The Amended Rules are Intended to be "More Technology Neutral" and Specifically Address Cloud Storage

On October 12, 2022, the US Securities and Exchange Commission ("SEC") adopted amendments to the electronic recordkeeping requirements under Rule 17a-4 under the Securities Exchange Act of 1934 (the "Exchange Act"), applicable to broker-dealers, as well as Rule 18a-6 under the Exchange Act, applicable to security-based swap dealers ("SBSDs") and major security-based swap participants ("MSBSPs") that are not registered as broker-dealers (collectively, "SBS Entities").1

The amendments modify requirements regarding the maintenance and preservation of electronic records, the use of third-party recordkeeping services, and the prompt production of records. Most notably, the amendments provide for an audit-trail alternative to the current requirement for broker-dealers to maintain and preserve electronic records exclusively in a non-rewriteable, non-erasable format (i.e., "write once/read many" or "WORM" format). According to the SEC, the amendments are designed to modernize the SEC's recordkeeping requirements given technological changes over the last two decades and to make the rules "more technology neutral." We provide an overview of the key aspects of the amendments below

The amendments to SEC Rules 17a-4 and 18a-6 become effective 60 days after publication in the Federal Register, which has not yet occurred as of the date of this Legal Update. The compliance date for the amendments is, with respect to SEC Rule 17a-4, six (6) months after publication in the Federal Register, and, with respect to SEC Rule 18a-6, twelve (12) months after publication in the Federal Register. Importantly, the amendments require updates to (and re-filing of) certain written undertakings previously filed under the rules and potential amendments to existing service provider agreements, as further described herein.

Amendments

ELIMINATION OF NOTICE AND REPRESENTATION REQUIREMENTS FOR BROKER-DEALERS UNDER SEC RULE 17A-4(f)(2)(i)

The amendments eliminate, from SEC Rule 17a-4(f)(2), the requirement for a broker-dealer to notify its designated examining authority ("DEA") before employing electronic storage media, including the 90-day notice if the broker-dealer intends to employ electronic storage media other than optical disk technology.2 The amendments also eliminate from SEC Rule 17a-4(f)(2) the requirement that the broker-dealer provide a representation (or one from the storage medium vendor or other third party with appropriate expertise) that the selected electronic storage medium meets the conditions set forth in SEC Rule 17a-4(f)(2).3

ADDING AN AUDIT TRAIL ALTERNATIVE TO THE WORM REQUIREMENT

Currently, broker-dealers are required to maintain and preserve electronic records exclusively in WORM format.4 The amendments add an audit-trail alternative to the WORM requirement, which allows broker-dealers to use an electronic recordkeeping system that maintains and preserves electronic records in a manner that permits the recreation of an original record if it is modified or deleted.5

For the audit-trail alternative to be available, the electronic recordkeeping system must maintain and preserve the records for the duration of their applicable retention periods in a manner that maintains a complete timestamped audit trail that includes:

  • All modifications to and deletions of the record or any part thereof;
  • The date and time of actions that create, modify, or delete the record;
  • If applicable, the identity of the individual creating, modifying, or deleting the record; and
  • Any other information needed to maintain an audit trail of the record in a way that maintains security, signatures, and data to ensure the authenticity and reliability of the record and will permit re-creation of the original record if it is modified or deleted.6

Amended SEC Rule 18a-6(e) requires that SBS Entities without a prudential regulator ("non-bank SBS Entities") maintain and preserve electronic records using an electronic recordkeeping system that meets either the WORM requirement or the new audit-trail requirement, as described above.7

Accordingly, as a result of the amendments, a broker-dealer or non-bank SBS Entity that elects to use an electronic recordkeeping system must ensure such system meets either the WORM requirement or the audittrail alternative.

ADDING A "DESIGNATED EXECUTIVE OFFICER" ALTERNATIVE TO THE THIRD-PARTY UNDERTAKING REGARDING ELECTRONIC RECORDS

Currently, SEC Rule 17a-4(f)(3)(vii) requires a broker-dealer using electronic storage media to engage a thirdparty who has access to and the ability to download information from the broker-dealer's electronic storage media to any acceptable medium, and provide certain written undertakings to the broker-dealer's DEA.

The amendments to SEC Rule 17a-4 add an alternative approach in which a broker-dealer may designate an executive officer ("Designated Executive Officer") to execute the required undertakings so long as the Designated Executive Officer has access to and the ability to provide records maintained and preserved on the

The amendments to SEC Rule 17a-4 add an alternative approach in which a broker-dealer may designate an executive officer ("Designated Executive Officer") to execute the required undertakings so long as the Designated Executive Officer has access to and the ability to provide records maintained and preserved on the

broker-dealer's electronic recordkeeping system, either directly or through a specialist who reports directly or indirectly to the Designated Executive Officer.8 The Designated Executive Officer can appoint in writing up to two (2) designated officers to help fulfill the obligations of the Designated Executive Officer set forth in the undertakings in the event that such executive officer is unable to fulfill those obligations.9 Importantly, the Designated Executive Officer's appointment of, or reliance on, a designated officer or designated specialist does not relieve the Designated Executive Officer of the obligations set forth in the undertakings.10

To view the full article click here

Footnotes

1. See Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants, Exchange Act Release No. 96034 (Oct. 12, 2022) (the "Adopting Release").

2. Id. at 15.

3. Id. at 15-16. SEC Rule 18a-6 does not contain parallel notice and representation requirements.

4. See SEC Rule 17a-4(f)(2)(ii)(A).

5. See amended SEC Rule 17a-4(f)(2)(i)(A)

6. See id

7. See amended SEC Rule 18a-6(e)(2)(i)(A)-(B). SBS Entities with a prudential regulator ("bank SBS Entities") are not subject to the technical requirements for electronic recordkeeping systems set forth in SEC Rule 18a-6(e)(2). See Adopting Release at 16 (explaining the SEC's intent to "avoid imposing requirements [on bank SBS Entities] that could potentially conflict with regulations and guidance of the prudential regulators....").

8. See amended SEC Rule 17a-4(f)(3)(v)(A). The Designated Executive Officer must be a member of senior management of the broker-dealer and either have the knowledge, credentials, and information necessary to access and provide the records without having to rely on other individuals at the firm, or have appointed in writing up to three (3) designated specialists who have such knowledge, credentials, and information and that are direct or indirect reports to the officer. See amended SEC Rule 17a-4(f)(1)(iii) (defining "designated executive officer"); see also amended SEC Rule 17a-4(f)(3)(v)(B)(2)

9. See amended SEC Rule 17a-4(f)(1)(iv) (defining "designated officer"); see also amended SEC Rule 17a-4(f)(3)(v)(B)(1). Any such designated officer(s) must be an employee of the broker-dealer who reports directly or indirectly to the Designated Executive Officer and who has access to and the ability to provide records maintained and preserved on the electronic recordkeeping system either directly or through a designated specialist who reports directly or indirectly to the designated officer. The designated officer either must have the knowledge, credentials, and information necessary to access and provide the records without having to rely on other individuals at the firm or be able to direct a designated specialist who has such knowledge, credentials, and information. See Adopting Release at 52-53.

10. See amended SEC Rule 17a-4(f)(3)(v)(C).

Visit us at mayerbrown.com

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe - Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

© Copyright 2020. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.