Broker Dealer Record Retention Guide for Firms

A broker-dealer’s records are not merely evidence of activity after the fact. They are the operating record regulators use to assess whether the firm supervised its business, protected customer information, calculated capital correctly, and met its obligations when decisions were made. This broker dealer record retention guide provides a practical framework for organizing those duties before an examination, inquiry, or dispute exposes a gap.

The governing requirements are spread across SEC rules, FINRA rules, Bank Secrecy Act requirements, and the firm’s own written supervisory procedures. The result is not a single retention schedule that can be copied into a policy. A workable program must identify each record class, assign a required retention period, preserve records in a compliant format, and establish accountable review of the process.

Broker Dealer Record Retention Guide: The Regulatory Baseline

For most FINRA member firms, the starting point is Securities Exchange Act Rules 17a-3 and 17a-4. Rule 17a-3 specifies books and records that broker-dealers must create. Rule 17a-4 addresses how long those records must be preserved and the manner of preservation. FINRA Rule 4511 separately requires members to make and preserve books and records as required under FINRA rules, the Exchange Act, and applicable exchange rules.

Retention periods vary by record. Many broker-dealer records must be retained for six years, while certain records carry a three-year requirement. Some records must remain readily accessible during a specified portion of the retention period. A firm should not assume that an archive is compliant simply because files can eventually be retrieved. During a regulatory examination, the practical question is whether the firm can produce complete, legible, and reliable records promptly.

The current SEC electronic recordkeeping framework permits compliant electronic preservation through either a non-rewriteable, non-erasable format or an audit-trail alternative that captures and preserves time-stamped changes. The choice of technology is consequential. A conventional cloud drive, shared mailbox, or accounting application may store information but still fail to meet the applicable preservation and retrieval requirements.

FINRA Rule 3110 also matters because supervision must be documented. A firm cannot credibly demonstrate that a principal reviewed activity, followed up on an exception, or escalated a concern if the documentation was discarded or scattered across individual inboxes. Rule 3310 and related BSA requirements add a separate layer for AML controls, training, testing, investigations, and suspicious activity reporting.

Build the Schedule Around Record Classes

The strongest retention schedules are operational documents, not generic policy attachments. They identify where a record originates, who owns it, where it is stored, what retention rule applies, and how it can be retrieved. That level of detail matters when a firm changes clearing relationships, personnel, email systems, or service providers.

Trading, customer, and financial records

Core books and records generally include order memoranda, trade blotters, confirmations, account records, account statements, customer communications, general ledgers, trial balances, capital computations, bank records, and supporting documentation for financial reporting. The firm’s required records depend on its business model. A fully disclosed introducing broker, for example, may rely on its clearing firm for portions of the customer recordkeeping function, but it remains responsible for records it creates and for its own supervisory and financial obligations.

Financial operations records deserve particular attention. Workpapers supporting the firm’s net capital calculation, FOCUS Report, expense allocations, payroll accruals, revenue recognition, and liabilities should reconcile to the general ledger and financial statements. A filing that is accurate but unsupported is difficult to defend in an examination. Retain the underlying schedules, approvals, reconciliations, and correspondence that explain material balances and adjustments.

For firms subject to SEC Rule 15c3-1, record retention should be part of the net capital control environment. The person preparing the computation, the FINOP, and firm management should be able to trace a reported amount back to source records without reconstructing the calculation from memory.

Supervisory and compliance records

Written supervisory procedures are only one part of the supervisory record. Firms should preserve evidence that procedures were implemented: branch and office inspections, principal reviews, exception reports, trade surveillance, correspondence reviews, approvals, attestations, complaint handling, and disciplinary follow-up.

The same principle applies to annual compliance activity. Retain the completed annual compliance meeting materials, records of associated-person participation, Rule 3120 certification support where applicable, training documentation, risk assessments, and updates to the compliance calendar. If a procedure changed because the firm added a product, hired representatives, changed systems, or identified a control failure, preserve the reasoning and approval trail.

Customer complaints require especially careful handling. The complaint itself, internal investigation, correspondence, remediation decisions, reportability analysis, and any regulatory filing support should remain together in a controlled file. Splitting these records among email folders, a CRM system, and a legal file makes consistent retrieval harder and can obscure whether the firm responded appropriately.

AML, identity, and transaction records

AML retention cannot be managed as an afterthought. Bank Secrecy Act rules impose separate obligations for AML program records, customer identification records, Currency Transaction Reports, Suspicious Activity Reports, and certain funds transfer documentation. Many of these records carry five-year retention requirements, but the applicable period and handling requirements differ by record type.

SAR-related information requires particular discipline. Access should be restricted, and the firm must protect the confidentiality of a SAR and information that would reveal its existence. Firms should retain investigation materials in a manner that supports the SAR filing decision without placing restricted information in ordinary supervisory files or broad-access collaboration systems.

OFAC screening results, escalation records, and disposition documentation should also be retained according to the firm’s policies and applicable requirements. A clear audit trail is often more valuable than a large volume of unreviewed screening output.

Electronic Storage Is a Control Decision

Electronic retention is not solved by scanning paper or purchasing an archiving platform. The firm must test whether its system captures all required records, preserves them without unauthorized alteration, maintains indexing or search capability, and produces records in a usable format. It must also account for communications occurring outside traditional email.

Text messages, business-related mobile communications, collaboration-platform messages, and social media activity can all create records when used to conduct firm business. A written prohibition on unapproved channels is not enough if personnel use them in practice. The firm needs a combination of policy, training, technical controls, surveillance, and documented enforcement.

Vendor oversight is equally relevant. Clearing firms, cloud providers, email archive vendors, payroll processors, and outsourced service providers may hold records the broker-dealer needs for regulatory purposes. Contracts, service-level expectations, access rights, data-export procedures, and termination planning should be reviewed before a problem arises. The broker-dealer remains accountable even where a third party maintains the system.

Assign Ownership and Test Retrieval

A retention schedule fails when it has no named owner. Compliance may own the policy, but finance should own financial record schedules, operations should own transaction and account documentation, and information technology should own system configuration and access controls. Senior management should receive periodic reporting on exceptions, vendor changes, failed captures, and overdue remediation.

Testing should mirror an examination request. Select samples across record categories and ask: Can the firm identify the authoritative record? Can it retrieve the complete version within the required timeframe? Is the record readable? Does the audit trail show changes and approvals? Can the firm explain the retention period and disposition control?

Destruction is also a controlled process. Retaining everything indefinitely may appear conservative, but it increases storage costs, complicates legal and privacy obligations, and leaves more information exposed in a cyber incident. A defensible disposition process follows the approved schedule, suspends deletion when litigation, arbitration, investigation, or examination holds apply, and documents what was destroyed and when.

Common Gaps That Create Examination Risk

The most frequent weaknesses are rarely dramatic. They include incomplete email capture, unsupported FOCUS Report balances, missing documentation of supervisory reviews, former representative records left in inaccessible accounts, and AML files that do not show how alerts were resolved. Another recurring issue is a gap created during a vendor migration, merger, office closure, or clearing-firm conversion.

These are operational failures, not simply records-management failures. They often reveal unclear responsibility between the CCO, FINOP, operations team, and technology provider. A periodic review led by personnel who understand both securities regulation and the firm’s accounting and operational workflows can identify those handoffs before they become findings.

A record retention program earns its value on the day a firm must produce proof, not on the day its policy is approved. Keep the schedule current, test the retrieval path, and make each business owner accountable for the records that demonstrate the firm did what it said it would do.

Related service: Compliance and CCO support