10.3 Broker-Dealer Books and Records, Electronic Storage, and Correspondence

Investment Company and Variable Contracts Products Principal Series 26

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Registration of the Broker-Dealer and Its Associated Persons

1.1 Broker-Dealer Registration, FINRA Membership, and Firm Filings 1.2 Individual Registration: Forms U4 and U5, Registration Categories, and Exempt Persons 1.3 Pre-Hire Screening, Fingerprinting, and Statutory Disqualification 1.4 Heightened Supervision, Interim Plans, and the Taping Rule 1.5 Broker-Dealers, Investment Advisers, Dual Registrants, and Unregistered Entities

2 Chapter 2: Training, Continuing Education, and Product Knowledge

2.1 Continuing Education (Rule 1240), the Maintaining Qualifications Program, and the Annual Compliance Meeting 2.2 The Investment Company Act of 1940: Classifications, Registration, and Fund Governance 2.3 Mutual Fund Pricing, Redemption, Exchanges, Sales Charges, and Share Classes 2.4 Variable Annuities and Variable Life Insurance: Structure, Charges, and Rule 2320 2.5 Closed-End and Interval Funds, UITs, Money Market Funds, 529 Plans, and Investment Risks

3 Chapter 3: Supervisory System, Conduct Standards, Insider Trading, and Discipline

3.1 The Supervisory System, Written Supervisory Procedures, and Standards of Conduct 3.2 Insider Trading, Information Barriers, and Personal Trading Supervision 3.3 FINRA Investigations, Disciplinary Proceedings, Sanctions, and Exemptions

4 Chapter 4: Communications with the Public

4.1 Communications Categories, Principal Approval, Filing, and Recordkeeping (Rule 2210) 4.2 Content Standards, Investment Company Advertising, and Professional Designations 4.3 Variable Contract Communications, Fund Rankings, Bond Fund Volatility Ratings, and Investment Analysis Tools 4.4 Correspondence and Internal Communications, Social Media, Public Appearances, and Telemarketing

5 Chapter 5: Recommendations, Customer Accounts, and Product Sales Supervision

5.1 Regulation Best Interest, Conflicts, and Form CRS 5.2 Know Your Customer, FINRA Suitability, and Institutional Accounts 5.3 New Accounts, Customer Authority, Discretion, and Order Handling 5.4 Mutual Fund Breakpoints, Share Classes, and Switching Supervision 5.5 Deferred Variable Annuities and the Seven-Business-Day Principal Review 5.6 Prospectuses, Summary Prospectuses, SAIs, and Ongoing Disclosures

6 Chapter 6: Compensation, Outside Activities, and Personal Conduct

6.1 Cash Compensation, Distribution Arrangements, and Conflicts 6.2 Gifts, Gratuities, and Business Entertainment (Rule 3220) 6.3 Training Meetings, Sales Contests, and Non-Cash Compensation 6.4 Referral Payments, Bank Networking, and Unregistered Persons 6.5 Outside Business Activities, Private Securities Transactions, and Rule 3290 Transition 6.6 Outside Accounts, Borrowing and Lending, Account Sharing, and Guarantees

7 Chapter 7: Customer Account Operations, Transfers, and Privacy

7.1 Account Records, Trusted Contacts, Confirmations, and Statements 7.2 Cash Accounts, T+1 Settlement, Regulation T, Extensions, and Freeriding 7.3 ACATS Transfers, Transfer-on-Death Accounts, and Account Changes 7.4 Regulation S-P, Incident Response, Service Providers, and Identity Theft

8 Chapter 8: Anti-Money Laundering, Customer Identification, and Sanctions

8.1 AML Program, Independent Testing, Training, and Governance 8.2 Customer Identification, Due Diligence, and Beneficial Ownership 8.3 SARs, CTRs, OFAC, Information Sharing, and AML Red Flags

9 Chapter 9: Supervisory Controls, Business Continuity, and Regulatory Reporting

9.1 Supervisory Controls, Annual Testing, and CEO Certification 9.2 Business Continuity, Systems Resilience, Cybersecurity, and Vendors 9.3 Rule 4530, FOCUS and Annual Reports, and Customer-Asset Events

10 Chapter 10: Office Classifications, Inspections, and Records

10.1 OSJs, Branches, RSLs, and Inspection Cycles 10.2 Inspection Reports, Independent Review, Signage, and Office Files 10.3 Broker-Dealer Books and Records, Electronic Storage, and Correspondence

11 Chapter 11: Complaints, Arbitration, Mediation, and Expungement

11.1 Customer Complaints, Investigation, Retention, and Reporting 11.2 Predispute Agreements, Arbitration Codes, Eligibility, Panels, and Awards 11.3 Mediation and Customer-Dispute Expungement

12 Chapter 12: Financial Responsibility, Membership Changes, and Investor Protection

12.1 Net Capital, Minimum Tiers, Haircuts, and Early Warning 12.2 Customer Protection, Possession or Control, Reserve Formula, and Exemptions 12.3 New-Product Review and Continuing Membership Applications 12.4 SIPC, Fidelity Bonds, Proxy Materials, and Financial Reports

10.3 Broker-Dealer Books and Records, Electronic Storage, and Correspondence

Key Takeaways Explain This Topic AI

SEC Rule 17a-3 specifies records broker-dealers must make, while Rule 17a-4 specifies preservation periods, accessibility, format, and production requirements.

Rule 17a-4 sets six-year periods for blotters and ledgers, three years for most other records, six years after closing for account terms, and the life of the enterprise for organizational records; FINRA Rule 4511 defaults to six years.

Electronic recordkeeping systems must satisfy Rule 17a-4 requirements through either the audit-trail alternative or the traditional non-rewriteable, non-erasable approach and related safeguards.

Business communications must be retained and supervised based on content, regardless of whether they occur through email, text, social media, collaboration tools, or a personal device.

SEC Rule 17a-3(a)(11) requires a trial balance of all ledger accounts and a net-capital computation at least monthly.

Last updated: September 2026

Creation and Preservation

SEC Rule 17a-3 requires broker-dealers to make specified records, including blotters, ledgers, account records, order information, associated-person records and financial documentation. Rule 17a-4 governs how long and how those records are preserved. FINRA rules add records for supervision, communications, complaints, gifts, continuing education and other functions.

The principal should avoid the shortcut that "all records are kept three years." SEC Rule 17a-4 sets different periods, and FINRA Rule 4511 adds a default: any FINRA-required record with no specified period must be kept at least six years , in a format and media that comply with Rule 17a-4.

Record Minimum retention

Blotters, general ledger, customer and other ledgers (Rule 17a-3(a)(1)–(3), (5)) 6 years , first 2 easily accessible

Order tickets, confirmations, trial balances and net-capital computations, and communications sent and received 3 years , first 2 easily accessible

Account cards and records on the terms of opening and maintaining an account 6 years after the account is closed

Rule 17a-3(a)(17) customer account record information 6 years after the earlier of account closing or the information being replaced or updated

Associated-person employment records and fingerprint records 3 years after the person's association ends

Partnership articles, articles of incorporation, minute books, and Forms BD and BDW Life of the enterprise and any successor

SEC Rule 17a-3(a)(11) requires a broker-dealer to prepare a trial balance of all ledger accounts and a computation of aggregate indebtedness and net capital at least monthly , a point FINRA's own Series 26 sample question tests. A retention schedule should cite the controlling provision for each record and preserve it longer when litigation, investigation or a legal hold applies.

Accessibility and Production

"Readily accessible" concerns the ability to retrieve and produce complete, legible records promptly, not merely whether data exists somewhere in a backup. Indexing must connect a communication or transaction to the associated person, account, date and reviewer. The firm should be able to export records with metadata and explain any codes.

Rule 17a-4 permits electronic preservation through specified alternatives. The traditional approach uses media that preserve records in a non-rewriteable, non-erasable format. The audit-trail alternative preserves a complete time-stamped audit trail showing creation and every modification or deletion so the original and changes can be recreated. Both approaches require controls for verification, indexing, access, backup or redundancy, and production. A generic cloud drive does not satisfy the rule merely because it stores files.

Electronic Communications

Recordkeeping follows business content , not the device or channel. Email, text messages, encrypted apps, social-media direct messages, collaboration platforms and messages from a personal phone are records when they concern the member's business. Prohibiting a channel is insufficient if personnel use it and the firm ignores evidence of use.

• Risk Control
• Personal texting with customers Approved captured channel, device controls, attestations and testing
• Disappearing messages Disable feature where possible; block or capture channel; investigate use
• Edited electronic record Preserve audit trail or compliant immutable version and metadata
• Vendor platform Contractual access, export testing, retention mapping and exit plan
• Legal hold Suspend routine deletion for responsive records across systems

FINRA Rule 2210 communication records generally include the communication, dates of first and last use where applicable, the name of any approving principal, and source materials supporting claims. Correspondence and internal communications use risk-based review under Rule 3110 procedures even where preapproval is not required.

Third-Party and Designated-Executive Controls

Using a vendor does not change the broker-dealer's responsibility. The firm must be able to access and surrender records and should test exports before an examination or failure. Rule 17a-4 also includes undertakings or designated-executive-officer mechanisms designed to ensure regulators can obtain records; procedures must identify current responsible persons and alternatives rather than rely on a departed employee.

Principal Review

The principal should reconcile system populations to the books, test edits and deletions, review access logs, search for off-channel indicators, and verify restoration. A missing record can be both a substantive supervision failure and a books-and-records violation. Once discovered, preserve available evidence, stop further loss, determine scope, correct technology and behavior, and assess reporting obligations.

Lifecycle Controls

Record governance begins before creation. Data fields, timestamps, identities and approvals must be captured in a form that remains understandable after systems and employees change. Migration testing compares counts, hashes, metadata and retrieval between the legacy and replacement systems; a successful login is not proof that all records migrated.

Deletion follows an approved schedule only after the applicable retention period and legal holds expire. Administrators should not be able to alter both records and audit evidence without detection. Access reviews remove departed personnel and unnecessary vendor privileges.

During an examination, the firm should produce the requested population rather than screenshots selected by a business unit. Failed searches, missing attachments or unreadable proprietary formats are recordkeeping issues even if an employee remembers the communication.

Annual vendor certifications are not enough when the firm cannot demonstrate retrieval. Sample requests should include old and recent dates, attachments, edited records and a departed employee. Results and corrective work belong in the recordkeeping control file.