Burying the Technologically Primitive WORM: Open Meeting on Broker-Dealer Electronic Recordkeeping Requirements
Oct. 12, 2022
The Commission finally is considering the adoption of a rule that will allow broker-dealers to retire the antiquated systems using CD-ROMs or other similar write-once-read-many (or, appropriately primitive, WORM) technology that our current rules require.
This day has been long in coming. The current rule, which was adopted in 1997, specified that a broker-dealer must preserve its records “exclusively in a non-rewriteable, non-erasable format.” This requirement was more flexible than the proposal, which had specified that firms keeping records electronically had to use “optical storage technology.” Commenters on that proposal objected that the requirement was overly restrictive. In the adopting release, the Commission acknowledged these concerns. Noting that other technologies also were “available in a WORM, non-rewriteable version,” the Commission declined to “specify the type of storage technology that may be used,” and instead established standards that the storage media had to satisfy to be acceptable under the rule. In other words, the Commission moved from a proposed approach that would have required optical storage technology because it recorded data in a non-rewriteable, non-erasable manner to a final rule that simply articulated an apparently technologically neutral standard that specified only that the medium needed to be in a non-rewriteable and non-erasable format.
The standard soon showed its true colors. Only six years later, the Commission found it necessary to respond to repeated requests from broker-dealers that suggested that the original rule was not as technologically neutral as the Commission initially thought. Broker-dealers were asking “for guidance on whether this requirement limits them to using optical platters, CD-ROMs, DVDs, or similar physical mediums to achieve” preservation of their records “exclusively in a non-rewriteable and non-erasable format” as required under rule 17a-4. The Commission explained that the rule “does not require that a particular type of technology or method be used to achieve the non-rewriteable and non-erasable requirement” and that a broker-dealer could use an integrated system of hardware and software control codes to comply with the rules. However, the Commission expressly excluded from this interpretation any system that relied exclusively on software controls, as they do not prevent modification or destruction of records and thus were not compliant with the rule.
Given the limitations of this interpretation, it appears that many, perhaps most, broker dealers continued to use various forms of optical storage technology to meet the requirements of rule 17a-4, notwithstanding its many deficiencies. Many broker-dealers incur significant costs to maintain a system that has little or no business use; that may be incapable of capturing, in a usable form, the types of dynamic information that contemporary information systems produce; and that, by all appearances, regulators almost never use. Significantly, broker-dealers bear these burdens while investment advisers and CFTC-regulated entities, some of which are also registered as broker-dealers, do not.
Given the inflexibility and costs of our current rules, I am happy to see this recommendation come before the Commission. The rule provides what appears to be a viable, less expensive, and more useful alternative to WORM that I hope will benefit both our regulated entities and the Commission as it supervises and examines them.
At the same time, our experience with the rule we adopted in 1997 nags at me. The release we are considering states that one of the goals of this rulemaking is to make the requirement “more technology neutral.” I hope these amendments achieve this goal, but, to be frank, our experience over the past quarter century with the existing rule leaves me in doubt. As commenters pointed out, even in the mid-90s, it would have been foolish to assume that optical storage technologies would continue to be a commonly used form of storage. Many people probably thought that a standard that required records to be kept in a non-rewriteable, non-erasable format would be much more durable. As I have already described, we had to revisit this question six years after we finalized the current rule. As a consequence, both firms and the Commission have been burdened with an expensive, obsolete, and probably, as a practical matter, unusable storage methodology for the better part of two decades.
What guarantees do we have that a rule that requires an “audit trail” will be any different? If the past twenty-five years have taught us anything, it is that technological developments consistently surprise us all. I hope that “audit trail” is sufficiently expansive to include all future technological solutions to identify changes to records and to reconstructing earlier versions of altered documents, but I fear that audit trail is to 2022 what WORM was to 1997.
We could be far more confident in the staying power of our rule if we were instead considering a principles-based approach that specified the objective we expected firms to achieve and allowed them to find the best technology available to them to reach this goal. For example, we could have specified that a broker-dealer needs to be able, upon request from the Commission, to retrieve any record it is required to maintain, as of any date specified by the Commission. This kind of rule would ensure that firms are capable of doing what we expect them to be able to do under the rule we are considering today. For many of them, an audit trail might be the best solution. For others—or for firms doing business a decade from now—other, more economical solutions might be available. Under a principles-based approach, the Commission could hold any firm liable for not maintaining a system capable of producing records required under the rules, but would not hold firms liable for failing to have systems that checked particular technological boxes.
Notwithstanding these concerns, I believe that this rule represents an improvement over our current, outdated requirement and am happy to support it. To be clear, however, I view this as an initial step toward a truly principles-based, technologically neutral future where our registrants are free to find the best solutions available to meet our regulatory requirements.
I would like to express my thanks to the staff for all the hours they have spent engaging with market participants to find a way to move beyond WORM, in discussing recordkeeping with me, and in drafting this rule.
 The rule also sets out generally similar provisions for security-based swap dealers and major security-based swap participants. See amendments to Exchange Act rule 18a-6.
 Exchange Act rule 17a-4(f)(2)(ii)(A).
 Reporting Requirements for Brokers or Dealers under the Securities Exchange Act of 1934; Proposed Amendments, Exchange Act Rel. No. 32609 (July 9, 1993), 58 Fed. Reg. 38092, 38094 (July 15, 1993). See also id. at 38093 (noting that “[o]ptical storage technology allows for digital data recording in a non-rewriteable, non-erasable format, such as write once, ready many (‘WORM’), which provides a non-alterable, permanent record storage medium”).
 Reporting Requirements for Brokers or Dealers under the Securities Exchange Act of 1934; Final Rule, Exchange Act Rel. No. 38245 (Feb. 5, 1997); 62 Fed. Reg. 6469, 6470 (Feb. 12, 1997) (“Several commenters explained that the description of optical storage technology in the Proposing Release included only one specific type of writing technology known as ablative writing, and requested clarification that the final rule would apply to other forms of optical disk technology that met the requirements of the rule.”).
 Electronic Storage of Broker-Dealer Records; Interpretation, Exchange Act Rel. No. 47806 (May 7, 2003), 68 Fed. Reg. 25281, 25282 (May 12, 2003).
 Id. at 25282-25283.
 See SIFMA, Financial Services Roundtable, Futures Industry Association, Financial Svcs. Inst., International Swaps and Derivatives Association, Petition for Rulemaking to Amend Exchange Act Rule 17a-4(f) (Nov. 14, 2017), available at https://www.sec.gov/rules/petitions/2017/petn4-713.pdf.
 See id. at 5 (noting that “regulators . . . do not typically ask for production of records from WORM storage because the information or data is not readily sortable or searchable [but] instead request customized extracts or views of data collected from active storage systems where the record was originally created, that has not yet been transferred to a WORM system”).