Does SEC Rule 17a-4 require electronic records to be stored in a non-rewritable WORM format?

The short answer

For decades, SEC Rule 17a-4 was widely understood to require that certain broker-dealer records be preserved on non-rewriteable, non-erasable media — the property commonly described as “WORM” (write once, read many). However, the requirement has historically been framed in terms of an outcome, not a brand or a single technology. The rule called for records to be kept in a way that prevents alteration or deletion during the required retention period and that ensures records remain authentic and readable.

In 2022, the SEC amended Rule 17a-4 to broaden how firms can meet this obligation. The amended rule recognizes two acceptable approaches: the traditional non-rewriteable, non-erasable (WORM) format, or an “audit-trail” alternative that preserves a complete record of any changes and allows the original record to be recreated. So the answer today is nuanced: WORM remains one compliant path, but it is no longer the only one.

What the rule actually requires

The underlying principle is trustworthiness over time, achieved through controls such as:

• Integrity — records cannot be altered or destroyed before their retention period ends.
• Auditability — any change is logged so the original can be reconstructed.
• Accessibility — records remain legible and retrievable for examiners.

These goals are common across many recordkeeping regimes, not just securities regulation. WORM media is one engineering means of achieving immutability; a verifiable audit trail is another.

Practical takeaways

• Don’t assume “WORM is mandatory.” Confirm against the current text of Rule 17a-4 and any guidance from your regulator, since requirements evolve.
• Focus on the control objective — demonstrable immutability and a reconstructable record — rather than a specific product label.
• Document how your chosen approach satisfies integrity, audit-trail, and accessibility requirements.

These same durability and integrity principles apply broadly to managing trustworthy electronic records. For securities-specific obligations, always verify the precise, current language of the rule and consult counsel, because financial recordkeeping rules are detailed and periodically updated.