17a-4 and FINRA supervision: a different product, and we say so.
Broker-dealer recordkeeping is not “RIA archiving plus a checkbox”. Rule 17a-4(f) requires either non-rewriteable storage or a complete audit-trail system, a designated third party able to produce your records independently, serialization and verification, and a duplicate copy. FINRA Rule 3110 adds supervisory review with documented sampling and escalation. We are building toward it; we are not selling it yet.
| Journaling | 100% of mail |
| Storage | S3 Object Lock · compliance mode |
| Designated third party | Letter on file |
| Retention | 6 years · first 2 accessible |
| Supervision (3110) | Weekly review · logged |
What the broker-dealer edition will include
- Storage meeting 17a-4(f) with the audit-trail alternative and immutable copies in two regions.
- Designated third-party arrangement and the undertaking letters your FINRA examiner expects.
- Supervisory review queue: lexicon and random sampling, reviewer assignment, escalation, documented outcomes.
- Off-channel communications attestation support.
Who it is for
Small independent broker-dealers and hybrid RIA/BD firms that currently pay enterprise archiving vendors far more than their size justifies.
Timing
After the RIA edition and SOC 2 Type II. If you are a compliance consultant to small BDs, we would like to talk now.
What Rule 17a-4(f) and FINRA 3110 require, in plain words
A broker-dealer’s electronic records are governed by Exchange Act Rule 17a-4, and paragraph (f) is where email lives. It gives a firm two ways to keep electronic records. The first is non-rewriteable, non-erasable storage, the WORM model: once a message is written, it cannot be changed or deleted before its retention date. The second, added in the 2022 amendments, is the audit-trail alternative: the system may allow changes, but every change is recorded so the original and each modification can be reproduced. Either way, the firm needs a designated third party (D3P) with independent access who can hand the records to the SEC or FINRA if the firm will not or cannot, a duplicate copy of the records kept separately, an index, and verification that what was stored is complete and accurate. Retention runs three or six years depending on the record type, with the first two years easily accessible; most firms keep everything six years and stop arguing about categories.
FINRA Rule 3110 is about supervision rather than storage. The firm must have written supervisory procedures, review incoming and outgoing correspondence and internal communications on a documented, risk-based basis, assign reviewers, escalate what they find and keep the evidence that the review happened. An archive that cannot show who reviewed what, and when, does not satisfy 3110 no matter how immutable it is.
Today PXCMail’s archive uses immutable storage and journals 100% of mail, which is most of the WORM half. It does not yet have the D3P arrangement, the duplicate-copy attestation, the serialization and verification letters, or the supervisory review queue. That is why this page says ROADMAP.
A week at a small hybrid firm, once the edition ships (ROADMAP)
- Monday. Every registered representative’s mail is journaled into WORM storage in us-east-1 with a duplicate in us-west-2. The index is written at the same time.
- Tuesday. The 3110 review queue presents the principal with a random sample plus every message that hit the lexicon (“guaranteed”, “off the books”, “text me”). Each decision is recorded with the reviewer’s name.
- Wednesday. A representative’s client confirms a trade instruction by email. The message is in the record with the TLS and delivery details; the confirmation is retrievable in seconds.
- Thursday. A FINRA examiner asks for the D3P undertaking and the representation letters. They are on file in the console, dated, and exportable.
- Friday. The annual off-channel attestation goes to every representative; responses are logged.
By the numbers
- Two storage models. Rule 17a-4(f) accepts either non-rewriteable, non-erasable storage or an audit-trail system that reproduces every version of a record. (17 CFR 240.17a-4(f))
- Three or six years, first two easily accessible, depending on the record category. (17 CFR 240.17a-4(a) and (b))
- $27,000 is the average business email compromise loss in Coalition’s 2026 claims report; BEC and funds-transfer fraud were 58% of all claims. Supervision rules exist for other reasons, but the archive is also the evidence when a client disputes an instruction. (Coalition 2026 Cyber Claims Report)
What the examiner asks a small BD
“Is your electronic storage compliant with 17a-4(f)?” The honest answer today, with PXCMail, is no. With the broker-dealer edition the answer will rest on the D3P undertaking, the duplicate-copy statement and the verification process, all of which are ROADMAP.
“Who is your designated third party?” A D3P arrangement is part of the edition. Until it exists we will not sell to a firm that needs one.
“Show me your correspondence review for Q2.” This needs the 3110 review queue with sampling, reviewer assignment and logged outcomes, which is ROADMAP.
“Where are the first two years?” Online and searchable; this part works today for RIA customers and carries over.
How a small BD can evaluate now
- Tell us about the firm
Number of representatives, hybrid or standalone, current archive vendor and renewal date. We reply with where the edition stands against your list. - Separate the RIA side if you are hybrid
The advisory side can run on the RIA edition today under Rule 204-2. The BD side stays with your current 17a-4 vendor until the edition ships. - Review the roadmap brief with your compliance consultant
We share the WORM and audit-trail design and the supervisory review-queue workflow for comment before we build them; the designated-third-party arrangement is drafted with the first design partners. - Do not switch early
We would rather lose the quarter than have a firm fail an exam on our account.
Pricing
The broker-dealer edition is not priced because it is not for sale. For reference, the RIA books-and-records profile is Gateway at $10 per seat per month, billed yearly, with a $49 organization minimum. A hybrid firm with five advisers and an operations associate on the RIA side pays $60 per month for that side today. Pricing for the BD edition will be published when the D3P and review-queue work is done.
Questions broker-dealers ask
Can we use the RIA edition for our BD records in the meantime?
No. It lacks the D3P arrangement, the duplicate-copy and verification statements and the supervisory queue that 17a-4(f) and 3110 require. We will say the same to a FINRA examiner.
Will the edition use WORM or the audit-trail alternative?
Both: immutable S3 Object Lock storage in compliance mode for the primary copy, with the audit-trail model for anything that must be amended, such as redactions ordered by a court. The design is in the roadmap brief.
Who will be the designated third party?
An independent party with its own access credentials and the undertaking letter examiners expect. The arrangement is ROADMAP; we will name the party when the agreement is signed.
When?
After the RIA edition and SOC 2 Type II. We do not publish dates we cannot keep. Leave your renewal date and we will tell you honestly whether to wait.
What about text messages and other off-channel communication?
Attestation support is in the edition. Capturing texts and chat apps is not; the edition is email.