Regimes · United States
Keeping email under SEC Rule 17a-4
The US securities regulator requires broker-dealers to keep their business communications so that nothing can change unnoticed. For Swiss and German firms with US business, that can apply alongside their own law.
How long
Under Rule 17a-4(b)(4), originals of all communications received and copies of all communications sent that relate to the business as such, including inter-office communications, are kept for at least three years, the first two in an easily accessible place. Where a FINRA rule sets no period of its own, FINRA Rule 4511 requires six years.
The two routes for electronic records
Since the 2022 amendments, Rule 17a-4(f)(2) allows two routes:
- Audit trail: the record is kept in a way that maintains a complete, time-stamped audit trail of every modification and deletion, with the date and time of the action and, where applicable, the individual who carried it out.
- WORM: the record is kept exclusively in a non-rewriteable, non-erasable format.
The rule also requires the system to verify automatically the completeness and accuracy of what it stores, to allow records and their audit trail to be downloaded in both a human-readable and a reasonably usable electronic format, and to have a backup or redundancy that ensures access.
What MailVault contributes
| Requirement | In MailVault |
|---|---|
| Unalterability | Written once, then only read: no path in the program rewrites a sealed file. Every action stands in a hash-chained, sealed journal. A copy on storage that cannot be written to opens read-only, and can be verified and handed over from there. |
| Automatic verification | Verification and deep verification recompute the chain, the seals and every message. |
| Index and production | A downloadable, machine-readable index; export of the messages in the original, as PDF or as a portable archive. |
| Second copy | The location is recorded in the archive and reported in every check. Making the copy is your backup's job. |
| Holds | Legal holds suspend every period and every disposal for as long as they stand. |
What software does not take on
Rule 17a-4(f)(3) requires an undertaking to the regulator, given by a designated executive officer or a designated third party, to furnish records and their audit trail on request. On top of that come supervisory duties and procedures that no archiving program replaces. MailVault is one building block, on a Mac, for keeping and proving; whether it is enough for your firm is a question for your compliance function.
Questions
How long must a broker-dealer keep emails?
Under Rule 17a-4(b)(4), at least three years, the first two in an easily accessible place; where a FINRA rule sets no period, six years under FINRA Rule 4511.
Is WORM storage still mandatory?
Not since the 2022 amendments. Rule 17a-4(f)(2) allows, as an alternative, a complete time-stamped audit trail recording every modification and deletion.
Does MailVault give the undertaking to the SEC?
No. The undertaking under Rule 17a-4(f)(3) is given by a designated executive officer or a third party. MailVault supplies the records and the audit trail they have to produce.
Not legal advice. This page describes how the software works. Whether an organisation complies depends on its organisation, processes and documentation as well; for your own case, involve your auditor or legal adviser.
Try it on your own mailboxes.
Thirty days with everything open, no sign-up. Or we set up the first archive with you.