FINRA Rule 6890

The 2022 Overhaul of SEA Rule 17a-4

The SEC adopted sweeping amendments to Rule 17a-4 on October 12, 2022, in Securities Exchange Act Release No. 96034, with an effective date of January 3, 2023 and a compliance date of May 3, 2023. These amendments fundamentally modernized the electronic recordkeeping framework that had remained largely unchanged since its original 1997 adoption, addressing technological developments that had rendered portions of the older rule text increasingly obsolete in practice, and every one of these changes flows directly through to shape how Industry Members satisfy their Rule 6890 CAT recordkeeping obligations today, even though Rule 6890's own text was never separately touched by FINRA in response.

The most consequential change replaced the older, increasingly obsolete terms "electronic storage media" and its associated technical framework with the broader, more technology-neutral concept of an "electronic recordkeeping system." Before this change, firms electing electronic storage generally needed to satisfy a strict Write Once, Read Many, or WORM, requirement, meaning the storage technology had to physically prevent any overwriting, erasure, or alteration of a stored record once written. The 2022 amendments introduced an alternative compliance path alongside the traditional WORM approach: firms may now instead preserve records using an audit-trail method, maintaining a complete, time-stamped audit trail capturing every modification or deletion made to a record, the date and time of each such action, and, where applicable, the identity of the individual who made the change, rather than relying exclusively on storage media that physically prevents alteration in the first place.

What the Audit-Trail Alternative Means for CAT Records Specifically

This audit-trail alternative carries particular relevance for CAT-related recordkeeping, since it reflects a broader recognition that a complete, verifiable record of how data changed over time can serve the same underlying regulatory purpose as immutable storage, provided that audit trail itself is properly preserved and secured. A firm choosing this alternative for its CAT-related records under Rule 6890 needs to ensure its recordkeeping system genuinely captures and preserves this complete modification history, since a system that merely restricts casual editing without maintaining a full audit trail of whatever changes do occur would not satisfy either the traditional WORM standard or the new audit-trail alternative properly.

The 2022 amendments also eliminated a notice requirement that had previously applied to firms adopting non-optical-disk electronic storage media, which formerly required 90 days advance notice to FINRA before deployment, along with a representation that the selected storage medium met SEC Rule 17a-4's requirements. Firms implementing new electronic recordkeeping systems today, including systems used to satisfy Rule 6890's CAT recordkeeping obligations, no longer face this advance notification burden, streamlining technology deployment relative to the pre-2022 framework.

The Third-Party Recordkeeping Relationship

Many firms rely on outside vendors, service bureaus, or affiliated recordkeeping services to actually store and preserve their regulatory records, including CAT-related records subject to Rule 6890. The 2022 amendments preserved, while modernizing, the underlying undertaking framework governing these third-party relationships: an outside entity maintaining a firm's required records must file a written undertaking, in a form the SEC accepts, confirming that the records remain the property of the firm and will be surrendered promptly upon the firm's request. The amendments introduced an "Alternative Undertaking" option available where the third party's electronic recordkeeping system utilizes servers or storage devices the third party itself owns or operates, provided the broker-dealer maintains independent access to the records, giving firms and their vendors additional flexibility in how they structure this required assurance of continued regulatory access.

Firms should understand that this undertaking framework applies to CAT-related records maintained by a third party in precisely the same way it applies to any other regulatory record a firm outsources to external storage, meaning a firm using a CAT Reporting Agent or a separate records vendor for its underlying CAT data should confirm the appropriate undertaking is properly in place covering those specific records, not merely assume that a general recordkeeping vendor relationship automatically extends to cover CAT-specific data without any dedicated confirmation.

Understanding the SEA Rule 17a-4(b) Retention Periods

Rule 6890's cross-reference to SEA Rule 17a-4(b) specifically, rather than the rule's broader provisions, ties CAT recordkeeping to the general retention period schedule that governs the bulk of a broker-dealer's ordinary business records. Under this schedule, most records must be preserved for a period of not less than three years, with the records from the first two years kept in an easily accessible place, a framework distinct from the six-year retention period Rule 17a-4(a) applies to certain other categories of foundational business records, such as blotters and ledgers. Because Rule 6890 specifically references subsection (b) rather than incorporating the full range of Rule 17a-4's varying retention periods, CAT-related records generally fall within this three-year framework rather than the longer six-year period applicable elsewhere in the broader books and records landscape.

This distinction matters practically because a firm's CAT-specific records retention policy should not simply default to whatever retention period the firm applies to its longest-retained category of records; it should specifically confirm that CAT data is being preserved for the correct period under the Rule 17a-4(b) framework Rule 6890 actually incorporates. A firm that over-retains CAT data relative to its actual regulatory obligation is not itself a compliance violation, but it does represent an unnecessary ongoing storage cost and potential data management burden, while a firm that under-retains, mistakenly applying a shorter retention period than Rule 17a-4(b) actually requires, faces genuine recordkeeping exposure if that data is destroyed before the required retention period has actually elapsed.

A Recurring Pattern: Cross-Referenced Rules and Silent Substantive Change

Rule 6890's relationship to SEA Rule 17a-4 illustrates a pattern that recurs throughout the Rule 6800 Series and the broader FINRA rulebook more generally, one worth recognizing as a distinct category of regulatory change risk. Rule 6820's clock synchronization standard cross-references the same underlying NIST atomic clock concept relied upon elsewhere in the rulebook; Rule 6621's OTC Equity Security definitions cross-reference Rule 6420 rather than restating them independently; and Rule 6890's recordkeeping obligation cross-references SEA Rule 17a-4 rather than establishing an independent CAT-specific standard. In each case, a firm monitoring only the specific numbered rule for amendments risks missing a substantive change that actually occurs through amendment to the cross-referenced provision instead.

This pattern deserves particular attention in the recordkeeping context specifically, since SEA Rule 17a-4 is an SEC rule, not a FINRA rule, meaning firms monitoring FINRA's own rule-filing notifications exclusively, without separately tracking SEC rulemaking affecting the broader broker-dealer recordkeeping framework, would have entirely missed the 2022 modernization discussed above despite its direct, substantial effect on how Rule 6890 obligations are actually satisfied in practice. A firm's regulatory change management program should specifically account for this category of indirect, cross-referenced amendment risk, rather than assuming that monitoring FINRA's Rule 6800 Series rule filings alone provides complete coverage of everything that could affect the firm's CAT recordkeeping compliance.

Relevance Across FINRA's Exam Programs

The SIE, Series 63, and Series 65 do not test Rule 6890's specific recordkeeping mechanics, since these exams do not reach into CAT's technical recordkeeping infrastructure. A Series 7 candidate is unlikely to encounter this rule directly, though a general awareness that regulatory records, including CAT data, must be preserved for defined periods in secure, accessible formats reinforces broader recordkeeping principles relevant across many areas of the exam.

A Series 24 candidate supervising CAT compliance and broader recordkeeping functions needs to understand that Rule 6890 does not exist as an isolated, CAT-specific standard, but rather inherits whatever the current state of SEA Rule 17a-4 happens to be, meaning a principal's recordkeeping compliance program should track amendments to the underlying SEC rule directly, not merely monitor FINRA's own Rule 6800 Series for changes that might never actually appear there even as the true substantive standard shifts underneath it. A principal should also understand the choice between the traditional WORM approach and the newer audit-trail alternative as a genuine technology and compliance decision affecting the firm's CAT recordkeeping infrastructure, one that should be made deliberately with input from both compliance and technology functions rather than defaulting to whichever approach a vendor happens to offer without independent evaluation. A Series 57 candidate is less directly implicated by this particular rule's technical recordkeeping mechanics, though should understand that the CAT order records relied upon for a trader's own recordkeeping and dispute resolution needs are themselves subject to this same underlying preservation framework, and that a recordkeeping gap upstream can eventually affect a trader's own ability to reconstruct or verify historical order activity when questions arise.

Practical Guidance for Firms

Firms should treat Rule 6890 compliance as inseparable from their broader SEA Rule 17a-4 compliance program rather than as a standalone, CAT-specific recordkeeping workstream, given how directly and completely Rule 6890 incorporates the general framework by reference. A firm's recordkeeping policies and procedures should explicitly address how CAT-related records are covered within the firm's overall Rule 17a-4 compliance architecture, rather than maintaining separate, potentially inconsistent recordkeeping standards for CAT data versus the firm's other regulatory records.

Firms that have not yet evaluated whether the 2022 audit-trail alternative might better suit their CAT recordkeeping infrastructure than a traditional WORM-based approach should undertake that evaluation directly, weighing the relative technical and cost implications of each path for their specific technology environment. A firm already operating a WORM-compliant system for its other regulatory records may find continuing that same approach for CAT data the simplest path, while a firm building new CAT-specific recordkeeping infrastructure from scratch may find the audit-trail alternative offers genuine flexibility advantages worth exploring before committing to a specific technical architecture.

Firms relying on third-party vendors for CAT-related record storage should specifically confirm which undertaking framework, Traditional or Alternative, applies to that relationship, and should periodically reconfirm that the underlying undertaking documentation remains current and accurately reflects the actual technical relationship between the firm and its vendor. A firm that has not revisited its third-party recordkeeping undertakings since before the 2022 amendments took effect should specifically review whether its existing arrangements still reflect current best practice, or whether taking advantage of the modernized Alternative Undertaking framework might offer meaningful benefits over an older arrangement structured around the pre-2022 rule text.

Firms should build a specific regulatory change monitoring process covering SEC amendments to SEA Rule 17a-4 and related recordkeeping provisions, distinct from and in addition to whatever process the firm already maintains for tracking FINRA's own Rule 6800 Series amendments. Given how completely Rule 6890 depends on the underlying SEC rule for its actual substantive content, a firm that only monitors FINRA rule filings for CAT-related regulatory change is missing an entire category of relevant developments that could materially affect its recordkeeping obligations without any corresponding change ever appearing in FINRA's own rule text.

Firms should also periodically audit their actual retention practices against the specific Rule 17a-4(b) three-year framework Rule 6890 incorporates, confirming that CAT-related records are neither prematurely destroyed before the required retention period elapses nor unnecessarily retained far beyond what the rule actually requires. This audit should specifically distinguish CAT-related records from other categories of firm records that may be subject to different retention periods under other provisions of Rule 17a-4, since applying a uniform, firm-wide retention policy without accounting for these category-specific distinctions risks either under-retaining data subject to a longer period elsewhere in the rule or unnecessarily over-retaining CAT-specific data relative to what Rule 6890's narrower cross-reference actually requires.

Legal and compliance teams evaluating a new recordkeeping vendor or technology platform for CAT-related data specifically should build direct compliance verification against the current, post-2022 version of Rule 17a-4(f) into their vendor selection and due diligence process, rather than relying on outdated internal documentation or vendor marketing materials that may reference the pre-2022 WORM-only framework without acknowledging the newer audit-trail alternative now available. A vendor genuinely current on the modernized recordkeeping framework should be able to articulate clearly which of the two compliance paths, traditional WORM or the newer audit-trail alternative, its platform actually satisfies, and firms should treat a vendor's inability to answer this question clearly and confidently as a meaningful red flag in the selection process.