SEC Rule 17a-4(f) — Electronic Records Storage Media (WORM + Audit Trail)
SEC Rule 17a-4(f) specifies the electronic-storage requirements for broker-dealer records — non-rewriteable/non-erasable format, automatic quality verification, serialised indexing, an accurate duplicate index, downloadability, third-party access, and a complete audit system. Ledgix evidences each requirement via signed retention attestations of the S3 Object Lock configuration, the Merkle checkpoint chain, and the inclusion-proof index.
Status: Full — every control resolves to an artifact Ledgix produces today following the Phase 6 retention-attestation module shipping.
Scope
Rule 17a-4(f) applies to broker-dealers subject to SEC jurisdiction when they use electronic storage media for records required under 17a-4. The 2022 amendment permits an audit-trail alternative to WORM — Ledgix supports both: signed Object Lock attestations satisfy the WORM path, while the append-only Merkle ledger plus per-event inclusion proofs satisfy the audit-trail alternative.
Controls covered
| Field | Type | Required | Description |
|---|---|---|---|
| SEC-17a-4(f)(2)(i)-NON-REWRITEABLE | retention_attestations | Non-Rewriteable, Non-Erasable Format | Signed, per-period attestations of S3 Object Lock mode, retention horizon, versioning, and MFA-delete. |
| SEC-17a-4(f)(2)(ii)(A)-QUALITY-ACCURACY | checkpoint_chain / proof_index / signatures | Verify Quality and Accuracy of Storage Media Recording Process | Merkle-chained checkpoints, per-event inclusion proofs, and signed manifest. |
| SEC-17a-4(f)(2)(ii)(B)-SERIAL-INDEX | events_jsonl / checkpoint_chain | Serialize the Original and Duplicate Units / Time-Date Stamp | Ledger events carry sequence numbers, timestamps, and checkpoint lineage. |
| SEC-17a-4(f)(2)(ii)(C)-ACCURATE-INDEX | proof_index / framework_mapping | Accurate Index of All Information | Per-event inclusion-proof index plus framework-aware mapping as a secondary index. |
| SEC-17a-4(f)(3)(iv)-DOWNLOADABLE | framework_mapping / signatures | Ability to Download Indexes and Records | Standalone signed ZIP containing every artifact referenced by the mapping. |
| SEC-17a-4(f)(3)(v)-THIRD-PARTY-ACCESS | key_history / signatures | Third-Party Access / Designated Third Party (D3P) | Full key custody and detached signatures enable offline D3P verification. |
| SEC-17a-4(f)(3)(vii)-AUDIT-SYSTEM | events_jsonl / policy_snapshots / retention_policies / retention_attestations | Complete Audit System for Preservation | Complete event stream, policy versions, approved retention policies, and periodic attestations. |
Evidence types referenced
- retention_attestations — signed S3 Object Lock configuration attestations.
- checkpoint_chain — Merkle-chained checkpoints, each linking to the predecessor.
- proof_index — per-event inclusion proofs for independent verification.
- signatures — detached signatures enabling offline verification.
- events_jsonl — serialised, timestamped event stream.
- key_history — key custody history for long-term verification.
- policy_snapshots — policy versions in force across the window.
- retention_policies — approved retention policies.
- framework_mapping — framework-aware secondary index over exported artifacts.
Known gaps (if any)
None — every control resolves to an artifact Ledgix produces today. The Designated Third Party (D3P) relationship is arranged outside Ledgix; the export package is designed to be independently verified by any D3P using only key_history + signatures.
Audit pack workflow
Export an evidence ZIP for this framework from the admin console's Evidence Exports panel by selecting SEC Rule 17a-4(f) — Electronic Records Storage Media (WORM + Audit Trail) and a time window. Each control's evidence_locators[] in the included framework_mapping.json points to the corresponding file in the ZIP.
References
- Framework mapping JSON:
vault/internal/compliance/frameworks/sec_17a4f.json - Canonical source: 17 CFR § 240.17a-4 — ecfr.gov