Key Takeaways
- FINRA Rule 4511 books and records requirements direct member firms to make and preserve books and records under FINRA rules and the Exchange Act, in a format that complies with SEC Rule 17a-4.
- Records with no other specified period must be kept for at least six years, while most business communications must be kept for three years, the first two years in an easily accessible place.
- From May 3, 2023, firms may store electronic records using either WORM or the new audit-trail alternative under the amended Rule 17a-4.
- Audit-readiness now means capturing every business channel, preserving immutable records, and producing them fast on demand.
Introduction
In September 2022, the SEC charged 16 firms with recordkeeping failures tied to off-channel communications, a case covered in detail below. That enforcement wave put a spotlight on FINRA Rule 4511, the general books-and-records obligation that applies to every FINRA member firm.
Rule 4511 itself is short: it states what firms must do, then points to a web of SEC rules (17a-3 and 17a-4) that define how to do it. Understanding the rule means understanding the full regulatory picture.
In this article, we’ll cover:
- What Rule 4511 requires and who it applies to;
- Which records you must keep and for how long;
- How 4511 connects to SEC Rules 17a-3 and 17a-4;
- Format requirements (WORM and the 2022 audit-trail alternative);
- Supervision, third-party obligations, and enforcement trends; and
- How to stay audit-ready under the rule.
What is FINRA Rule 4511?
FINRA Rule 4511 is the general books-and-records rule in the 4500 series, replacing legacy NASD and NYSE recordkeeping rules when FINRA adopted SR-FINRA-2010-052, effective Dec. 5, 2011 (Regulatory Notice 11-19).
The rule has three subsections:
- 4511(a) requires members to make and preserve books and records as required under the FINRA rules, the Exchange Act, and applicable Exchange Act rules.
- 4511(b) requires firms to preserve those books and records for at least six years where no other specified period applies.
- 4511(c) requires that all such records be preserved in a format and media that complies with SEC Rule 17a-4.
Rule 4511 applies to all FINRA member firms, including broker-dealers, and is technology- and channel-neutral: the obligation extends across every medium used for business communications.
Because 4511 is a FINRA rule, it binds only FINRA member firms, meaning broker-dealers, not Registered Investment Advisers, which follow a separate SEC recordkeeping standard.
What records must broker-dealers make and preserve?
The “books and records” covered by Rule 4511 fall into two broad categories: financial records and business communications.
Financial records include:
- Blotters showing purchases and sales of securities;
- Asset and liability ledgers;
- Income and expense ledgers;
- Customer account ledgers;
- Securities records and order tickets; and
- Trade confirmations and net-capital computations.
Business communications are records “relating to business as such,” covering all internal and external communications related to business regardless of channel or device, per FINRA’s key topics page. Email, instant messages, text messages, chat apps, and social media posts all fall under this definition.
SEC Rule 17a-3 specifies which records firms must create, and Rule 4511 obligates firms to preserve them. Under the “business as such” standard, channel is irrelevant: if content relates to business, it must be captured and retained.
Jatheon addresses this breadth by capturing email, social media, chat, instant messaging, mobile text and voice, and files in a single archive, so you don’t need separate systems for each channel.
How long must firms keep records under Rule 4511?
FINRA Rule 4511 books and records retention periods depend on the type of record. Rule 4511(b) sets a six-year default, but SEC Rule 17a-4 specifies shorter periods for certain categories.
The six-year default rule
Rule 4511(b) states that firms must preserve FINRA books and records for at least six years where no other specified period applies, according to the FINRA rulebook. If the record is tied to an account, the six-year clock starts when the account is closed, according to FINRA’s Books and Records key topics page.
This default covers financial records like blotters, ledgers, trial balances, and net-capital computations, with the first two years in an easily accessible place under SEC Rule 17a-4(a) through (b)(5), according to the FINRA 2025 Annual Report.
The three-year rule for communications
Business communications fall under SEC Rule 17a-4(b)(4), which requires firms to retain originals of communications received and copies sent relating to “business as such” for at least three years, the first two in an easily accessible place.
This three-year period applies to most email, text, chat, and social media messages, though some firms extend retention for litigation holds, investigations, or state-law requirements using configurable retention policies by record type.
How Rule 4511 Connects to SEC Rules 17a-3 and 17a-4
Three rules work together to form the broker-dealer recordkeeping framework:
| Rule | Function |
| SEC Rule 17a-3 | Specifies what records must be created |
| SEC Rule 17a-4 | Specifies how long to keep them and in what format |
| FINRA Rule 4511 | Requires FINRA members to comply with both |
According to the FINRA 2025 Annual Report, 17a-3 tells you which records to make, 17a-4 tells you how to preserve them, and 4511(c) ties the two together by requiring that all records be preserved in a format and media that complies with 17a-4.
FINRA enforces these SEC rules against its member firms: when it conducts an exam or responds to a complaint, it reviews your compliance with 17a-3 and 17a-4 through the lens of Rule 4511.
Format and Media Requirements: WORM and the Audit-Trail Alternative
Rule 4511(c) requires records to be preserved in a format that complies with SEC Rule 17a-4, which permits three options: paper, micrographic media, or an electronic recordkeeping system (ERS).
Most broker-dealers rely on electronic storage. Until 2022, that meant WORM, or “write once, read many,” storage. The SEC has now added an alternative.
What WORM storage requires
WORM storage preserves records in a non-rewriteable, non-erasable format, a standard in place since the late 1990s, according to Dechert LLP, meant to prevent alteration or deletion after records are written.
Under WORM, once a record is committed to storage, no user or administrator can modify or erase it during the retention period. The FINRA 2026 Annual Report confirms that records must be preserved “consistent with the non-rewritable, non-erasable (i.e., WORM) requirement” if a firm chooses this pathway.
The 2022 audit-trail alternative
The SEC adopted these amendments to Rule 17a-4 in October 2022, with a compliance date of May 3, 2023, according to the SEC’s Small Entity Compliance Guide.
These amendments kept WORM as an option but added an audit-trail alternative: firms may use a system that preserves records “in a manner that permits the recreation of an original record if it is modified or deleted.”
The audit-trail alternative has four requirements:
- Log all modifications and deletions;
- Record the date and time of each action;
- Capture the identity of the individual who performed the action; and
- Retain other information needed to ensure authenticity and permit recreation.
The amendments also require firms to produce records in a “reasonably usable electronic format” on request, so examiners can review them efficiently. Jatheon Cloud supports both pathways, with WORM-compliant storage, tamper-proof records, and complete audit trails, so you can choose the approach that fits your infrastructure.
Supervision and Third-Party Recordkeeping Obligations
Recordkeeping sits within a broader supervision framework: FINRA Rules 3110 and 3120 require firms to maintain written supervisory procedures (WSPs) reasonably designed to achieve compliance with applicable securities laws.
Your WSPs should address which communication channels are approved, how they are captured, where records are stored, and how they will be produced during an exam.
Firms may outsource recordkeeping to a third-party provider, but they retain ultimate responsibility. The 2022 amendments added a cloud-service-provider undertaking that lets third parties sign the required undertaking on the firm’s behalf, but this doesn’t shift accountability: regulators still expect you to demonstrate that your vendor meets 17a-4 requirements, maintains audit logs, enforces access controls, and can produce records promptly.
Jatheon’s SOC 2 and ISO 27001 certifications, audit logs, and role-based access controls support these expectations, with cloud, on-premises, and virtual deployment options to meet data-residency and IT-policy requirements.
Enforcement: What Off-Channel Communications Recordkeeping Failures Cost Firms
Recordkeeping enforcement has intensified since 2021, with off-channel communications at the center of regulatory focus.
December 2021: JPMorgan Securities became the first major firm to settle an off-channel recordkeeping case, paying a $125 million SEC penalty (SEC press release 2021-262), after employees used personal devices and messaging apps without preserving those communications.
September 2022: The SEC charged 15 broker-dealers and one investment adviser for pervasive personal-texting-app use, with combined penalties exceeding $1.1 billion, according to SEC press release 2022-174, including eight firms paying $125 million each, for conduct spanning January 2018 through September 2021.
2021 to 2025: Between 2021 and 2024, 77 FINRA member firms settled similar SEC enforcement actions; in January 2025, the SEC brought additional off-channel actions but on notably less burdensome terms, according to a FINRA blog post by Robert Cook and Greg Ruppert.
The pattern is clear: prohibiting personal devices or unapproved channels isn’t enough. Regulators expect firms to capture and supervise business communications wherever they occur.
Jatheon helps address this by capturing off-channel channels like WhatsApp, iMessage, Teams, and SMS alongside email, so you can supervise communications rather than simply prohibiting them.
Common Recordkeeping Failures Beyond Off-Channel Communications
The nine-figure SEC settlements above get the headlines, but most FINRA disciplinary actions for Rule 4511 violations are far smaller and closer to home, with fines that reported FINRA sanction guidelines put at roughly $5,000 to $310,000 per case.
In a 2022 case, a Jefferies representative used WhatsApp to exchange securities-related messages with six customers over more than a year. Because WhatsApp wasn’t an approved channel, the firm never captured those communications, a Rule 4511 violation that contributed to a $15,000 fine and a six-month suspension, alongside separate, unrelated violations. Other recurring exam gaps include inconsistent retention schedules across record types, records that exist but can’t be located or produced fast enough to meet the two-year “easily accessible” standard, and outsourced arrangements where firms can’t demonstrate their vendor meets 17a-4 requirements.
GenAI, Chatbots, and Rule 4511
The same “business as such” standard that pulled texting and WhatsApp into scope is now pulling in generative AI. FINRA’s 2026 Annual Regulatory Oversight Report states that using GenAI implicates existing rules on supervision, communications, recordkeeping, and fair dealing, rather than a separate, new framework.
Two things follow: AI chatbots that interact with customers count as firm communications and must be captured like any email or text, and FINRA recommends storing prompt and output logs for AI tools used in supervision or customer-facing work so inputs stay reviewable, not just outputs.
The practical risk is employees quietly using consumer AI tools to draft or summarize business communications the firm never captures, the same structural gap behind the 2018-2022 off-channel texting failures. Many WSPs written before GenAI became common don’t name AI tools at all, approved or not.
Firms extending their Rule 4511 program to cover GenAI should treat AI tools as another channel: name which ones are approved, capture their outputs (including prompts, where supervision depends on reviewing them), and apply the same retention standards already used for email and chat. Jatheon’s Claude data connector already does this, continuously capturing every conversation, including prompts, responses, attachments, and even deleted exchanges.
How to Stay Audit-Ready Under Rule 4511
FINRA’s 2025 Annual Regulatory Oversight Report describes effective recordkeeping practices, summarized here as an audit-readiness checklist:
- Capture every approved business channel. Archive email, chat, social media, text messages, and voice communications in one system.
- Store records immutably with full audit trails. Use WORM storage or the audit-trail alternative, and log every action taken on a record, including date, time, and user identity.
- Enable fast, defensible retrieval. Produce records promptly when a regulator asks; slow responses raise questions about completeness.
- Apply legal hold when needed. When litigation or an investigation is reasonably anticipated, suspend deletion schedules for relevant records.
- Test your vendor by simulating an exam request, per the FINRA 2025 Report, as if responding to a regulatory inquiry. This reveals gaps before regulators find them.
- Keep WSPs specific about permitted and prohibited platforms. Generic policies are harder to enforce. Name the approved channels and explain the consequences of using unapproved ones.
FAQ
Does FINRA Rule 4511 apply to Registered Investment Advisers (RIAs)?
No. Rule 4511 binds only FINRA member firms (broker-dealers), not Registered Investment Advisers, which follow a separate SEC standard, Rule 204-2 of the Investment Advisers Act of 1940, with its own retention schedule. Firms dually registered as both must satisfy both regimes.
What are FINRA’s penalties for a Rule 4511 violation?
Published FINRA sanction guidelines put books-and-records fines at roughly $5,000 to $310,000 per case. A 2022 WhatsApp-use case resulted in a $15,000 fine; a 2025 undocumented-archiving case resulted in $65,000. Most published cases cite Rule 4511 alongside other violations, so the fine reflects the full scope of what examiners found, not the recordkeeping gap alone.
Are AI tools and chatbot interactions covered by Rule 4511 the same way off-channel texting is?
Yes. FINRA’s 2026 Annual Regulatory Oversight Report treats GenAI as falling under existing recordkeeping and supervision rules: customer-facing AI chatbot interactions count as firm communications that must be captured. See the GenAI section above for details.
Read Next:How to Meet FINRA Compliance and Retain Records in Line With SEC 17a-4 FCA Compliance: What Financial Firms Need to Know About Recordkeeping, Audits and Enforcement |
