Broker-Dealer Compliance: Keep Records Audit-Ready

Broker-dealer compliance is the set of obligations a firm meets to operate honestly and stay accountable to regulators. It spans registration, supervision, and the books-and-records rules. And one corner of it now causes more enforcement pain than almost any other: the business communications your people send by text and chat.

This guide explains broker-dealer compliance in plain terms, then goes deep on the part most firms struggle with, so you can keep every business communication audit-ready.

What broker-dealer compliance actually covers

Broker-dealer compliance rests on a few pillars. A firm registers with the SEC and a self-regulatory organization, usually FINRA. It supervises its people through a written system of procedures. And it makes and preserves books and records, so a regulator can reconstruct what happened and when.

The first two pillars are well-trodden ground. Firms know to register and to write supervisory procedures. The third pillar, record keeping, is where the modern gap hides, because business now happens on devices the firm does not fully see.

This page is educational. It is not legal advice, and we are not a law firm or a compliance consultant. We are the record keeping layer that captures business communications so your records stay complete.

The short answer on business communications

Yes, business texts count. Under the books-and-records rules, a business-related communication is a record no matter the device or app used to send it. A text to a client about an account is a record, the same as a business email. So if your people conduct business by SMS, iMessage, or WhatsApp, those messages must be captured and preserved, and they must be available for supervision and audit.

That single principle drives most of the record keeping risk a broker-dealer carries today.

Where the records gap quietly opens

Here is the pattern regulators keep finding. A firm rolls out a capture tool nobody enjoys using. Adoption stays low. People naturally gravitate to the apps they already know, and business drifts to personal phones and unmonitored channels. Coverage quietly erodes as a few users go off-channel. Then a request arrives, the firm reaches for messages it never captured, and a books-and-records gap is suddenly in plain view.

The exposure rarely comes from bad intent. It comes from poor tool fit. A single tool forced on every user is the very thing some users reject, and rejection is what opens the gap. Therefore the fix is not more pressure. It is capture people will actually live with.

How firms close the communications gap

We solve this. The open question is never whether we capture your channels; it is which mix fits your environment best. That is the conversation a quick demo settles.

Capture every channel, your way

We compliantly capture SMS, iMessage, RCS, and WhatsApp business communications. Capture iMessage and RCS natively, with no app and no change to how people text, so blue bubbles, reactions, and media are all preserved. Capture WhatsApp Business and Messenger, in 1:1 and group chats, with no third-party app on the phone. On corporate-owned devices, capture business texts right at the carrier network, with nothing for employees to install. On personal phones, capture business texting through a secure app that keeps personal messages private.

A few honest boundaries keep expectations clear. Carrier capture runs on corporate-owned devices with a corporate billing plan, and it handles standard SMS, so iMessage and RCS are turned off on those lines. The personal-phone app uses a business number, either new or the one already on the card, not the employee’s personal cell number, and it does not route through iMessage. WhatsApp capture covers messages, media, and metadata, not calls placed inside the app. We map these trade-offs with you so each user lands on the right method.

Convert and deliver to the archive you already run

Whatever we capture, we convert to email format and deliver it to the journaling address of the archive you already trust, industry-leading archives like Intradyn, or any other. Nothing to rip out, nothing to refit. Each message arrives identified by type, with the employee side enriched with name, cell number, and corporate email, so you can supervise email and texts together in one search.

Match the right method to each user

Adoption is what actually closes the gap, and the right method per user is what drives adoption. So we match carrier capture, native capture, and the personal-phone app to the people and devices in your firm, instead of forcing one shape on everyone. You can also centrally set and enforce an SMS disclaimer on captured lines, on the cadence you choose.

So you can stand up complete capture without ripping out your archive or fighting your own people to use it.

The rules behind books and records

Accurate grounding matters more here than anywhere, so each rule below links to its primary source. Paraphrased plainly, here is what drives the obligation.

SEC Rules 17a-3 and 17a-4

Rule 17a-3 sets out the records a broker-dealer must create, and Rule 17a-4 sets out how long to keep them and how to preserve them (more on capturing texts under SEC 17a-3 and 17a-4 here). Many records are kept for six years, with the two most recent years readily accessible. The 2022 amendments modernized the format, so a firm may now use a complete, time-stamped audit-trail system as an alternative to the older write-once-read-many approach, with records produced in a reasonably usable electronic form. Business communications fall squarely inside this, whatever device sent them. See the SEC’s electronic-recordkeeping amendment guide and the rule text. Registered investment advisers fall under a related retention rule, Investment Advisers Act Rule 204-2.

FINRA Rules 4511 and 3110

FINRA Rule 4511 requires member firms to make and preserve books and records, defaulting to at least six years where no other period applies, in a format that complies with the SEC preservation standard (see our guide to FINRA 4511 retention). FINRA Rule 3110 requires a supervisory system reasonably designed to achieve compliance, including the review of correspondence and internal communications (see our guide to supervising texts under FINRA 3110). The two rules work as a pair. A firm cannot supervise what it cannot see, so messages have to be captured before they can ever be reviewed. Firms with commodities or EU activity also have parallel duties under CFTC Rule 1.31 and MiFID II, plus other applicable recordkeeping, retention, and supervision regulations.

Off-channel enforcement is active right now

This is not a theoretical risk. The SEC, joined by the CFTC, opened its off-channel communications initiative in 2021, looking at business messages sent on personal devices. Since then, more than 100 firms have been charged and over $3 billion in civil penalties paid for recordkeeping failures.

In one sweep on August 14, 2024, the SEC charged 26 firms with more than $390 million in combined penalties , and an earlier action on February 9, 2024 covered 16 firms and more than $81 million. Notably, regulators have pointed to firm-approved, captured messaging as the remedy. The message is not to ban mobile. It is to capture it properly.

Keep every communication audit-ready

Broker-dealer compliance comes down to a simple promise you make to regulators: the record is complete and you can produce it. Registration and supervision get you most of the way. The business communications drifting across texts and chats are what quietly put that promise at risk. Close that gap with capture your people will actually use, delivered into the archive you already run, and the audit becomes routine instead of a scramble. A Solutions Team expert can map the right mix for your environment, and capture runs about a third the cost of an iPhone. Explore compliant communications archiving on our solutions hub

---

This article is general information and education only, not legal or compliance advice. FINRA and SEC requirements change, and how they apply depends on your firm and situation. Confirm current obligations with your own qualified compliance or legal counsel and the primary regulations before you act.