[Federal Register Volume 87, Number 212 (Thursday, November 3, 2022)]
[Rules and Regulations]
[Pages 66412-66452]
[FR Doc No: 2022-22670]

Vol. 87

Thursday,

No. 212

November 3, 2022

Part III

 Securities and Exchange Commission

-----------------------------------------------------------------------

17 CFR Part 240

Electronic Recordkeeping Requirements for Broker-Dealers, Security-
Based Swap Dealers, and Major Security-Based Swap Participants; Final
Rule

Federal Register / Vol. 87, No. 212 / Thursday, November 3, 2022 /
Rules and Regulations

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Part 240

[Release No. 34-96034; File No. S7-19-21]
RIN 3235-AM76

Electronic Recordkeeping Requirements for Broker-Dealers,
Security-Based Swap Dealers, and Major Security-Based Swap Participants

AGENCY: Securities and Exchange Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'') is
adopting amendments to the recordkeeping rules applicable to broker-
dealers, security-based swap dealers, and major security-based swap
participants. The amendments modify requirements regarding the
maintenance and preservation of electronic records, the use of third-
party recordkeeping services to hold records, and the prompt production
of records. The Commission also is designating broker-dealer examining
authorities as Commission designees for purposes of certain provisions
of the broker-dealer record maintenance and preservation rule.

DATES:
    Effective date: January 3, 2023.
    Compliance date: The compliance date for the amendments to 17 CFR
240.17a-4 is May 3, 2023. The compliance date for the amendments to 17
CFR 240.18a-6 is November 3, 2023.

FOR FURTHER INFORMATION CONTACT: Michael A. Macchiaroli, Associate
Director, at<PHONE_NUMBER>; Thomas K. McGowan, Associate Director, at
(202) 551-5521; Randall W. Roy, Deputy Associate Director, at (202)
551-5522; Raymond Lombardo, Assistant Director, at<PHONE_NUMBER>; Joseph
I. Levinson, Senior Special Counsel, at<PHONE_NUMBER>; or Timothy C.
Fox, Branch Chief, at<PHONE_NUMBER>, Division of Trading and Markets,
Securities and Exchange Commission, 100 F Street NE, Washington, DC
20549-7010.

SUPPLEMENTARY INFORMATION: The Commission is amending:

------------------------------------------------------------------------
           Commission  Reference                    CFR citation
------------------------------------------------------------------------
Rule 17a-4................................  17 CFR 240.17a-4.
Rule 18a-6................................  17 CFR 240.18a-6.
------------------------------------------------------------------------

Contents

I. Introduction
    A. Background
    B. Overview of the Final Rule Amendments and Designation
II. Final Amendments
    A. Introductory Text
    B. Definition of Electronic Recordkeeping System
    C. Elimination of Notice and Representation Requirements From
Rule 17a-4(f)
    D. Technical Requirements for Electronic Recordkeeping Systems
    1. Applicability of the Requirements
    2. The Audit-Trail and WORM Requirements
    3. Verification Requirement
    4. Serialization Requirement
    5. Download and Transfer Requirement
    6. Backup or Redundant Recordkeeping System
    E. Requirements for Broker-Dealers and SBS Entities Using
Electronic Recordkeeping Systems
    1. Applicability of the Requirements
    2. Facilities To Produce Records
    3. Ability To Provide Records Stored Electronically
    4. Accountability Regarding Inputting of Records
    5. Information To Access and Locate Records
    6. Designated Executive Officer or Third Party
    F. Requirements for Broker-Dealers Using Micrographic Media To
Preserve Records
    G. Requirements for Certain Third Parties That Maintain Broker-
Dealer or SBS Entity Regulatory Records
    H. Requirement To Produce Electronic Records in a Reasonably
Usable Electronic Format
    I. Compliance Date
III. Designation of Broker-Dealer Examining Authorities
IV. Paperwork Reduction Act
    A. Summary of Collections of Information
    1. Amendments to Rules 17a-4(f) and 18a-6(e)
    2. Amendments to Rules 17a-4(i) and 18a-6(f)
    3. Amendments to Rules 17a-4(j) and 18a-6(g)
    B. Proposed Use of Information
    C. Respondents
    D. Total Initial and Annual Reporting Burdens
    E. Collection of Information Is Mandatory
    F. Confidentiality of Responses to Collection of Information
    G. Retention Period for Recordkeeping Requirements
V. Economic Analysis
    A. Baseline
    1. Broker-Dealers
    2. Security-Based Swap Entities
    3. Recordkeeping Practices of Market Participants
    B. Benefits of the Amendments
    C. Costs of the Amendments
    D. Reasonable Alternatives
    E. Effects on Efficiency, Competition, and Capital Formation
VI. Regulatory Flexibility Act
    A. Reasons for, and Objectives of, the Final Action
    B. Legal Basis
    C. Small Entities Subject to the Final Rules
    D. Reporting, Recordkeeping, and Other Compliance Requirements
    E. Duplicative, Overlapping, or Conflicting Federal Rules
    F. Significant Alternatives
VII. Other Matters
VIII. Statutory Basis

I. Introduction

A. Background

    Securities Exchange Act of 1934 (``Exchange Act'') Rule 17a-4
(``Rule 17a-4'') \1\ sets forth record maintenance and preservation
requirements applicable to broker-dealers, including broker-dealers
also registered as security-based swap dealers (``SBSDs'') or major
security-based swap participants (``MSBSPs'').\2\ Exchange Act Rule
18a-6 (``Rule 18a-6'') \3\ sets forth record maintenance and
preservation requirements for SBSDs and MSBSPs that are not also
registered as broker-dealers (``SBS Entities'').\4\ Rule 18a-6 was
modeled on Rule 17a-4.\5\ Pursuant to Sections 15F and 17(a) of the
Exchange Act, in 2021, the Commission proposed amendments to Rules 17a-
4 and 18a-6.\6\ Specifically, the Commission proposed to amend the
electronic record maintenance and preservation requirements of Rules
17a-

4 and 18a-6 and the prompt production of records requirements of those
rules.\7\ The Commission received comment letters in response to the
proposed amendments.\8\ The Commission is adopting the proposed
amendments with certain modifications in response to comments.\9\
---------------------------------------------------------------------------

    \1\ See 17 CFR 240.17a-4.
    \2\ As used in this release, the term ``broker-dealer'' includes
a broker-dealer that is also registered as an SBSD or MSBSP.
    \3\ See 17 CFR 240.18a-6.
    \4\ As used in this release, the term ``SBS Entity'' refers to
an SBSD and MSBSP that is not also registered as a broker-dealer.
    \5\ See Recordkeeping and Reporting Requirements for Security-
Based Swap Dealers, Major Security-Based Swap Participants, and
Broker-Dealers, Exchange Act Release No. 87005 (Sept. 19, 2019), 84
FR 68550, 68562-71 (Dec. 16, 2019) (``SBSD/MSBSP Recordkeeping
Adopting Release''); Recordkeeping and Reporting Requirements for
Security-Based Swap Dealers, Major Security-Based Swap Participants,
and Broker-Dealers; Capital Rule for Certain Security-Based Swap
Dealers, Exchange Act Release No. 71958 (Apr. 17, 2014), 79 FR
25194, 25211-20 (May 4, 2014) (``SBSD/MSBSP Recordkeeping Proposing
Release'').
    \6\ See Electronic Recordkeeping Requirements for Broker-
Dealers, Security-Based Swap Dealers, and Major Security-Based Swap
Participants, Exchange Act Release No. 93614 (Nov. 18, 2021), 86 FR
68300 (Dec. 1, 2021) (``Proposing Release''). Section 17(a) of the
Exchange Act, in pertinent part, provides the Commission with
authority to issue rules requiring broker-dealers to make and keep
for prescribed periods such records as the Commission, by rule,
prescribes as necessary or appropriate in the public interest, for
the protection of investors, or otherwise in furtherance of the
purposes of the Exchange Act. See 15 U.S.C. 78q(a). Section
15F(f)(1)(B)(i) of the Exchange Act provides that SBSDs and MSBSPs
for which there is a prudential regulator shall keep books and
records of all activities related to their business as an SBSD or
MSBSP in such form and manner and for such period as may be
prescribed by the Commission by rule or regulation. See 15 U.S.C.
78o-10(f)(1)(B)(i). Section 15F(f)(1)(B)(ii) of the Exchange Act
provides that SBSDs and MSBSPs without a prudential regulator shall
keep books and records in such form and manner and for such period
as may be prescribed by the Commission by rule or regulation. See 15
U.S.C. 78o-10(f)(1)(B)(ii).
    \7\ See paragraph (f) of Rule 17a-4 and paragraph (e) of Rule
18a-6 (setting forth the electronic record preservation
requirements) and paragraph (j) of Rule 17a-4 and paragraph (g) of
Rule 18a-6 (setting forth the prompt production of records
requirements).
    \8\ The comment letters are available at https://www.sec.gov/comments/s7-19-21/s71921.htm.
    \9\ See paragraphs (f), (i), and (j) of Rule 17a-4, as amended;
paragraphs (e), (f), and (g) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

B. Overview of the Final Rule Amendments and Designation

    Rule 17a-4 currently requires a broker-dealer to notify its
designated examining authority (``DEA'') before employing an electronic
recordkeeping system.\10\ The amendments to the rule eliminate this
requirement.\11\
---------------------------------------------------------------------------

    \10\ See paragraph (f)(2)(i) of Rule 17a-4. Rule 18a-6 does not
have a similar requirement.
    \11\ See section II.C. of this release (discussing these
amendments in more detail).
---------------------------------------------------------------------------

    Rule 17a-4 currently requires a broker-dealer to maintain and
preserve electronic records exclusively in a non-rewriteable, non-
erasable format (also known as a write once, read many (``WORM'')
format). The amendments to Rule 17a-4 add an audit-trail alternative to
the WORM requirement.\12\ Under the audit-trail alternative, a broker-
dealer will need to use an electronic recordkeeping system that
maintains and preserves electronic records in a manner that permits the
recreation of an original record if it is modified or deleted.
Currently, Rule 18a-6 does not require an SBS Entity to use an
electronic recordkeeping system that meets either the audit-trail or
the WORM requirement. The amendments to Rule 18a-6 require an SBS
Entity without a prudential regulator (``nonbank SBS Entity'') to
maintain and preserve electronic records using an electronic
recordkeeping system that meets either the audit-trail or the WORM
requirement.\13\ Thus, under the amendments to Rules 17a-4 and 18a-6, a
broker-dealer or nonbank SBS Entity that elects to use an electronic
recordkeeping system will need to ensure that such electronic
recordkeeping system meets either the audit-trail requirement or the
WORM requirement.
---------------------------------------------------------------------------

    \12\ See section II.D.2. of this release (discussing these
amendments in more detail).
    \13\ See section II.D.2. of this release (discussing these
amendments in more detail).
---------------------------------------------------------------------------

    Rule 17a-4 currently requires a broker-dealer to engage a third
party who has access to and the ability to download information from
the broker-dealer's electronic storage media to any acceptable medium
under the rule. The third party must execute, and file with its DEA,
written undertakings agreeing to, among other things, promptly furnish
to the Commission and other securities regulators the information
necessary to download records kept on the electronic storage media to
any medium acceptable under Rule 17a-4. The amendments to Rule 17a-4
modify the form of the undertakings to make them more technology
neutral and to provide an alternative to engaging a third party to
perform this function.\14\ Under the alternative, a broker-dealer can
designate an executive officer to execute the undertakings if the
executive officer has access to and the ability to provide records
maintained and preserved on the broker-dealer's electronic
recordkeeping system either directly or through a specialist who
reports directly or indirectly to the executive officer. Further, the
executive officer can appoint in writing up to two employees who are
direct or indirect reports to fulfill the executive officer's
obligations if the executive officer is unable to fulfill those
obligations. The employees must have the same ability as the executive
officer to independently access and provide the records either directly
or through a specialist who reports directly or indirectly to them. In
addition, the designated executive officer can appoint in writing up to
three specialists to assist in fulfilling the executive officer's
obligations. Rule 18a-6 currently does not have either a third-party or
executive officer undertakings requirement. The amendments to Rule 18a-
6 add the third-party undertakings provision and alternative executive
officer undertakings provision to the rule and require those
undertakings to be filed with the Commission.\15\ Thus, under the
amendments to Rules 17a-4 and 18a-6, a broker-dealer or SBS Entity that
elects to use an electronic recordkeeping system must have either a
third party or an executive officer provide the written undertakings.
---------------------------------------------------------------------------

    \14\ See section II.E.6. of this release (discussing these
amendments in more detail). The Commission proposed to eliminate the
third-party undertakings requirement of Rule 17a-4 and replace it
with a senior officer undertakings requirement, and to add a
parallel senior officer undertakings requirement to Rule 18a-6. See
Proposing Release, 86 FR at 68310. For the reasons discussed in
section II.E.6. of this release, the Commission is retaining the
third-party undertakings provision in Rule 17a-4, as amended, to
serve as an alternative to an executive officer undertakings
requirement, and adding both the third-party undertakings
requirement and the alternative executive officer undertakings
requirement to Rule 18a-6, as amended.
    \15\ See section II.E.6. of this release (discussing these
amendments in more detail).
---------------------------------------------------------------------------

    Rules 17a-4 and 18a-6 require a third party who prepares or
maintains the regulatory records of a broker-dealer or SBS Entity
(regardless of whether the records are in paper or electronic form) to
file a written undertaking with the Commission signed by a duly
authorized person.\16\ The undertaking must include a provision whereby
the third party agrees, among other things, to permit examination of
the records by representatives or designees of the Commission as well
as to promptly furnish to the Commission or its designee true, correct,
complete, and current hard copies of any or all or any part of such
books and records.
---------------------------------------------------------------------------

    \16\ This undertaking requirement is designed to address access
to broker-dealer or SBS Entity records when they are held by a
person other than the broker-dealer or SBS Entity and regardless of
whether the records are in paper form, stored on micrographic media,
or stored on an electronic recordkeeping system. It is separate from
the third-party or executive officer undertakings requirements
discussed above, which are designed to address access to records
preserved and maintained on an electronic recordkeeping system
irrespective of whether they are held by a third party.
---------------------------------------------------------------------------

    Some broker-dealers and SBS Entities maintain their electronic
recordkeeping systems and associated electronic records on servers or
other storage devices that are owned or operated by a third party
(e.g., a cloud service provider) while the broker-dealer or SBS Entity
retains control of the electronic recordkeeping system and access to
the electronic records preserved on the system. Consequently, the third
parties state that they cannot provide the undertaking required under
Rules 17a-4 and 18a-6.
    The Commission is amending Rules 17a-4 and 18a-6 to address this
development in electronic recordkeeping practices.\17\ Under the
amendments, the third party may provide an alternative undertaking in
lieu of the traditional undertaking that is tailored to how certain
recordkeeping services, including cloud service providers, hold
electronic records for broker-dealers and SBS Entities. The use of this
alternative undertaking is subject to certain conditions, including
that the records are maintained on an electronic recordkeeping system
and the broker-dealer or SBS Entity has independent access to the
records meaning, among other things, the broker-dealer can access the
records without the need of any intervention of the third party.

Consequently, the alternative undertaking cannot be used if the records
maintained and preserved by the third party are not maintained and
preserved by means of an electronic recordkeeping system (e.g., it
cannot be used if the records are in paper form). It also cannot be
used if the broker-dealer or SBS Entity must rely on the third party to
take an intervening step to make the records available to the broker-
dealer or SBS Entity (e.g., it cannot be used if the broker-dealer or
SBS Entity must ask the third party to transfer copies of the records
to the broker-dealer or SBS Entity or must ask the third party to first
decrypt the records before they can be accessed).
---------------------------------------------------------------------------

    \17\ See section II.G. of this release (discussing these
amendments in more detail).
---------------------------------------------------------------------------

    In the alternative undertaking, which must be filed with the
Commission, the third party must, among other things, acknowledge that
the records are the property of the broker-dealer or SBS Entity and
that the broker-dealer or SBS Entity has represented to the third party
that the broker-dealer or SBS Entity: (1) is subject to rules of the
Commission governing the maintenance and preservation of certain
records; (2) has independent access to the records maintained by the
third party; and (3) consents to the third party fulfilling the
obligations set forth in the undertaking. Further, the third party must
undertake to facilitate within its ability, and not impede or prevent,
the examination, access, download, or transfer of the records by a
representative or designee of the Commission as permitted under the
law. In the case of a broker-dealer, the third party must also
undertake to facilitate within its ability, and not impede or prevent,
a trustee appointed under the Securities Investor Protection Act of
1970 (``SIPA'') to liquidate the broker dealer in accessing,
downloading, or transferring the records as permitted under the
law.\18\
---------------------------------------------------------------------------

    \18\ SBS Entities are not members of the Securities Investor
Protection Corporation (``SIPC'') and, therefore, are not eligible
to be liquidated under SIPA.
---------------------------------------------------------------------------

    Rules 17a-4 and 18a-6 require a broker-dealer or SBS Entity,
respectively, to furnish promptly to a representative of the Commission
legible, true, complete, and current copies of the records required to
be maintained and preserved under the rules and any other records
subject to examination. The amendments to Rules 17a-4 and 18a-6 require
the broker-dealer or SBS Entity to furnish a record and its audit trail
(if applicable) preserved on an electronic recordkeeping system in a
reasonably usable electronic format, if requested by a representative
of the Commission.\19\ This means the record will need to be produced
in an electronic format that is compatible with commonly used systems
for accessing and reading electronic records.
---------------------------------------------------------------------------

    \19\ See section II.H. of this release (discussing these
amendments in more detail).
---------------------------------------------------------------------------

    The following table summarizes the electronic recordkeeping
amendments to Rules 17a-4 and 18a-6.

----------------------------------------------------------------------------------------------------------------
                                                                              Rule 18a-6
            Provision                 Rule 17a-4     -----------------------------------------------------------
                                                            Current           As amended            Current
----------------------------------------------------------------------------------------------------------------
DEA Notification................  Required..........  No longer required  Not required......  Not required.
WORM............................  Required..........  WORM or audit-      Not required......  WORM or audit-
                                                       trail required.                         trail required
                                                                                for nonbank SBS
                                                                                Entities.
3rd Party Undertaking Regarding   Required..........  3rd Party or        Not required......  3rd Party or
 Electronic Records.                                   executive officer                       executive officer
                                                       undertaking                             undertaking
                                                       required.                               required.
Produce Electronic Records in a   Not required......  Required..........  Not required......  Required.
 Reasonably Useable Format.
Alternative Undertaking for       Not permitted.....  Permitted.........  Not Permitted.....  Permitted.
 Cloud Service Providers.
----------------------------------------------------------------------------------------------------------------

    Finally, various provisions of Rule 17a-4 refer to representatives
or designees of the Commission. For example, an outside entity serving
as a record custodian for a broker-dealer or SBS Entity must execute an
undertaking agreeing to permit examination of the records by
representatives or designees of the Commission as well as to promptly
furnish hard copies of the records to the representatives and
designees. The Commission is designating a broker-dealer's examining
authorities as Commission designees for the purposes of these
provisions of Rule 17a-4.\20\
---------------------------------------------------------------------------

    \20\ See section III of this release (discussing this
designation). The Commission is not making a similar designation
with respect to Rule 18a-6 because SBS Entities are not members of a
self-regulatory organization (``SRO'') and, therefore, do not have
an SRO that serves as an examining authority.
---------------------------------------------------------------------------

II. Final Amendments

A. Introductory Text

    The electronic recordkeeping provisions of Rule 17a-4 are set forth
in paragraph (f) of the rule (``Rule 17a-4(f)''). The introductory text
of Rule 17a-4(f) provides, in pertinent part, that the records required
to be maintained and preserved pursuant to 17 CFR 240.17a-3 (Rule 17a-
3) and Rule 17a-4 (``Broker-Dealer Regulatory Records'') may be
immediately produced or reproduced on ``micrographic media'' or by
means of ``electronic storage media'' that meet the conditions set
forth in the rule and be maintained and preserved for the required time
in that form. The term ``micrographic media'' refers to microfilm,
microfiche, or any similar medium.\21\ The electronic recordkeeping
provisions of Rule 18a-6 are set forth in paragraph (e) of the rule
(``Rule 18a-6(e)''). The introductory text of Rule 18a-6(e) provides,
in pertinent part, that the records required to be maintained and
preserved pursuant to 17 CFR 240.18a-5 (Rule 18a-5) and Rule 18a-6
(``SBS Entity Regulatory Records'') may be immediately produced or
reproduced by means of an ``electronic storage system'' that meets the
conditions set forth in the rule and be maintained and preserved for
the required time in that form.\22\ Rule 18a-

6(e) does not provide a micrographic media option.\23\
---------------------------------------------------------------------------

    \21\ See paragraph (f)(1)(i) of Rule 17a-4 (defining the term
``micrographic media'').
    \22\ The use of the phrase ``electronic storage system''
throughout Rule 18a-6 was intended to clarify that the rule does not
require a particular storage medium such as an optical disk or CD-
ROM. See Proposing Release, 86 FR at 68303; SBSD/MSBSP Recordkeeping
Adopting Release, 84 FR at 86568.
    \23\ Rule 18a-6 does not include a micrographic media option
because it was believed that SBS Entities would not choose to use
that technology to preserve electronic records. See Proposing
Release, 86 FR at 68303; SBSD/MSBSP Recordkeeping Adopting Release,
84 FR at 86568 n.200; SBSD/MSBSP Recordkeeping Proposing Release, 79
FR at 25219.
---------------------------------------------------------------------------

    Rule 17a-4(f) was adopted in 1997.\24\ The Commission intended Rule
17a-4(f) to be technology neutral but was guided by the predominant
electronic storage method at that time: using optical platters, CD-
ROMs, or DVDs (collectively, ``optical disks'').\25\ Therefore, the
requirements of the rule contemplated the use of optical disks to a
certain degree.
---------------------------------------------------------------------------

    \24\ See Reporting Requirements for Brokers or Dealers under the
Securities Exchange Act of 1934, Exchange Act Release No. 38245
(Jan. 31, 1997), 62 FR 6469 (Feb. 12, 1997) (``Rule 17a-4(f)
Adopting Release''). See also Reporting Requirements for Brokers or
Dealers under the Securities Exchange Act of 1934, Exchange Act
Release No. 32609 (July 9, 1993), 58 FR 38092 (July 15, 1993)
(proposing Rule 17a-4(f)).
    \25\ See Rule 17a-4(f) Adopting Release, 62 FR at 6470.
---------------------------------------------------------------------------

    The Commission proposed amendments to Rule 17a-4(f), including to
the rule's introductory text, to make the rule more technology
neutral.\26\ For example, the Commission proposed to replace the phrase
``electronic storage media'' with the phrase ``electronic recordkeeping
system'' throughout the rule, including in the introductory text. The
Commission also proposed a conforming amendment to Rule 18a-6(e) to
replace the phrase ``electronic storage system'' with the phrase
``electronic recordkeeping system'' throughout the rule, including in
the introductory text.
---------------------------------------------------------------------------

    \26\ See Proposing Release 86 FR at 68303.
---------------------------------------------------------------------------

    As discussed next, commenters addressed the proposal's use of the
term ``electronic recordkeeping system'' and its proposed definition.
Otherwise, commenters did not address the proposed amendments to the
introductory text of Rules 17a-4(f) and 18a-6(e) and the Commission is
adopting them substantially as proposed.\27\
---------------------------------------------------------------------------

    \27\ See introductory text of paragraph (f) of Rule 17a-4, as
amended; introductory text of paragraph (e) of Rule 18a-6, as
amended. To improve readability, the phrase ``subject to the
conditions set forth in this paragraph'' has been moved to the
beginning of the introductory text of both paragraphs. Id.
---------------------------------------------------------------------------

B. Definition of Electronic Recordkeeping System

    Paragraphs (f)(1)(i) and (ii) of Rule 17a-4 and paragraph (e)(1) of
Rule 18a-6 currently define the terms ``micrographic media'',
``electronic storage media,'' and ``electronic storage system'',
respectively. Paragraph (f)(1)(ii) of Rule 17a-4 defines the term
``electronic storage media'' as, in pertinent part, any digital storage
medium or system that meets the requirements of the rule. Similarly,
paragraph (e)(1) of Rule 18a-6 defines the term ``electronic storage
system'' as, in pertinent part, any digital storage system that meets
the requirements of the rule.
    The Commission proposed to replace the terms ``electronic storage
media'' and ``electronic storage system'' in Rules 17a-4(f) and 18a-
6(e), respectively, with the term ``electronic recordkeeping
system''.\28\ The Commission proposed to define the new term in both
rules as ``a system that preserves records in a digital format and that
requires a computer to access the records.'' \29\
---------------------------------------------------------------------------

    \28\ See Proposing Release, 86 FR at 68304.
    \29\ Id.
---------------------------------------------------------------------------

    One commenter stated that the proposed definition was
``appropriately generic to survive foreseeable technological changes
and will provide broker-dealers the flexibility to employ solutions
that are innovative, efficient and/or cost-effective while still
meeting the requirements of Rule 17a-4(f).'' \30\ Another commenter
expressed broad support for the proposal to update references to
``electronic storage media'' to the ``more generally applicable term''
``electronic recordkeeping system.'' \31\ Other commenters, however,
suggested modifications to the term and definition. Two commenters
suggested replacing the term ``electronic recordkeeping system'' with
the term ``electronic recordkeeping.'' \32\ One commenter stated that
the definition should not use the word ``system'' because ``it implies
the expectation of a physical and specified grouping of hardware and
software rather than a system of supervision undertaken by a Regulated
Entity to ensure records are maintained.'' \33\ The commenter stated
that ``any definition of electronic recordkeeping system should
consider non-technological elements, such as assigning roles and
responsibilities to key individuals and groups.'' \34\
---------------------------------------------------------------------------

    \30\ See letter from John Gebauer, President, National
Regulatory Services, Jan. 6, 2022 (``NRS Letter'').
    \31\ See letter from John Trotti, NCC Group, Dec. 29, 2021
(``NCC Group Letter'').
    \32\ See letter from Ian J. Frimet, Senior Vice President,
Associate General Counsel, LPL Financial, Jan. 3, 2022 (``LPL
Financial Letter''); letter from Melissa MacGregor, Managing
Director and Associate General Counsel, SIFMA, Dec. 22, 2021
(``SIFMA Letter'').
    \33\ See LPL Financial Letter.
    \34\ Id.
---------------------------------------------------------------------------

    The intent in defining ``electronic recordkeeping system'' was to
refer to the technological means by which records are stored in digital
form and accessed and retrieved without specifying a specific type of
technology.\35\ This is because the proposed amendments were structured
so that paragraphs (f)(2) and (e)(2) of Rules 17a-4 and 18a-6,
respectively, set forth the technical requirements for the electronic
recordkeeping system.\36\ Paragraphs (f)(3) and (e)(3) of Rules 17a-4
and 18a-6, respectively, set forth requirements for broker-dealers and
SBS Entities that use electronic recordkeeping systems (i.e.,
requirements that were not intrinsic to the electronic recordkeeping
system). Commenters suggested using the term ``electronic
recordkeeping'' to encompass more than the technological means by which
the records are stored in digital form and accessed and retrieved.\37\
However, using the broader term ``electronic recordkeeping'' would not
be consistent with the objective of differentiating the requirements in
paragraphs (f)(2) and (e)(2) of Rules 17a-4 and 18a-6 (which set forth
technical requirements applicable to the electronic recordkeeping
system itself) from the requirements of paragraphs (f)(3) and (e)(3) of
Rules 17a-4 and 18a-6 (which set forth requirements for firms using an
electronic recordkeeping system). For these reasons, Rules 17a-4 and
18a-6, as amended, use the term ``electronic recordkeeping system.''
---------------------------------------------------------------------------

    \35\ See Proposing Release, 86 FR at 68303.
    \36\ See Proposing Release, 86 FR at 68304-11.
    \37\ See, e.g., LPL Financial Letter.
---------------------------------------------------------------------------

    One commenter recommended that if the term ``electronic
recordkeeping system'' is retained, the Commission alter the definition
of the term ``to eliminate the word `computer,' which may not be
technologically neutral in the future.'' \38\ A second commenter
expressed agreement with and support for this suggestion, and
recommended ``the use of technology neutral terms to allow the proposed
rules to be and remain relevant to current technologies and continued
innovation.'' \39\
---------------------------------------------------------------------------

    \38\ SIFMA Letter.
    \39\ Letter from Blair Anderson, Director, AWS, Jan. 3, 2022
(``AWS Letter'').
---------------------------------------------------------------------------

    An objective of the proposed amendments to Rules 17a-4 and 18a-6
was to make them more technology neutral.\40\ Accordingly, the
definition of ``electronic recordkeeping system'' in Rules 17a-4 and
18a-6 is being modified to eliminate the reference to a ``computer'' as
recommended by the commenters. In particular, the definition replaces
the concept that an electronic recordkeeping system is a

system that preserves records in a digital format and that requires a
computer to access the records with the concept that it is a system
that preserves the records in a digital format in a manner that permits
the records to be viewed and downloaded.\41\ Therefore, the technology
used to preserve records may employ a means other than a computer, but
the technology must permit the records to be viewed and downloaded.
These two features are necessary for firms to furnish records to
representatives of the Commission and other securities regulators so
that they may perform their oversight responsibilities. For these
reasons and the reasons stated in the proposing release,\42\ the
Commission is adopting amendments that use the term ``electronic
recordkeeping system'' and that define the term with the modifications
discussed above.\43\
---------------------------------------------------------------------------

    \40\ See Proposing Release, 86 FR at 68301.
    \41\ See paragraph (f)(1)(ii) of Rule 17a-4 and paragraph
(e)(1)(i) of Rule 18a-6, as amended.
    \42\ See Proposing Release, 86 FR at 68304.
    \43\ See paragraph (f)(1)(ii) of Rule 17a-4 and paragraph
(e)(1)(i) of Rule 18a--6, as amended.
---------------------------------------------------------------------------

C. Elimination of Notice and Representation Requirements From Rule 17a-
4(f)

    Paragraph (f)(2)(i) of Rule 17a-4 requires a broker-dealer to
notify its examining authority \44\ prior to employing electronic
storage media, including a 90-day notice if the broker-dealer intends
to employ electronic storage media other than optical disk technology.
Paragraph (f)(2)(i) also requires a representation from the broker-
dealer or the storage medium vendor or another third party with
appropriate expertise that the selected electronic storage medium meets
the conditions set forth in the rule. Rule 18a-6 does not contain
parallel notice and representation requirements. The Commission
proposed to eliminate the notification and representation requirements
from Rule 17a-4(f).\45\ Commenters supported the elimination of these
requirements, while none of the commenters expressed opposition.\46\
For the reasons stated in the proposing release as well as in the
comments,\47\ the Commission is adopting the amendments eliminating
these requirements, as proposed.\48\
---------------------------------------------------------------------------

    \44\ The term ``examining authority'' means an SRO registered
with the Commission under the Exchange Act (other than a registered
clearing agency) with the authority to examine, inspect, and
otherwise oversee the activities of a registered broker-dealer. See
Section 17(j)(5) of the Exchange Act. 15 U.S.C. 78q(j)(5).
    \45\ See Proposing Release, 86 FR at 68304.
    \46\ See letter from Alexander Gavis, Senior Vice President &
Deputy General Counsel, Fidelity Investments, Dec. 31, 2021
(``Fidelity Letter''); NRS Letter.
    \47\ See Proposing Release, 86 FR at 68304.
    \48\ See paragraph (f) of Rule 17a-4, as amended.
---------------------------------------------------------------------------

D. Technical Requirements for Electronic Recordkeeping Systems

1. Applicability of the Requirements
    The Commission proposed to set forth the technical requirements for
electronic recordkeeping systems used by broker-dealers and SBS
Entities in paragraph (f)(2) of Rule 17a-4 and paragraph (e)(2) of Rule
18a-6, respectively.\49\ The Commission proposed that the technical
requirements for electronic recordkeeping systems in Rule 17a-4(f)
apply to all broker-dealers.\50\ The Commission further proposed that
the technical requirements for electronic recordkeeping systems in
paragraph (e)(2) of Rule 18a-6 apply to nonbank SBS Entities (i.e., SBS
Entities without a prudential regulator). Under the proposal, SBS
Entities with a prudential regulator (``bank SBS Entities'') could
employ electronic recordkeeping systems that did not necessarily meet
the technical requirements set forth in paragraph (e)(2) of Rule 18a-6,
as proposed to be amended. The intent was to avoid imposing
requirements that could potentially conflict with regulations and
guidance of the prudential regulators, particularly given that the
Commission's recordkeeping requirements for bank SBS Entities are more
limited in scope.\51\ The Commission did not receive comments
addressing the applicability of paragraph (f)(2) of Rule 17a-4 and
paragraph (e)(2) of Rule 18a-6. For the reasons stated in the proposing
release,\52\ the Commission is adopting the amendments regarding the
applicability of the requirements, as proposed.\53\
---------------------------------------------------------------------------

    \49\ See Proposing Release, 86 FR at 68304-07. Specifically, the
proposed technical requirements were set forth in paragraphs
(f)(2)(i) through (iv) of Rule 17a-4 and paragraphs (e)(2)(i)
through (iv) of Rule 18a-6.
    \50\ See Proposing Release, 86 FR at 68304-05.
    \51\ Id.
    \52\ Id.
    \53\ See introductory text of paragraph (f)(2) of Rule 17a-4 and
paragraph (e)(2) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

2. The Audit-Trail and WORM Requirements
    The Commission proposed to amend Rule 17a-4(f) to add the audit-
trail requirement as an alternative to the existing WORM
requirement.\54\ Thus, under the proposal, an electronic recordkeeping
system used by a broker-dealer to preserve Broker-Dealer Regulatory
Records would need to meet either the audit-trail or WORM requirement.
In addition, the Commission proposed to amend Rule 18a-6(e) to require
that the electronic recordkeeping systems of nonbank SBS Entities meet
either the audit-trail or the WORM requirement.\55\ Thus, under the
proposals, nonbank SBS Entities would need to preserve SBS Entity
Regulatory Records using an electronic recordkeeping system that meets
either the audit-trail or WORM requirement.
---------------------------------------------------------------------------

    \54\ See Proposing Release, 86 FR at 68305-06.
    \55\ Id.
---------------------------------------------------------------------------

    Commenters generally supported adding the audit-trail alternative
to Rules 17a-4 and 18a-6. One commenter stated that the ``addition of
an audit-trail based electronic record keeping system appears to be a
sensible and workable option in addition to the option to store records
in a WORM compliant manner'' and that it ``appears likely that broker-
dealers will benefit from greater access to systems and technology that
meet these broader technical criteria.'' \56\ Another commenter stated
that ``[f]or many broker-dealers, adoption of the proposal will result
in significant cost savings and efficiencies'' and that ``[t]he current
WORM system is expensive to build and maintain annually, and is only
used to comply with Rule 17a-4.'' \57\ This commenter also stated that
the audit-trail requirement should ``have a significantly lower annual
cost of maintenance.'' Other commenters similarly supported the
Commission's effort to modernize Rule 17a-4 by providing an alternative
to the WORM requirement.\58\
---------------------------------------------------------------------------

    \56\ NCC Group Letter.
    \57\ LPL Financial Letter.
    \58\ See letter from William C. Anderson, Senior Vice President
and Chief Compliance Officer, American Funds Distributors, Inc.,
Dec. 31, 2021 (``American Funds Distributors Letter'') (``In our
experience the requirements of the current rule, particularly the
requirement to store records in a write once read many format
(WORM), have resulted in the implementation of complex procedures
that do not serve the purposes for which the rule was designed. For
example, many of our records are stored in systems that do not meet
the WORM standards. As a result, we transfer records to a WORM
compliant system, which is not as user friendly as the native
systems used by the business on a day-to-day basis.''); letter from
Alexander Gavis, Senior Vice President & Deputy General Counsel,
Fidelity Investments, Dec. 31, 2021 (``Fidelity Letter'') (``WORM
records are not easily searchable and, as a result, even as noted in
the Release, SEC and FINRA examiners typically do not request
records in WORM format. Examiners instead request customized data
pulls from the non-WORM systems where the information was originally
created prior to its storage in WORM format.'').
---------------------------------------------------------------------------

    Several commenters, however, recommended that the Commission adopt
a more principles-based approach in place of the audit-trail
requirement and expressed support for a 2017

petition for rulemaking.\59\ The petition was filed by a group of trade
associations.\60\ The petition requested that the Commission replace
the WORM requirement with more liberal ``principles-based
requirements'' similar to amendments the Commodity Futures Trading
Commission (``CFTC'') had made to its electronic recordkeeping
rule.\61\ One of these commenters recommended that the Commission adopt
the principles-based approach set forth in the petition and stated,
``The audit-trail alternative proposed by the SEC is not `technology-
neutral' and mandates specific technology requirements and electronic
formats for broker-dealers, which reduce the ability for firms to
implement future technological innovations or advancements.'' \62\
---------------------------------------------------------------------------

    \59\ See letter from Eversheds Sutherland (US) LLP on behalf of
Committee of Annuity Insurers, Jan. 5, 2022 (``Committee of Annuity
Insurers Letter''); letter from Dave T. Bellaire, Esq., Executive
Vice President & General Counsel, Financial Services Institute, Jan
3, 2022 (``FSI Letter''); NRS Letter.
    \60\ See Petition 4-713 (Nov. 14, 2017) filed by the Securities
Industry Financial Markets Association, Financial Services
Roundtable, Futures Industry Association, International Swaps
Derivatives Association, and Financial Services Institute available
at https://www.sec.gov/rules/petitions/2017/petn4-713.pdf (``Rule
17a-4(f) Rulemaking Petition''). An addendum to the Rule 17a-4(f)
Rulemaking Petition was filed on May 24, 2018, and is available at
https://www.sec.gov/rules/petitions/2018/ptn4-713-addendum.pdf
(``Rule 17a-4(f) Rulemaking Petition Addendum''). Comments on the
petition were received and are available at https://www.sec.gov/comments/4-713/4-713.htm.
    \61\ See CFTC, Recordkeeping, 82 FR 24479 (May 30, 2017).
    \62\ FSI Letter.
---------------------------------------------------------------------------

    The Commission responded to the petition in the proposing release
by stating that ``[w]hile [the proposed audit-trail requirement] would
not rely on `principles-based requirements' to protect the reliability
and authenticity of electronic records, it is designed to address
concerns raised by commenters about the WORM requirement.'' \63\ The
Commission continues to believe that providing the option to preserve
records using an electronic recordkeeping system that complies with the
audit-trail requirement appropriately addresses concerns about the WORM
requirement while meeting the objective of the WORM requirement: the
preservation of electronic records in a manner that protects the
authenticity and reliability of original records.\64\ As the Commission
stated when proposing the audit-trail requirement, it is ``designed to
address concerns that the WORM requirement causes some firms to deploy
an electronic recordkeeping system that serves no purpose other than to
hold records in a manner that meets the Commission's regulatory
requirements for electronic recordkeeping systems.'' \65\ The
Commission further explained that the records stored on WORM-compliant
electronic recordkeeping systems are often retained in that particular
format solely for the purpose of meeting the WORM requirement (i.e.,
they are not the records and associated electronic recordkeeping
systems the firms use for business purposes). The Commission noted that
broker-dealers have explained to Commission staff that the electronic
recordkeeping systems used for business purposes are dynamic and
updated constantly (e.g., with each new transaction or position) and
easily accessible for retrieving records; whereas the WORM-compliant
electronic recordkeeping systems are more akin to static ``snapshots''
of the records at a point in time and less accessible.\66\ Broker-
dealers retrieve records from their business-based electronic
recordkeeping systems for their own purposes. In addition, the
Commission understood that firms generally retrieve and produce records
from their business-based electronic recordkeeping systems rather than
from their WORM-compliant electronic recordkeeping systems in response
to requests from securities regulators because these records are easier
to retrieve. The Commission further acknowledged that Commission staff
typically do not specifically request that records be produced from the
WORM-compliant recordkeeping system.\67\ The exception would be a case
where alteration is suspected. In that case, the staff would request
records from the WORM-compliant electronic recordkeeping system.
---------------------------------------------------------------------------

    \63\ Proposing Release, 86 FR at 68302.
    \64\ See Proposing Release, 86 FR at 68302, 68305.
    \65\ Rule 17a-4(f) Rulemaking Petition at 4 (``Today, WORM
systems are costly, outmoded, and inefficient storage containers
used exclusively to meet the rule's requirements.''); see also
Proposing Release, 86 FR 68305.
    \66\ See Rule 17a-4(f) Rulemaking Petition at 4 (``Data stored
in WORM is essentially a static snapshot of a record that is locked
and secured from any manipulation or deletion, as opposed to a
complete system that could be used to stand up a production system
during or following a disaster event.'').
    \67\ See also Rule 17a-4(f) Rulemaking Petition at 5 (``[O]ur
members report that regulators (including SEC and FINRA examiners
and enforcement staff) do not typically ask for production of
records from WORM storage because the information or data is not
readily sortable or searchable. Regulators instead request
customized extracts or views of data collected from active storage
systems where the record was originally created, that has not yet
been transferred to a WORM system.'').
---------------------------------------------------------------------------

    The objective of the proposed audit-trail requirement was to
provide an alternative to broker-dealers and nonbank SBS Entities that
permits them to preserve Broker-Dealer Regulatory Records and SBS
Regulatory Records, respectively, on the same electronic recordkeeping
system they use for business purposes, but also to require that the
system have the capacity to recreate an original record if it is
modified or deleted. This requirement was designed to provide the same
level of protection as the WORM requirement, which prevents records
from being altered, over-written, or erased. The principles-based
approach recommended by the commenters would not provide this level of
protection because it simply requires ``appropriate systems and
controls that ensure the authenticity and reliability of regulatory
records.'' \68\ The proposed amendments to Rules 17a-4 and 18a-6 and
the principles-based approach recommended by the commenters share an
objective: ensuring the authenticity and reliability of regulatory
records. However, the audit-trail requirement is more likely to achieve
this objective because, like the existing WORM requirement, it sets
forth a specific and testable outcome that the electronic recordkeeping
system must achieve: the ability to access and produce modified or
deleted records in their original form.
---------------------------------------------------------------------------

    \68\ See CFTC, Recordkeeping, 82 FR at 24486.
---------------------------------------------------------------------------

    The principles-based approach advocated by the commenters would not
ensure the authenticity or reliability of electronic records with the
same testable and specific outcome as the existing WORM requirement or
the audit-trail requirement the Commission is adopting. This is because
it would set forth a generalized standard for the electronic
recordkeeping system to ensure the authenticity and reliability of the
records: appropriate systems and controls. This approach focuses on the
design of the electronic recordkeeping system and unlike the audit-
trail or WORM requirement does not require a specific and testable
outcome that the system must achieve in terms of promoting the
authenticity and reliability of the records. Further, the design
requirement--appropriate systems and controls--may not set forth
obligations with respect to electronic recordkeeping that do not
already exist under the general record preservation requirements of
Rules 17a-4 and 18a-6. In particular, the broker-dealer or SBS Entity
must retain Broker-Dealer Regulatory Records and SBS Entity Regulatory
Records, respectively, in a manner that will enable the firm to produce
copies of original records during their retention periods. A failure to
be able to produce the records because, for example, they are

overwritten or lost would violate the existing preservation and prompt
production of records requirements of Rules 17a-4 and 18a-6.
Consequently, the systems and controls for preserving these records
must be appropriate to serve this purpose irrespective of whether the
records are stored in paper or electronic form. The audit-trail and
WORM requirements go a step further because they prescribe specific
outcomes the electronic recordkeeping system must achieve to promote
the authenticity and reliability of the records. Moreover, the audit-
trail requirement is designed to permit broker-dealers and SBS Entities
to use their existing business-purpose recordkeeping systems to achieve
the required outcome without specifying any particular technology
solution. In this way, the audit-trail requirement provides the
flexibility of a principles-based requirement by setting forth a high-
level outcome the electronic recordkeeping system must achieve without
prescribing how the system must be configured to meet that objective.
For these reasons, the final amendments include the audit-trail
requirement as an alternative to the WORM requirement.
    As proposed, to meet the audit-trail requirement, the electronic
recordkeeping system would need to maintain and preserve the records
for the duration of their applicable retention periods in a manner that
maintains a complete time-stamped audit trail that includes: (1) all
modifications to and deletions of a record or any part thereof; (2) the
date and time of operator entries and actions that create, modify, or
delete the record; (3) the individual(s) creating, modifying, or
deleting the record; and (4) any other information needed to maintain
an audit trail of each distinct record in a way that maintains
security, signatures, and data to ensure the authenticity and
reliability of the record and will permit re-creation of the original
record and interim iterations of the record.\69\
---------------------------------------------------------------------------

    \69\ See Proposing Release, 86 FR at 68306.
---------------------------------------------------------------------------

    One commenter stated that vendors ``typically already maintain the
audit trail logs with the data points described in the rule.'' \70\ In
response to the proposed components of the audit trail set forth in
items (2) and (3) above, another commenter stated that electronic
recordkeeping systems ``don't always record names [of individuals] but
always record a unique identifier that can be used to find the name''
and ``in many instances an automated system or process rather than a
natural person will be the actor.'' \71\ In response to this comment,
the final amendments eliminate the requirement that the audit trail
include the date and time of operator entries that create, modify, or
delete the record.\72\ The rules require the audit trail to include the
date and time of actions that create, modify, or delete the record, as
proposed. This requirement is intended to encompass both human-
initiated and automated actions that create, modify, or delete the
record. In further response to the comment, the final amendments
require that the audit trail include, if applicable, the identity of
the individual creating, modifying, or deleting the record.\73\ The
identity of the individual can be reflected in the audit trail as a
unique identifier for the individual.
---------------------------------------------------------------------------

    \70\ Letter from Adam Schaub, Vice President, RegEd, Jan. 3,
2022 (``RegEd Letter'').
    \71\ NRS Letter.
    \72\ See paragraph (f)(2)(i)(A)(2) of Rule 17a-4 and paragraph
(e)(2)(i)(A)(2) of Rule 18a-6, as amended.
    \73\ See paragraph (f)(2)(i)(A)(3) of Rule 17a-4 and paragraph
(e)(2)(i)(A)(3) of Rule 18a-6, as amended. As proposed, the audit
trail needed to include the individual(s) creating, modifying, or
deleting the record.
---------------------------------------------------------------------------

    Commenters also sought clarity about the scope of the audit-trail
requirement. One commenter asked when the audit trail must begin, and
provided the examples of making sequential entries onto a blotter and
of a draft blotter that does not become an ``official record of the
firm.'' \74\ Another commenter stated that ``[w]hile it is generally
possible to produce a log showing who has made specific changes at a
specific time, it may not always be possible for the means of
electronic recordkeeping to reproduce every version of a record that
has undergone changes at multiple points in time.'' \75\ A third
commenter suggested that broker-dealers should be permitted ``to
maintain a log of all changes to the record rather than requiring each
iteration of a record to be reproduced.'' \76\
---------------------------------------------------------------------------

    \74\ RegEd Letter.
    \75\ SIFMA Letter.
    \76\ American Funds Distributors Letter.
---------------------------------------------------------------------------

    As indicated above, the proposal specified that the audit trail
must include any other information needed to maintain an audit trail of
each distinct record in a way that maintains security, signatures, and
data to ensure the authenticity and reliability of the record and will
permit re-creation of the original record and interim iterations of the
record. The intent, however, was that the audit-trail requirement apply
to Broker-Dealer Regulatory Records (i.e., the records required to be
maintained and preserved pursuant to Rules 17a-3 and 17a-4) in the case
of broker-dealers, and SBS Entity Regulatory Records (i.e., the records
required to be maintained and preserved pursuant to Rules 18a-5 and
18a-6) in the case of SBS Entities. The proposed audit-trail
requirement was not intended to create new recordkeeping requirements
under Rules 17a-3 and 17a-4 or Rules 18a-5 and 18a-6. Although broker-
dealers and SBS Entities must comply with the individual records
requirements set forth in these rules, the audit-trail requirement
applies to the final records required pursuant to the rules, rather
than to drafts or iterations of records that would not otherwise be
required to be maintained and preserved under Rules 17a-3 and 17a-4 or
Rules 18a-5 and 18a-6.
    For example, paragraph (a)(1) of Rule 17a-3 requires a broker-
dealer to make and keep current blotters (or other records of original
entry) containing, among other information, an itemized daily record of
all purchases and sales of securities (including security-based swaps),
all receipts and deliveries of securities (including certificate
numbers), all receipts and disbursements of cash and all other debits
and credits. A broker-dealer's electronic recordkeeping system
throughout the day may constantly update the information used to create
these blotters as each new purchase, sale, receipt, or delivery of a
security is made. The broker-dealer, however, does not need to create
an audit trail for each iteration of this information when a new
purchase, sale, receipt, or delivery of a security is made during the
day because paragraph (a)(1) of Rule 17a-3 does not require these type
of records to be made and kept current.
    Instead, the rule requires blotters (or other records of original
entry) containing, among other information, an itemized daily record of
all purchases and sales of securities (including security-based swaps),
all receipts and deliveries of securities (including certificate
numbers). Thus, the broker-dealer must make and keep current a daily
record that reflects all transactions made throughout the day. It is
this daily record to which the audit-trail requirement applies. In
order to remove potential ambiguity in the rules on this point, the
final amendments eliminate the phrase ``and interim iterations of the
record.'' \77\
---------------------------------------------------------------------------

    \77\ See paragraph (f)(2)(i)(A)(4) of Rule 17a-4 and paragraph
(e)(2)(i)(A)(4) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

    For these reasons and the reasons stated in the proposing
release,\78\ the Commission is adopting amendments that add the audit-
trail requirement to Rule 17a-4(f) and the audit-trail and

WORM requirements to Rule 18a-6(e) with the modifications discussed
above.\79\ Under the final amendments, broker-dealers and nonbank SBS
Entities have the flexibility to preserve all of their electronic
Broker-Dealer Regulatory Records or SBS Entity Regulatory Records
either by: (1) using an electronic recordkeeping system that meets
either the audit-trail requirement or the WORM requirement; or (2)
preserving some electronic records using an electronic recordkeeping
system that meets the audit-trail requirement and preserving other
electronic records using an electronic recordkeeping system that meets
the WORM requirement.\80\
---------------------------------------------------------------------------

    \78\ See Proposing Release, 86 FR at 68305-06.
    \79\ See paragraphs (f)(2)(i)(A) and (B) of Rule 17a-4 and
paragraphs (e)(2)(i)(A) and (B) of Rule 18a-6, as amended. In
addition, to improve the readability of these paragraphs, the final
amendments consistently refer to a record in the singular by
replacing the phrase ``the records'' and word ``their'' in paragraph
(f)(2)(i)(A) of Rule 17a-4 and paragraph (e)(2)(i)(A) of Rule 18a-6,
as amended, with the phrase ``a record'' and the word ``its'',
respectively; replacing the word ``a'' in paragraph (f)(2)(i)(A)(1)
of Rule 17a-4 and paragraph (e)(2)(i)(A)(1) of Rule 18a-6, as
amended, with the word ``the''; and replacing the phrase ``each
distinct'' in paragraph (f)(2)(i)(A)(4) of Rule 17a-4 and paragraph
(e)(2)(i)(A)(4) of Rule 18a-6, as amended, with the word ``the''.
    \80\ For business reasons, broker-dealers and nonbank SBS
Entities may elect to use two recordkeeping systems: one that
complies with the audit-trail requirement and one that complies with
the WORM requirement. For example, a WORM-compliant electronic
recordkeeping system may be appropriate for certain types of records
such as emails. Further, a broker-dealer may choose to continue to
retain legacy Broker-Dealer Regulatory Records using a WORM-
compliant electronic recordkeeping system, while employing an audit
trail-compliant electronic recordkeeping system to preserve Broker-
Dealer Regulatory Records created or received after the system is
put in place.
---------------------------------------------------------------------------

    Finally, commenters asked how two Commission interpretations of the
WORM requirement would apply in light of the amendments to Rules 17a-
4(f) and 18a-6(e).\81\ The Commission's interpretations of the WORM
requirement were issued in 2003 and 2019.\82\ The 2003 interpretation
clarified that the WORM requirement does not mandate the use of optical
disks and, therefore, a broker-dealer can use ``an electronic storage
system that prevents the overwriting, erasing or otherwise altering of
a record during its required retention period through the use of
integrated hardware and software codes.'' \83\ The 2019 interpretation
further refined the 2003 interpretation. In particular, it noted that
the 2003 interpretation described a process of integrated software and
hardware codes and clarified that ``a software solution that prevents
the overwriting, erasing, or otherwise altering of a record during its
required retention period would meet the requirements of the rule.''
\84\ The Commission confirms that a broker-dealer or nonbank SBS Entity
can rely on the 2003 and 2019 interpretations with respect to meeting
the WORM requirement of Rule 17a-4(f) or 18a-6(e), as amended. Because
the 2003 and 2019 interpretations addressed the WORM requirement, they
are not relevant to the audit-trail requirement being adopted in this
document.
---------------------------------------------------------------------------

    \81\ See Committee of Annuity Insurers Letter; FSI Letter. See
also RegEd Letter (requesting that the Commission confirm whether
the 2003 interpretation will extend to the requirements for the
audit trail alternative).
    \82\ See Electronic Storage of Broker-Dealer Records, Exchange
Act Release No. 47806 (May 7, 2003), 68 FR 25281, (May 12, 2003)
(``Rule 17a-4(f) Interpretation''); SBSD/MSBSP Recordkeeping
Adopting Release, 84 FR at 68568.
    \83\ See Rule 17a-4(f) Interpretation, 68 FR at 25282.
    \84\ See SBSD/MSBSP Recordkeeping Adopting Release, 84 FR at
68568.
---------------------------------------------------------------------------

    A commenter also asked how Commission guidance with respect to Rule
17a-4(f) and the Electronic Signatures in Global and National Commerce
Act of 2000 (``ESIGN Act'') might be impacted by the amendments.\85\ In
2001, the Commission issued guidance that Rule 17a-4(f) was consistent
with the ESIGN Act.\86\ The final amendments to Rule 17a-4(f) do not
alter the rule in a way that would change this guidance.\87\ Moreover,
because Rule 18a-6(e) is closely modelled on Rule 17a-4(f), it also is
consistent with the ESIGN Act for the reasons set forth in the
Commission's 2001 guidance.
---------------------------------------------------------------------------

    \85\ See Committee of Annuity Insurers Letter. See also Public
Law 106-229, 114 Stat. 464 (2000).
    \86\ See Commission Guidance to Broker-Dealers on the Use of
Electronic Storage Media Under the Electronic Signatures in Global
and National Commerce Act of 2000 With Respect to Rule 17a-4(f),
Exchange Act Release No. 44238 (May 1, 2001), 66 FR 22916 (May 7,
2001).
    \87\ See id.
---------------------------------------------------------------------------

3. Verification Requirement
    The Commission proposed that the electronic recordkeeping system
used by a broker-dealer or nonbank SBS Entity must verify automatically
the completeness and accuracy of the processes for storing and
retaining records electronically.\88\ The requirement was designed to
ensure that when an original record is added to the electronic
recordkeeping system it is completely and accurately captured in the
system. The Commission received one comment on this proposed
requirement, stating, ``[I]t is appropriate to require an electronic
recordkeeping system to automatically verify the quality and accuracy
of the records being made.'' \89\ For the reasons stated in the
proposing release,\90\ the Commission is adopting the verification
requirements, as proposed.\91\
---------------------------------------------------------------------------

    \88\ See Proposing Release, 86 FR at 68306.
    \89\ See NRS Letter.
    \90\ See Proposing Release, 86 FR at 68306.
    \91\ See paragraph (f)(2)(ii) of Rule 17a-4 and paragraph
(e)(2)(ii) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

4. Serialization Requirement
    The Commission proposed to amend Rules 17a-4(f) and 18a-6(e) to
require, if applicable, that the electronic recordkeeping system
serialize the original and duplicate units of storage media, and time-
date the required period of retention for the information placed on
such electronic storage media.\92\ The Commission explained that this
requirement was limited to electronic recordkeeping systems that use
optical disks to meet the WORM requirement. A commenter stated ``that
the proposed addition of the `if applicable' modifier is beneficial and
removes the ambiguity of its application to systems without multiple
units of storage media.'' This commenter also argued, however, that
``specificity of the `serialize and time-date' requirements of the
existing and proposed rules are unnecessary and duplicative of the
requirements to produce the records and retain them for the proper
duration.'' \93\ The serialization and time-date requirements remain
necessary to the extent that optical disks are used to store records
electronically as the serial number and time-date stamp are used to
distinguish one disk from another and to associate the records stored
on the disk with that specific storage unit. For these reasons and the
reasons stated in the proposing release,\94\ the Commission is adopting
the serialization requirements, substantially as proposed.\95\
---------------------------------------------------------------------------

    \92\ See Proposing Release, 86 FR at 68306-07.
    \93\ See NRS Letter.
    \94\ See Proposing Release, 86 FR at 68306-07.
    \95\ See paragraph (f)(2)(iii) of Rule 17a-4 and paragraph
(e)(2)(iii) of Rule 18a-6, as amended. To improve the readability of
paragraph (f)(2)(iii) of Rule 17a-4 and paragraph (e)(2)(iii) of
Rule 18a-6, as amended, the Commission replaced the phrase ``and
time-date for the required period of retention the information
placed on such electronic storage media'' with the phrase ``and
time-date the required period of retention for the information
placed on such electronic storage media''.
---------------------------------------------------------------------------

5. Download and Transfer Requirement
    The Commission proposed to amend Rules 17a-4(f) and 18a-6(e) to
require that the electronic recordkeeping system must have the capacity
to readily download and transfer copies of a record and its audit trail
(if applicable) in both a human readable format and in a reasonably
usable electronic format, and to readily download and transfer

the information needed to locate the electronic record, as required by
the staffs of the Commission and other relevant securities
regulators.\96\ The Commission stated that a human readable format
would be a format that can be naturally read by an individual and that
a reasonably usable electronic format would be a format that is common
and compatible with commonly used systems for accessing and reading
electronic records. The Commission further explained that the
requirement to download and transfer audit trails would apply only if
the firm's electronic recordkeeping system uses the audit-trail
alternative and that the general reference to ``information needed to
locate the electronic record'' would be designed to incorporate
whatever means a particular electronic recordkeeping systems uses to
organize the records and locate a specific record (e.g., indexes or
data fields).
---------------------------------------------------------------------------

    \96\ See Proposing Release, 86 FR at 68307.
---------------------------------------------------------------------------

    One commenter, with respect to the reasonably usable electronic
format requirement, ``wholeheartedly agree[d] with the Commission's
goal of making this standard flexible and future-proof'' and stated
``that the Commission's Proposal achieves this goal.'' \97\ However,
the commenter further stated that ``nearly all electronic recordkeeping
systems will naturally provide either human readable or reasonably
usable electronic formats.'' \98\ Therefore, the commenter stated that
it would be ``burdensome'' and add ``unnecessary cost and complexity''
to require that an electronic recordkeeping system have the capacity to
produce a record in both formats. The commenter concluded by
recommending ``that the proposed amendment be changed to reflect that
electronic recordkeeping systems be required to have the capacity to
produce either human readable or reasonably usable electronic formats,
but not both.'' \99\ The commenter provided no data to quantify the
burden, cost, or complexity of the proposed requirement.
---------------------------------------------------------------------------

    \97\ NRS Letter.
    \98\ Id. (emphasis added).
    \99\ Id.
---------------------------------------------------------------------------

    The Commission believes that the capacity to produce records in
both formats is a necessary and important feature of electronic
recordkeeping systems in terms of the ability of the Commission and
other securities regulators being able to carry out their oversight
responsibilities. Depending on the nature and volume of records
requested by a securities regulator as part of an examination or
investigation, producing them in a human readable format that is not
also machine readable (e.g., a hard copy or pdf of a voluminous
spreadsheet) may hinder or delay the examination or investigation
because it would take more time to search the records for relevant
information; whereas producing electronic records in a reasonably
usable electronic format will permit the records to be searched and
sorted using a computer. Conversely, in other cases, it may be more
efficient to produce a record in a human readable format; for example,
if an examiner is on site and requests a specific record or if the
requested record is a policies and procedures manual. Further, Rules
17a-4 and 18a-6 currently require broker-dealers and SBS Entities,
respectively, to furnish promptly to a representative of the Commission
legible (i.e., capable of being read) copies of records.\100\
Consequently, an electronic recordkeeping system of a broker-dealer or
SBS Entity must have the capacity to readily download and transfer
copies of a record and its audit trail (if applicable) in a human
readable format to meet this existing obligation.
---------------------------------------------------------------------------

    \100\ See paragraph (j) of Rule 17a-4 and paragraph (g) of Rule
18a-6.
---------------------------------------------------------------------------

    For these reasons and the reasons stated in the proposing
release,\101\ the Commission is adopting the download and transfer
requirements, as proposed.\102\
---------------------------------------------------------------------------

    \101\ See Proposing Release, 86 FR at 68306-07.
    \102\ See paragraph (f)(2)(iv) of Rule 17a-4 and paragraph
(e)(2)(iv) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

6. Backup or Redundant Recordkeeping System
    Paragraph (f)(3)(iii) of Rule 17a-4 requires a broker-dealer to
store separately from the original, on any medium acceptable under Rule
17a-4, a duplicate copy of a record for the requisite time period.
Similarly, paragraph (e)(3)(iii) of Rule 18a-6 requires that an SBS
Entity store separately from the original a duplicate copy of a record
stored on the electronic storage system for the requisite time period.
These current provisions require broker-dealers and SBS Entities to
maintain a second copy of each record.
    The Commission proposed amendments to both of these paragraphs to
require the broker-dealer and the SBS Entity to have a backup
electronic recordkeeping system.\103\ As proposed, the broker-dealer or
SBS Entity would have needed to have a second electronic recordkeeping
system that preserves a second set of records that can be accessed and
examined if the primary electronic recordkeeping system storing the
primary set of records is disrupted, malfunctions, or otherwise becomes
inaccessible. The second electronic recordkeeping system would need to
meet the requirements of Rules 17a-4(f) and 18a-6(e), except that it
would not need a backup recordkeeping system. The records stored on the
backup electronic recordkeeping system would have been required to be
preserved in accordance with the record maintenance and preservation
requirements of Rule 17a-4 or 18a-6, as applicable. Among other
requirements, this would mean that the second set of records would have
been required to be preserved for their required retention periods.
---------------------------------------------------------------------------

    \103\ See Proposing Release, 86 FR at 68308.
---------------------------------------------------------------------------

    One commenter expressed support for the proposed requirement,
stating, ``[t]he proposal requiring the covered entities to maintain a
backup set of records is well taken and should be an existing practice
among broker-dealers for disaster recovery and business continuity
purposes.'' \104\ Other commenters stated that a backup electronic
recordkeeping system is not the only means of achieving redundancy of
the records.\105\ Another commenter stated that ``[a] `backup
electronic recordkeeping system' describes one of several methods of
records recovery in the event an electronic recordkeeping system is
disrupted, malfunctions, or otherwise becomes inaccessible.'' \106\
This commenter suggested that the rule text instead require that the
electronic recordkeeping system ``[m]aintain redundancies that provide
an alternative that meets the other requirements of [Rule 17a-4(f)] to
locate and re-create records, in the event the primary records required
to be maintained and preserved pursuant to Sec. Sec.  240.17a-3 and
240.17a-4 are unavailable.'' \107\ A different commenter stated that
the requirement for a backup electronic recordkeeping system should be
replaced with a requirement that ``the means of electronic
recordkeeping have fail-safes in place to ensure that records are
accessible at all times, including during an emergency or at a time of
significant business disruption.'' \108\ The commenter further stated
that the proposed requirement to maintain a separate backup system ``is
not technologically neutral, as there are currently other alternatives
available to ensure redundancy with respect to records in times of
stress'' and that ``the requirement undermines one of the

central goals of the Proposed Rules to permit Regulated Entities to
have a unified set of business records and regulatory records.'' \109\
---------------------------------------------------------------------------

    \104\ NCC Group Letter.
    \105\ See letter from Curtis Turnell, Compliance Program
Manager, Microsoft Corporation, Jan. 23, 2022 (``Microsoft
Letter''); SIFMA Letter.
    \106\ Microsoft Letter.
    \107\ Id.
    \108\ SIFMA Letter.
    \109\ Id.
---------------------------------------------------------------------------

    In response to these comments, the final amendments to Rules 17a-4
and 18a-6 provide the option to use either a backup recordkeeping
system or other redundancy capabilities.\110\ Further, the final
amendments make these technical requirements that the electronic
recordkeeping system itself must meet by relocating them to the
paragraphs of Rules 17a-4 and 18a-6 that set forth the technical
requirements for electronic recordkeeping systems.\111\ The Commission
views the means by which an electronic recordkeeping system achieves
redundancy as being part of this overall system. For example, in the
simplest case, a WORM-compliant electronic recordkeeping system may
create two copies on an optical disk with each disk containing the same
set of records. If the primary disk is corrupted, the secondary disk
can be used to access the records and to make an additional copy to
preserve a new backup. The primary and backup disks are part of the
hardware (storage media) of the electronic recordkeeping system.
Similarly, an electronic recordkeeping system may include a second
recordkeeping system that uses a different server or group of servers
to store a duplicate set of records. If one server or group of servers
fails, the overall system will switch to using the second (or backup)
recordkeeping system to access the records on the second server or
group of servers. Further, redundancy may be achieved in the manner in
which the electronic recordkeeping system stores information, such as
by using disk arrays. For these reasons, the final amendments require
the electronic recordkeeping system to include a backup recordkeeping
system or have other redundancy capabilities.
---------------------------------------------------------------------------

    \110\ See paragraph (f)(2)(v) of Rule 17a-4 and paragraph
(e)(2)(v) of Rule 18a-6, as amended.
    \111\ This modification is achieved by moving the requirement to
paragraph (f)(2) of Rule 17a-4 and paragraph (e)(2) of Rule 18a-6,
as amended. Under the proposal, the requirement to have a backup
recordkeeping system was in paragraph (f)(3) of Rule 17a-4 and
paragraph (e)(3) of Rule 18a-6, which set forth the requirements for
a broker-dealer or SBS Entity using an electronic recordkeeping
system. See Proposing Release, 86 FR at 68307. As discussed above,
paragraph (f)(2) of Rule 17a-4 and paragraph (e)(2) of Rule 18a-6
set forth the technical requirements for electronic recordkeeping
systems themselves, making these paragraphs the more appropriate
location for the backup/redundancy requirements. See id. at 68308.
In addition, placing this requirement in paragraph (e)(2) of Rule
18a-6 appropriately restricts the requirement to nonbank SBS
Entities.
---------------------------------------------------------------------------

    As indicated above, the electronic recordkeeping system must
include either a backup electronic recordkeeping system or other
redundancy capabilities. Under the proposal, the broker-dealer or SBS
Entity would have been required to maintain a backup electronic
recordkeeping system that meets the other requirements of Rule 17a-4(f)
or Rule 18a-6(e) (as applicable) and that retains the Broker-Dealer
Regulatory Records or SBS Entity Regulatory Records, respectively, in
accordance with Rule 17a-4(f) or Rule 18a-6(e) (as applicable).\112\
Commenters addressed this aspect of the proposal by stating that a
backup recordkeeping system--by itself--may not serve as a redundant
set of records.\113\ One of these commenters stated that ``for a
`backup electronic recordkeeping system' to be an effective recovery
method many dependencies must be considered, such as assuring
geographic dispersion.'' \114\ The other commenter stated that the
``rule does not, for example, discuss geographic or topological
disparity between the two copies.'' \115\ In response to these
comments, the final amendments modify the requirement to specify that
the backup electronic recordkeeping system must also retain the Broker-
Dealer Regulatory Records or SBS Entity Regulatory Records in a manner
that will serve as a redundant set of records if the original
electronic recordkeeping system is temporarily or permanently
inaccessible.\116\ In keeping with the objective of making the rules
technology neutral and able to adapt to new technologies, the final
amendments do not specify how the backup electronic recordkeeping
system must achieve this level of redundancy. However, sufficient
geographic separation of the hardware components of the primary and
backup electronic recordkeeping systems--as identified by commenters--
may be an aspect of achieving the redundancy required by the final
amendments. However a firm meets the redundancy requirement, the backup
electronic recordkeeping system must serve as a redundant set of
records if the original electronic recordkeeping system is temporarily
or permanently inaccessible because, for example, it is impacted by a
natural disaster or a power outage.
---------------------------------------------------------------------------

    \112\ See Proposing Release, 86 FR at 68308.
    \113\ See Microsoft Letter; NRS Letter.
    \114\ Microsoft Letter.
    \115\ NRS Letter.
    \116\ See paragraph (f)(2)(v)(A) of Rule 17a-4 and paragraph
(e)(2)(v)(A) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

    The second option under the final amendments relies on redundancy
capabilities that are designed to ensure access to Broker-Dealer
Regulatory Records or the SBS Entity Regulatory Records must have a
level of redundancy that is at least equal to the level that is
achieved through using a backup recordkeeping system.\117\ In other
words, this alternative requires a standard that ensures at least as
much access to Broker-Dealer Regulatory Records or SBS Entity
Regulatory Records as a backup recordkeeping system.
---------------------------------------------------------------------------

    \117\ For example, the redundancy capabilities should consider
taking into account fault tolerance. The National Institute of
Standards and Technology defines ``fault tolerance'' as ``[a]
property of a system that allows proper operation even if components
fail.'' See, e.g., Computer Security Resource Center, National
Institute of Standards and Technology, U.S. Department of Commerce
definition of ``fault tolerance''. Available at https://csrc.nist.gov/glossary/term/fault_tolerance.
---------------------------------------------------------------------------

    For these reasons and the reasons stated in the proposing
release,\118\ the Commission is adopting redundancy requirements with
the modifications discussed above.\119\
---------------------------------------------------------------------------

    \118\ See Proposing Release, 86 FR at 68308.
    \119\ See paragraph (f)(2)(v) of Rule 17a-4 and paragraph
(e)(2)(v) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

E. Requirements for Broker-Dealers and SBS Entities Using Electronic
Recordkeeping Systems

1. Applicability of the Requirements
    Paragraph (f)(3) of Rule 17a-4 and paragraph (e)(3) of Rule 18a-6
impose obligations on broker-dealers and SBS Entities, respectively,
related to their use of electronic recordkeeping systems. In general,
these requirements are designed to ensure that the staffs of the
Commission and other relevant securities regulators can access and
examine the records. The proposed amendments would have applied these
requirements to all broker-dealers and SBS Entities (i.e., both bank
and nonbank SBS Entities). Aside from comments on the specific
requirements discussed below, the Commission did not receive comments
on the applicability of paragraph (f)(3) of Rule 17a-4 and paragraph
(e)(3) of Rule 18a-6 to broker-dealers and SBS Entities.\120\ For the
reasons stated in the proposing release,\121\ the Commission is
adopting the amendments regarding the

applicability of the requirements, as proposed.\122\
---------------------------------------------------------------------------

    \120\ A commenter raised a concern that a proposed amendment to
paragraph (e)(3) of Rule 18a-6 could be read to impose a technical
requirement on electronic recordkeeping systems used by bank SBS
Entities, which would be contrary to the Commission's intent not to
impose such requirements on these entities. See SIFMA Letter. The
comment and the Commission's response to the comment are discussed
below in section II.E.4. of this release.
    \121\ See Proposing Release, 86 FR at 68307-08.
    \122\ See introductory text of paragraph (f)(3) of Rule 17a-4
and paragraph (e)(3) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

2. Facilities To Produce Records
    Paragraph (f)(3)(i) of Rule 17a-4 requires a broker-dealer to at
all times have available, for examination by Commission or SRO staff,
facilities for the immediate, easily readable projection or production
of micrographic media or electronic storage media images and for the
production of easily readable images. Similarly, paragraph (e)(3)(i) of
Rule 18a-6 requires an SBS Entity to at all times have available for
examination by Commission staff facilities for the immediate, easily
readable projection or production of records or images maintained on an
electronic storage system and for the production of easily readable
copies of those records or images.
    The Commission proposed amending these paragraphs to make them more
technology neutral.\123\ Under the amendments, broker-dealers and SBS
Entities would be required to have at all times available, for
examination by the staffs of the Commission and other relevant
securities regulators, facilities for immediate production of records
preserved by means of the electronic recordkeeping system and for
producing copies of those records.
---------------------------------------------------------------------------

    \123\ See Proposing Release, 86 FR at 68308. The proposed
amendments to paragraph (f)(3)(i) of Rule 17a-4 would have deleted
references to micrographic media and would have replaced terms that
are related to the use of micrographic media. Id. The amendments as
adopted transfer the current requirements for a broker-dealer
electing to use a micrographic media system from paragraph (f)(3) of
Rule 17a-4 to paragraph (f)(4) of that rule.
---------------------------------------------------------------------------

    One commenter stated that ``this proposed rule is unclear,
impractical, and inconsistent with general examination practices'' and
asked whether it requires broker-dealers to ``have one or more computer
workstations set aside for use by examiners'' that are ``able to access
all electronic recordkeeping systems.'' \124\ The commenter further
stated that the ``requirement for the broker-dealer to promptly deliver
requested records should be adequate to ensure that the DEA receives
the required information and afford the broker-dealer with an
opportunity to perform a privilege review before production.'' \125\
The commenter reiterated these comments with respect to the proposed
requirements of paragraph (f)(3)(ii) of Rule 17a-4 and paragraph
(e)(3)(ii) of Rule 18a-6 (discussed next) to the extent they required
the broker-dealer or SBS Entity to be ready at all times to provide,
and immediately provide, any information needed to locate records
stored by means of the electronic recordkeeping system that the staffs
of the Commission, SROs, and state securities regulators, as
applicable, may request.\126\
---------------------------------------------------------------------------

    \124\ NRS Letter.
    \125\ Id. (emphasis in original).
    \126\ See NRS Letter. See also sections II.E.3. and II.E.5. of
this release (discussing the proposals regarding information
necessary to locate records stored on an electronic recordkeeping
system).
---------------------------------------------------------------------------

    In proposing the amendments to paragraph (f)(3)(i) of Rule 17a-4
and paragraph (e)(3)(i) of Rule 18a-6, the Commission stated that the
``objective is to set forth new requirements that would require broker-
dealers and SBS Entities to have facilities available to produce
records to the staffs of the Commission, SROs, and state securities
regulators, as applicable, and to read records stored on an electronic
recordkeeping system.'' \127\ The objective was not to alter how the
Commission staff or other securities regulators conduct examinations.
In the normal course, the facilities will typically be used by the
broker-dealer or SBS Entity to produce the records and not by the
examiners to review the records, so the use of the broker-dealer's or
SBS Entity's facilities to review the records will not be necessary.
However, there may be instances where the Commission staff or other
securities regulators may need to use the facilities to access the
records. For example, if the broker-dealer or SBS Entity fails
financially and no longer has sufficient staff available to respond to
requests to produce records, the Commission staff may need to use the
facilities to access the records or request an executive officer or
third party to use the facilities to produce the records immediately to
Commission staff or other securities regulators so that the examination
or other use of the records by the Commission staff is not
delayed.\128\ Further, in order to access the records, the Commission
staff will need the information necessary to locate the records.
---------------------------------------------------------------------------

    \127\ Proposing Release, 86 FR 68308.
    \128\ As discussed in section II.E.6. of this release, broker-
dealers and SBS Entities will need to designate an executive officer
or third party to undertake, among other things, to furnish promptly
to the Commission and other securities regulators information
necessary to download copies of a record and its audit trail (if
applicable) and to take reasonable steps to download the record and
audit trail.
---------------------------------------------------------------------------

    For these reasons and the reasons stated in the proposing
release,\129\ the Commission is adopting the facilities requirements,
substantially as proposed.\130\
---------------------------------------------------------------------------

    \129\ See Proposing Release, 86 FR 68308.
    \130\ See paragraph (f)(3)(i) of Rule 17a-4 and paragraph
(e)(3)(i) of Rule 18a-6, as amended. To improve the readability of
paragraph (f)(3)(i) of Rule 17a-4 and paragraph (e)(3)(i) of Rule
18a-6, as amended, the Commission is replacing the phrase
``facilities for immediate production of records preserved by means
of the electronic recordkeeping system and for producing copies of
those records'' with the phrase ``facilities for immediately
producing the records preserved by means of the electronic
recordkeeping system and for producing copies of those records''. As
discussed in section II.E.5. of this release, the Commission also is
adopting the requirement with respect to producing the information
necessary to locate the records in other paragraphs of Rules 17a-4
and 18a-6.
---------------------------------------------------------------------------

3. Ability To Provide Records Stored Electronically
    Paragraph (f)(3)(ii) of Rule 17a-4 requires a broker-dealer to be
ready at all times to provide, and immediately provide, any facsimile
enlargement that the staff of the Commission, an SRO, or state
securities regulator may request. Similarly, paragraph (e)(3)(ii) of
Rule 18a-6 requires that an SBS Entity be ready at all times to
immediately provide in a readable format any record or index stored on
the electronic storage system that the staff of the Commission
requests.
    The Commission proposed amendments to both of these paragraphs to
require the broker-dealer and the SBS Entity to be ready at all times
to provide records stored on an electronic recordkeeping system and
related information.\131\ In particular, the current text of both
paragraphs would have been replaced with new text requiring that the
broker-dealer or SBS Entity be ready at all times to provide, and
immediately provide, any (1) record or (2) information needed to locate
records stored by means of the electronic recordkeeping system that the
staffs of the Commission, SROs, and state securities regulators, as
applicable, may request. One commenter that raised the concern that the
facilities requirement discussed above would alter how the Commission
and other securities regulators perform examinations reiterated that
concern with this proposed requirement to the extent it required the
production of information needed to locate records.\132\ The final
amendments eliminate the information needed to locate records
requirement from paragraph (f)(3)(ii) of Rule 17a-4 and paragraph
(e)(3)(ii) of Rule 18a-6, as amended, because it is duplicative of a
requirement in paragraph (f)(3)(iv) of Rule 17a-4 and paragraph
(e)(3)(iv) of

Rule 18a-6, as amended.\133\ Consequently, the requirements of
paragraph (f)(3)(ii) of Rule 17a-4 and paragraph (e)(3)(ii) of Rule
18a-6, as amended, are limited to addressing the production of a record
and do not address the production of information needed to locate a
record.
---------------------------------------------------------------------------

    \131\ See Proposing Release, 86 FR at 68308.
    \132\ See NRS Letter. This comment is addressed in section
II.E.2. of this release.
    \133\ As discussed in section II.E.5. of this release, the final
amendments consolidate the requirements relating to information
needed to access and locate records preserved by means of an
electronic recordkeeping system in paragraph (f)(3)(iv) of Rule 17a-
4 and paragraph (e)(3)(iv) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

    For these reasons and the reasons stated in the proposing
release,\134\ the Commission is adopting the requirement that broker-
dealers and SBS Entities be ready to provide a record with the
modification discussed above.\135\
---------------------------------------------------------------------------

    \134\ See Proposing Release, 86 FR at 68308.
    \135\ See paragraph (f)(3)(i) of Rule 17a-4 and paragraph
(e)(3)(i) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

4. Accountability Regarding Inputting of Records
    Paragraph (f)(3)(v) of Rule 17a-4 and paragraph (e)(3)(v) of Rule
18a-6 require broker-dealers and SBS Entities, respectively, to have in
place an audit system providing for accountability regarding inputting
of Broker-Dealer Regulatory Records or SBS Entity Regulatory Records to
electronic storage media (in the case of Rule 17a-4(f)) and the
electronic storage system (in the case of Rule 18a-6(e)) and inputting
of any changes made to every original and duplicate record maintained
and preserved thereby. The paragraphs further require that the broker-
dealer or SBS Entity must be able to have the results of such audit
system available for examination by the staff of the Commission and
that the audit results must be preserved for the time required for the
audited records. The requirements of paragraph (f)(3)(v) of Rule 17a-4
were designed to address electronic recordkeeping systems that use
technology that is WORM-compliant. The requirements of paragraph
(e)(3)(v) of Rule 18a-6 were modelled closely on paragraph (f)(3)(v) of
Rule 17a-4 even though Rule 18a-6(e) did not include the WORM
requirement when it was adopted.\136\
---------------------------------------------------------------------------

    \136\ See SBSD/MSBSP Recordkeeping Proposing Release, 79 FR at
25219; SBSD/MSBSP Recordkeeping Adopting Release, 84 FR at 68567-69.
---------------------------------------------------------------------------

    The Commission proposed to replace the existing requirements of
paragraph (f)(3)(v) of Rule 17a-4 and paragraph (e)(3)(v) of Rule 18a-6
with a requirement that the broker-dealer or SBS Entity have in place
an auditable system of controls that records, among other things: (1)
each input, alteration, or deletion of a record; (2) the names of
individuals inputting, altering, or deleting a record; and (3) the date
and time such individuals input, altered, or deleted the record.\137\
As used in the proposed text, the phrase ``auditable system of
controls'' would have meant a system of controls that is documented and
can be audited by internal or external examiners to determine whether
the controls are operating as would be required by the rule.\138\
---------------------------------------------------------------------------

    \137\ See Proposing Release, 86 FR at 68309.
    \138\ See id.
---------------------------------------------------------------------------

    Commenters expressed concern that the proposed amendments to
paragraph (f)(3)(v) of Rule 17a-4 and paragraph (e)(3)(v) of Rule 18a-6
would be duplicative of the audit-trail requirement.\139\ A commenter
stated that the proposed new requirements would impose requirements
``nearly identical'' to the proposed new audit trail requirements of
paragraph (f)(2)(i) of Rule 17a-4 and paragraph (e)(2)(i) of Rule 18a-
6.\140\ The commenter further stated that the requirements of paragraph
(e)(3)(v) as of Rule 18a-6, as proposed to be amended, would ``impose
on bank SBS Entities many of the same technical requirements to
maintain an audit trail that [would] apply to non-bank SBS Entities
under [Rule]18a-6(e)(2)'' as proposed to be amended.\141\ The commenter
therefore suggested that the requirements be ``deleted'' or, in the
alternative, that bank SBS Entities be excluded from having to comply
with them.\142\
---------------------------------------------------------------------------

    \139\ See SIFMA Letter; RegEd Letter (expressing agreement with
the SIFMA Letter).
    \140\ SIFMA Letter.
    \141\ Id.
    \142\ See id.
---------------------------------------------------------------------------

    The Commission agrees that the audit-trail requirement, as proposed
and adopted, will achieve the same results as the proposed amendments
to paragraph (f)(3)(v) of Rule 17a-4 and paragraph (e)(3)(v) of Rule
18a-6. As discussed above, under the audit-trail requirement, a broker-
dealer or nonbank SBS Entity must use an electronic recordkeeping
system that preserves a record for the duration of its applicable
retention period in a manner that maintains a complete time-stamped
audit trail that includes: (1) all modifications to and deletions of
the record or any part thereof; (2) the date and time of actions that
create, modify, or delete the record; (3) if applicable, the identity
of the individual creating, modifying, or deleting the record; and (4)
any other information needed to maintain an audit trail of the record
in a way that maintains security, signatures, and data to ensure the
authenticity and reliability of the record and will permit re-creation
of the original record if it is modified or deleted.\143\ Consequently,
the electronic recordkeeping system must generate the same type of
information that paragraph (f)(3)(v) of Rule 17a-4 and paragraph
(e)(3)(v) of Rule 18a-6, as proposed, would have required the broker-
dealer or SBS Entity to generate separately from the electronic
recordkeeping system.
---------------------------------------------------------------------------

    \143\ See paragraph (f)(2)(i) of Rule 17a-4 and paragraph
(e)(2)(i) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

    However, as discussed above,\144\ WORM-compliant electronic
recordkeeping systems are not required to generate records of every
iteration of every required record, and may in fact not be capable of
generating every iteration. Consequently, the final amendments maintain
the existing requirement on broker-dealers and nonbank SBS Entities
with respect to their use of WORM-compliant recordkeeping systems by
retaining the existing text of the rules, which--in the case of Rule
17a-4(f)--was adopted to address the use of WORM-compliant electronic
recordkeeping systems and has been a requirement since 1997.\145\
Therefore, a broker-dealer or nonbank SBS Entity using a WORM-compliant
electronic recordkeeping system will need to generate this information.
The requirements do not apply with respect to an electronic
recordkeeping system that complies with the audit-trail requirement.
Nor do they apply to bank SBS Entities because they are not required to
use a WORM-compliant electronic recordkeeping system (or an audit-trail
compliant electronic recordkeeping system).\146\
---------------------------------------------------------------------------

    \144\ See section II.D.2 of this release (discussing these
amendments in more detail).
    \145\ See Rule 17a-4(f) Adopting Release, 62 FR 6496.
    \146\ See paragraph (f)(3)(iii) of Rule 17a-4 and paragraph
(e)(3)(iii) of Rule 18a-6, as amended. As adopted, each paragraph
contains an introductory clause stating that the requirements set
forth in the paragraph apply to broker-dealers or SBS Entities
operating pursuant to paragraph (f)(2)(i)(B) of Rule 17a-4 or
paragraph (e)(2)(i)(B) of Rule 18-6, respectively, which set forth
the WORM alternative. As discussed in section II.E.1. of this
release, bank SBS Entities are not subject to the requirements of
paragraph (e)(2) of Rule 18a-6 and, therefore, will not be operating
pursuant to paragraph (e)(2)(i)(B) of that rule.
---------------------------------------------------------------------------

    For these reasons, the Commission is not adopting the proposed
amendments to paragraph (f)(3)(v) of Rule 17a-4 and paragraph (e)(3)(v)
of Rule 18a-6 and, instead, is retaining the existing text of the rules
with certain modifications.\147\
---------------------------------------------------------------------------

    \147\ See paragraph (f)(3)(iii) of Rule 17a-4 and paragraph
(e)(3)(iii) of Rule 18a-6, as amended. Under the final amendments,
both paragraphs use the term ``electronic recordkeeping system''
rather than the existing terms ``electronic storage media'' in the
case of Rule 17a-4(f) and ``electronic storage system'' in the case
of Rule 17a-6(e). See section II.B. of this release (discussing the
definition of ``electronic recordkeeping system''). Finally, both
paragraphs have been re-lettered from paragraphs (f)(3)(v) and
(e)(3)(v) to paragraphs (f)(3)(iii) and (e)(3)(iii), respectively,
because the requirements in paragraphs (f)(3)(iii) and (e)(3)(iii),
as proposed, relating to a backup recordkeeping system were moved to
paragraphs (f)(2) and (e)(2), respectively, and the requirements in
paragraphs (f)(3)(iv) and (e)(3)(iv), as proposed, relating to
information needed to locate electronic records were consolidated
with the requirements in paragraphs (f)(3)(vi) and (e)(3)(vi), as
proposed, respectively. See sections II.D.6. and II.D.5. of this
release (discussing, respectively, the modifications to paragraph
(f)(3)(iii) of Rule 17a-4 and paragraph (e)(3)(iii) of Rule 18a-6,
as proposed, and paragraph (f)(3)(iv) of Rule 17a-4 and paragraph
(e)(3)(iv) of Rule 18a-6, as proposed).

---------------------------------------------------------------------------

5. Information To Access and Locate Records
    As discussed above, paragraph (f)(3)(ii) of Rule 17a-4 and
paragraph (e)(3)(ii) of Rule 18a-6, as proposed, would have required a
broker-dealer or SBS Entity, respectively, to, among other things, be
ready at all times to provide, and immediately provide, any (1) record
and (2) information needed to locate records stored by means of the
electronic recordkeeping system that the staffs of the Commission or
other relevant securities regulators may request.\148\ As discussed
above, paragraph (f)(3)(ii) of Rule 17a-4 and paragraph (e)(3)(ii) of
Rule 18a-6, as amended, address the production of a record but not the
production of information needed to locate records. Instead, as
discussed below, the final amendments consolidate requirements that
address information needed to locate records stored electronically into
single paragraphs in Rules 17a-4 and 18a-6.
---------------------------------------------------------------------------

    \148\ See section II.E.3. of this release (discussing these
amendments in more detail).
---------------------------------------------------------------------------

    Paragraph (f)(3)(iv) of Rule 17a-4 establishes a series of
obligations relating to the indexing of Broker-Dealer Regulatory
Records. Paragraph (e)(3)(iv) of Rule 18a-6 establishes similar
requirements relating to the indexing of SBS Entity Regulatory Records.
The Commission proposed to amend these paragraphs to impose obligations
on broker-dealers and SBS Entities to organize and maintain information
necessary to locate records stored on their electronic recordkeeping
systems without mandating the use of indexes.\149\ Under the
amendments, a broker-dealer or SBS Entity using an electronic
recordkeeping system would have been required to organize and maintain
information necessary to locate records maintained by the electronic
recordkeeping system.\150\ A commenter stated that this proposal was
``clear and appropriate and will provide broker-dealers the flexibility
to implement any method of cataloguing their records.'' \151\
---------------------------------------------------------------------------

    \149\ See Proposing Release, 86 FR at 68309.
    \150\ See Proposing Release, 86 FR at 68309, note 75.
    \151\ NRS Letter.
---------------------------------------------------------------------------

    Paragraph (f)(3)(vi) of Rule 17a-4 and paragraph (e)(3)(vi) of Rule
18a-6 require a broker-dealer and an SBS Entity, respectively, to
maintain, keep current, and provide promptly upon request by the staffs
of the Commission or an SRO, if applicable, all information necessary
to access records and indexes stored on the electronic storage media;
or place in escrow and keep current a copy of the physical and logical
file format of the electronic storage media, the field format of all
different information types written on the electronic storage media and
the source code, together with the appropriate documentation and
information necessary to access records and indexes. The Commission
proposed to eliminate the escrow account option from these
paragraphs.\152\ The Commission proposed to retain the requirement that
the broker-dealer or SBS Entity maintain, keep current, and provide
promptly upon request by the Commission, SROs, and state securities
regulators, as applicable, all information necessary to access and
locate records preserved by means of the electronic recordkeeping
system. No comments were received on these proposed amendments.
---------------------------------------------------------------------------

    \152\ See Proposing Release, 86 FR at 68309.
---------------------------------------------------------------------------

    To improve the clarity of the rules and eliminate potentially
redundant requirements, the final amendments consolidate the proposed
requirements discussed above in a single paragraph. Under the
amendments, a broker-dealer and SBS Entity must organize, maintain,
keep current, and provide promptly upon request by the staffs of the
Commission or other relevant securities regulators all information
necessary to access and locate records preserved by means of the
electronic recordkeeping system.\153\
---------------------------------------------------------------------------

    \153\ See paragraph (f)(3)(iv) of Rule 17a-4 and paragraph
(e)(3)(iv) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

    As discussed above, a commenter raised a concern that requiring
broker-dealers to produce information needed to locate records to the
Commission staff and other securities regulators could alter the
existing examination process.\154\ The final amendments, which, as
explained above, do not directly alter the examination process and are
not designed to otherwise change the examination process, retain the
production requirement relating to providing information needed to
locate electronic records for reasons discussed above.\155\ As
described in the proposing release, the more general reference to
``information needed to locate the electronic record'' is designed to
incorporate whatever means a particular electronic recordkeeping system
uses to organize the records and locate a specific record (e.g.,
indexes or data fields).\156\ For these reasons, the Commission is
adopting the proposed requirements with respect to the information
necessary to locate electronic records with modifications discussed
above.\157\
---------------------------------------------------------------------------

    \154\ See NRS Letter.
    \155\ See section II.E.2. of this release (discussing the
comment and the Commission's response to the comment).
    \156\ See Proposing Release, 86 FR at 68307.
    \157\ See paragraph (f)(3)(iv) of Rule 17a-4 and paragraph
(e)(3)(iv) of Rule 18a-6, as amended.
---------------------------------------------------------------------------

6. Designated Executive Officer or Third Party
    Paragraph (f)(3)(vii) of Rule 17a-4 provides that, for a broker-
dealer exclusively using electronic storage media for some or all of
its record preservation, at least one third party, who has access to
and the ability to download information from the broker-dealer's
electronic storage media to any acceptable medium under Rule 17a-4,
must file with the DEA for the broker-dealer certain undertakings. The
required text of the undertakings are set forth in the rule. They
require the third party to undertake: (1) to furnish promptly to the
Commission, the broker-dealer's SRO(s), and state securities regulators
having jurisdiction over the broker-dealer (collectively, the
``securities regulators''), upon reasonable request, such information
as is deemed necessary by the securities regulators to download
information kept on the broker-dealer's electronic storage media to any
medium acceptable under Rule 17a-4; and (2) to take reasonable steps to
provide access to information contained on the broker-dealer's
electronic storage media, including, as appropriate, arrangements for
the downloading of any record required to be maintained and preserved
by the broker-dealer pursuant to Rules 17a-3 and 17a-4 in a format
acceptable to the securities regulators. The rule further provides that
these arrangements must provide specifically that in the event of a
failure on the part of a broker-dealer to download the record into a
readable format and after reasonable notice to the broker-dealer, upon
being provided with the appropriate electronic storage medium, the
third party will undertake

to do so, as the securities regulators may request.
    The Commission proposed to amend paragraph (f)(3)(vii) of Rule 17a-
4 to replace the third-party undertakings requirement with a senior
officer undertakings requirement.\158\ In proposing this modification,
the Commission noted that commenters stated during the rulemaking for
Rule 18a-6(e) that the requirement ``was outdated in light of the
changed technological environment'' and that providing a third party
access to electronic recordkeeping systems and client information
``needlessly exposes firms to data leakage and cybersecurity threats.''
\159\ The proposed amendments to paragraph (f)(3)(vii) of Rule 17a-4
also would have modified the second undertaking so that it would have
been triggered if the broker-dealer failed to provide records and, if
applicable, associated audit trails stored on the electronic
recordkeeping system.\160\ Rule 18a-6(e) did not include the third-
party undertakings requirement. The proposed amendments to Rule 18a-
6(e) would have added the senior officer undertakings requirement to
the rule.\161\ However, the undertakings would have been required to be
filed with the Commission (rather than a DEA) because SBS Entities do
not have a DEA.
---------------------------------------------------------------------------

    \158\ See Proposing Release, 86 FR at 68310-11.
    \159\ Proposing Release, 86 FR at 68310. See also SBSD/MSBSP
Recordkeeping Adopting Release, 84 FR at 68569.
    \160\ See Proposing Release, 86 FR at 68311. The Commission
proposed a number of additional amendments to the form of the
undertakings to improve their readability and conform them to other
proposed amendments (e.g., using the term ``electronic recordkeeping
system'' instead of the term ``electronic storage media'' and
requirements to produce a record and its audit trail in a human
readable format or a reasonably usable electronic format). See
Proposing Release, 86 FR at 68310, note 86.
    \161\ See Proposing Release, 86 FR at 68311.
---------------------------------------------------------------------------

    One commenter expressed general support for the proposal.\162\ Four
commenters suggested clarifying the proposal to specify that broker-
dealers and SBS Entities should be allowed to designate more than one
senior officer to complete the proposed undertakings.\163\ One of these
commenters stated that doing so would ``provid[e] leeway to firms to
account for personnel location changes, vacation scheduling, remote
working and succession planning.'' \164\ Two commenters noted that the
term ``senior officer'' could be confusing, as the term is used in
other regulatory contexts.\165\ One of these commenters suggested using
the term ``designated officers,'' \166\ while the other suggested
``designated head or heads.'' \167\
---------------------------------------------------------------------------

    \162\ See letter from Robert Laorno, General Counsel, ICE Bonds
Securities Corporation, Dec. 14, 2021 (``ICE Bonds Letter'').
    \163\ See Fidelity Letter; NRS Letter; RegEd Letter; SIFMA
Letter.
    \164\ Fidelity Letter.
    \165\ See Fidelity Letter; SIFMA Letter.
    \166\ SIFMA Letter.
    \167\ Fidelity Letter.
---------------------------------------------------------------------------

    Commenters also suggested modifying the proposed senior officer
undertakings requirements to explicitly allow for the designation or
delegation of responsibility.\168\ Two of these commenters expressed
concern that the language as proposed would require technical expertise
not usually expected in a senior officer position.\169\ One of these
commenters stated that the proposed language ``implies that the
[designated] individual or individuals will have every password as well
as personal knowledge of every repository that may hold records of the
Regulated Entity'' and that this would be ``an unrealistic expectation
of a senior person in a large organization.'' \170\
---------------------------------------------------------------------------

    \168\ See American Funds Distributors Letter; ICE Bonds Letter;
SIFMA Letter.
    \169\ See American Funds Distributors Letter; SIFMA Letter.
    \170\ SIFMA Letter.
---------------------------------------------------------------------------

    Commenters expressed concerns with replacing the third-party
undertakings requirement with the senior officer undertakings
requirement.\171\ One of these commenters stated that ``the designated
third party is a critical component of Rule 17a-4 which helps to ensure
timely access to records if requested by a regulator'' and that the
requirement ``creates a clear incentive for full cooperation from
broker-dealers at the outset by providing an alternative and
independent means to access records if the broker-dealer fails to do
so.'' \172\ A second commenter stated that the ``real value [of
designated third-party use] for clients is in our regular meetings in
which the client's compliance and [information technology] IT teams are
brought together to discuss and ensure,'' among other things, that the
client understands ``how electronic compliance records are retained
internally including access, Rule 17a-4(f) requirements, disposition,
and a review of legal holds,'' and that it ``follow[s] industry `best
practices' as to collection and capture of metadata.'' \173\ This
commenter further stated that ``an independent 3rd party working
together with both IT and compliance teams provides a valuable service
to financial institutions and their respective DEAs.'' A third
commenter stated that ``the Commission should consider providing firms
with the option to either have a senior officer sign an undertaking or
provide an undertaking by a third party, if that third party will also
be maintaining those records on behalf of the firm.'' \174\
---------------------------------------------------------------------------

    \171\ See letter from Douglas Weeden, Managing Director, 17a-4,
LLC, Jan, 3, 2022 (``17a-4, LLC Letter''); NCC Group Letter; RegEd
Letter.
    \172\ NCC Group Letter.
    \173\ 17a-4, LLC Letter.
    \174\ RegEd Letter.
---------------------------------------------------------------------------

    In response to the comments, the final amendments to Rules 17a-4(f)
and 18a-6(e) require a broker-dealer or SBS Entity to designate either
an executive officer of the firm (``Designated Executive Officer'') or
an unaffiliated third-party (``Designated Third Party'') to make the
required undertakings. For example, some firms may choose the
Designated Executive Officer option for cyber-security reasons because
these firms prefer to make this an internal function. Other firms may
elect the Designated Third-Party Option because they prefer to
outsource this function. Firms may elect to outsource this function
because they are comfortable with how the Designated Third-Party
manages cybersecurity risk and because they may use that entity for
other record custodial services.
    The Designated Executive Officer replaces the role of the ``senior
officer,'' an undefined term introduced in the proposed rule
amendments. The Designated Executive Officer must be a member of senior
management of the broker-dealer or SBS Entity who has access to and the
ability to provide the records of the firm maintained and preserved on
the firm's electronic recordkeeping system. Further, the Designated
Executive Officer can appoint in writing up to two employees and three
specialists to assist the Designated Executive Officer in fulfilling
the officer's obligations set forth in the undertakings.
    Therefore, under the final amendments a broker-dealer or SBS Entity
has the option to designate an executive officer to make the required
undertakings in lieu of designating a third party.\175\ A Designated
Executive Officer must be a member of senior management of the broker-
dealer or SBS Entity who has access to and the ability to provide
records maintained and preserved on the electronic recordkeeping system
either directly or through a designated specialist who reports directly
or indirectly to the Designated Executive Officer.\176\ As proposed,
the amendments would have required the senior officer to have

independent access to the records.\177\ The Commission explained that
``[i]ndependent access would mean the senior officer has the knowledge,
credentials, and information necessary to access and provide the
records without having to rely on other individuals at the firm.'' A
Designated Executive Officer under the final amendments, however, must
have access and the ability to provide the records either directly or
through a designated specialist who reports directly or indirectly to
the officer. The final amendments permit the Designated Executive
Officer to appoint in writing up to three designated specialists.\178\
A designated specialist must be an employee of the broker-dealer or SBS
Entity who has access to and the ability to provide records maintained
and preserved on the electronic recordkeeping system.\179\
Consequently, under the final amendments, the Designated Executive
Officer either must have the knowledge, credentials, and information
necessary to access and provide the records without having to rely on
other individuals at the firm or have appointed in writing up to three
designated specialists who have such knowledge, credentials, and
information and that are direct or indirect reports to the officer. In
this way, the Designated Executive Officer's access can be achieved
through the officer's ability to direct a designated specialist to
access and provide the records.
---------------------------------------------------------------------------

    \175\ See paragraph (f)(3)(v)(A) of Rule 17a-4 and paragraph
(e)(3)(v)(A) of Rule 18a-6, as amended.
    \176\ See paragraph (f)(1)(iii) of Rule 17a-4 and paragraph
(e)(1)(ii) of Rule 18a-6, as amended (defining the term ``designated
executive officer'').
    \177\ See Proposing Release, 86 FR at 68311.
    \178\ See paragraph (f)(3)(v)(B)(2) of Rule 17a-4 and paragraph
(e)(3)(v)(B)(2) of Rule 18a-6, as amended.
    \179\ See paragraph (f)(1)(v) of Rule 17a-4 and paragraph
(e)(1)(iv) of Rule 18a-6, as amended (defining the term ``designated
specialist'').
---------------------------------------------------------------------------

    Under the final amendments, the Designated Executive Officer also
can appoint in writing up to two designated officers who will take the
steps necessary to fulfill the obligations of the Designated Executive
Officer set forth in the undertakings in the event the Designated
Executive Officer is unable to fulfill those obligations.\180\ A
designated officer must be an employee of the broker-dealer or SBS
Entity who reports directly or indirectly to the Designated Executive
Officer and who has access to and the ability to provide records
maintained and preserved on the electronic recordkeeping system either
directly or through a designated specialist who reports directly or
indirectly to the designated officer.\181\ As is required of the
Designated Executive Officer, the designated officer either must have
the knowledge, credentials, and information necessary to access and
provide the records without having to rely on other individuals at the
firm or be able to direct a designated specialist who has such
knowledge, credentials, and information.
---------------------------------------------------------------------------

    \180\ See paragraph (f)(3)(v)(B)(1) of Rule 17a-4 and paragraph
(e)(3)(v)(B)(1) of Rule 18a-6, as amended.
    \181\ See paragraph (f)(1)(iv) of Rule 17a-4 and paragraph
(e)(1)(iii) of Rule 18a-6, as amended (defining ``designated
officer'').
---------------------------------------------------------------------------

    The final amendments provide that the Designated Executive
Officer's appointment of, or reliance on, a designated officer or
designated specialist does not relieve the Designated Executive Officer
of the obligations set forth in the undertakings.\182\ The Designated
Executive Officer is at all times responsible for fulfilling the
obligations set forth in the undertakings either directly or through a
designated officer or specialist regardless of any actions taken by a
designated officer or designated specialist in response to a request of
the Commission or other relevant securities regulator that the
Designated Executive Officer fulfill an obligation set forth in the
undertakings. In response to the comment that it would be ``an
unrealistic expectation of a senior person in a large organization'' to
``have every password as well as personal knowledge of every repository
that may hold records of the Regulated Entity,'' \183\ the Commission
believes that the Designated Executive Officer of a broker-dealer or
SBS Entity should have information about every repository that the firm
may employ for the purpose of holding the firm's records pursuant to
the requirements of Rule 17a-4(f) or 18a-6(e). Otherwise, this
individual may not be able to fulfill directly or indirectly the
obligations in the undertaking with respect to the records stored at