worthless.

Global Relay’s gold standard compliance solutions give Broker-Dealers the confidence that their processes meet the scrutiny of the SEC and FINRA. Only the best is ‘good enough’ – with a holistic approach to help you meet the compliance requirements of the SEC, FINRA, and various exchanges in one place.

For more information, click here.

FAQs

What technology supports SEC and FINRA recordkeeping?

Communications archiving platforms accurately capture, retain, and retrieve business communications from channels like email, chat, text messages, and collaboration tools. Many are paired with supervision capabilities that help firms review those records for risks and regulatory violations.

What should a compliant communications archive be able to do?

It should capture communications completely and accurately, preserve them in a tamper-resistant form for the required retention period, and make them searchable and retrievable for exams and regulatory requests. It should also maintain audit trails and access controls.

Which communications should broker-dealers capture?

Broker-dealers should capture all business-related communications, regardless of the channel or device used, including email, text messages, chat and messaging apps, and social media. This also includes personal channels and devices when they are used for business.

Does SEC Rule 17a-4 require WORM storage?

Not exclusively. Since the 2022 amendments, firms may use either a write-once, read-many (WORM) format or an equivalent electronic recordkeeping system with a complete, time-stamped audit trail.

What is the difference between communications archiving and surveillance?

Archiving preserves communications as records, while surveillance reviews them to identify potential policy violations or misconduct. Archiving supports recordkeeping obligations, and surveillance supports supervisory obligations.