Email archiving for broker-dealers
Business email is not useful as a record simply because it remains in a mailbox. Broker-Dealers need a defined process for identifying in-scope communications, preserving them in the appropriate electronic recordkeeping system, documenting supervisory activity, and retrieving the records they need.
Patrina brings email preservation, search, supervision, and review workflows together in one archiving environment designed for Broker-Dealers.
One connected archiving workflow
Broker-dealer email can span representatives, branches, shared accounts, and central teams. Patrina’s compliant archiving platform connects preservation and indexing with search, review, access controls, audit trails, and reporting.
This connected workflow helps authorized teams locate business email, route selected messages for supervision, and maintain a clear record of the review activity performed.
Patrina can help align supported mail environments, users, and account structures with the archive configuration. Patrina also supports importing historical email into the archive, helping firms bring prior records into the same searchable environment so important business communications are not left behind.
A defined source map gives operations and compliance a clearer view of which business correspondence is included in the archiving workflow.
For broker-dealers subject to SEC Rule 17a-4, electronic records must be preserved in a manner that protects them from alteration or erasure and supports accurate retrieval. Recordkeeping also involves requirements around serialization, time and date information, verification, and the ability to produce usable records.
Patrina’s archiving approach is designed to preserve business email as searchable records while maintaining the content and associated information needed to verify, review, and retrieve those records.
Search criteria, sampling, lexicons, and assignments help route selected messages for human review. Flags, escalation, and recorded reviewer activity help the team track each item through follow-up and disposition.
Patrina provides a structured environment for applying the firm’s review policies and maintaining a visible history of the supervisory work performed.
Saved searches, access controls, and reporting help authorized teams repeat defined queries and narrow the archive to relevant records. Audit information provides visibility into the search and review activity performed.
Patrina’s support team can also assist with complex queries and audit support when needed, with any applicable service charges discussed based on the scope of assistance.
“We use Patrina primarily to help us monitor email communication between the advisor and the client. In addition, we find Patrina useful in helping us monitor external text messaging.”
Joel A. Diaz
Managing Member, Anchored Wealth Management
From retention to review
Patrina’s archiving platform is designed to handle broker-dealer electronic records in accordance with applicable SEC Rule 17a-4 recordkeeping requirements, including controls for record integrity, verification, time and date information, serialization, and searchable indexing.
Patrina provides full indexing and the ability to save and repeat search criteria, helping authorized users quickly locate defined email populations for supervision, follow-up inquiries, and production requests.
During a demo, bring a sample of your firm’s typical request and Patrina will demonstrate how it uses email data to confirm searchable fields, query behavior, and the ability to reproduce relevant results.
Patrina provides configurable flagging lexicons, percentage-based sampling, and automated review assignments to help direct selected communications to the appropriate reviewers.
Patrina provides follow-up flags, reassignment and escalation tools, and a full audit trail to help document the supervisory review process.
The audit trail can help answer key questions: Who reviewed the message? When? What issue was identified? What action followed? During evaluation, ask Patrina to demonstrate the specific review events captured and reported.
Patrina provides group-based access controls and reporting capabilities for reviews and regulatory requests. These tools help limit access to appropriate reviewer populations and provide authorized teams with visibility into supervisory activity.
During evaluation, confirm that roles, permissions, report contents, and export controls align with the firm’s operating model.
Patrina supports legacy-message import to help firms bring historical email into the same searchable archive as current communications. This can help prevent important business records from being left behind when transitioning from an existing archive or email system.
During evaluation, confirm the content and metadata that can be imported, how completeness is validated, whether historical review information can be preserved, and the expected migration scope and timeline.
Bring one email source, one supervisory review population, and one representative production request. Patrina can demonstrate how the proposed configuration handles each step—from capture and search through review and retrieval—and identify any details that require product or compliance confirmation.
Confirm Email Sources and Capture Support
A broker-dealer's email archiving project begins with coverage, not storage capacity. The firm needs to identify where business email is sent and received, whose accounts are in scope, and which exceptions could create gaps in the record.
During discovery, Patrina can review your email environment, including users, shared mailboxes, message types, attachments, and other requirements, and explain the available capture and archiving approach.
A useful source inventory answers four questions:
Email is only one part of the firm’s broader communications inventory. If representatives use text, chat, social media, or collaboration tools for business, those channels need their own approved capture and supervision path. An email archive should not be assumed to capture them.
During discovery, confirm the capture method, completeness monitoring, attachment and metadata scope, shared and departed mailbox handling, exception reporting, and treatment of off-channel communications.
Bring Your Email Environment to a Patrina Discovery Call
The broker-dealer reality
An archiving decision affects compliance, supervision, IT, and the business units that generate email.
Each group views the requirement differently: IT focuses on mail flow, compliance on review populations, principals on supervisory decisions, and regulators on records that can be located and produced.
The archive should connect these perspectives without suggesting that software alone fulfills the firm’s recordkeeping obligations.
The firm’s email environment changes as people join, leave, change roles, add aliases, or adopt new tools. Distributed representatives and outside service providers can make those changes harder to track.
A configuration that is accurate at onboarding can become incomplete without a process for reconciling people, accounts, and permitted channels against what the archive is actually receiving.
The key question is not, “Do we archive email?” It is, “Can we account for the business email sources and populations covered by our policies, including changes and exceptions?”
Preservation protects the record and keeps it accessible for its applicable retention period. Supervision applies the firm’s written procedures to communications that require review.
One does not prove the other.
A large archive without a documented review process can leave a supervisory gap, while an effective review workflow cannot address communications that never entered the archive.
The implementation should clearly define which messages are preserved, which enter a review population, how reviewer activity is documented, and how significant issues are escalated.
A request may be defined by an associated person, customer, date range, domain, subject matter, or combination of criteria. Without effective indexing, permissions, and repeatable search, a firm may preserve the records but still struggle to isolate the responsive set.
Overbroad production creates unnecessary operational burden, while incomplete production creates uncertainty about what may have been missed.
The archive should support a disciplined path from question to search, from search to review, and from approved results to the required export or report.
Use a real handoff to evaluate fit, ownership and visibility.
The archive in operation
A scheduled review cycle begins for a defined business unit, representative group, or risk-based message population.
A registered principal, compliance reviewer, and archive administrator.
The firm applies the search, sampling, or lexicon criteria established in its procedures. The assigned reviewer examines the resulting communications, records the review activity, and routes significant items for follow-up.
Archive administration monitors access and capture exceptions without making the supervisory decision.
The firm maintains a traceable connection between the selected population, reviewer activity, and resulting action. This distinguishes a documented supervisory review from a message that was simply opened or stored.
The firm receives a request for communications involving specified people, dates, accounts, or subjects.
Compliance or legal leads the request, with an authorized archive user, IT as needed, and the firm’s designated production decision-maker.
The team translates the request into documented search criteria, confirms the scope with the responsible reviewer, refines the results as needed, and preserves the search logic. Before production, authorized personnel verify the output format, included metadata, and completeness against the approved scope.
The firm can document how it located the responsive records and produce them in the required format without relying on manual searches across individual mailboxes.
A customer complaint, internal escalation, or suspected policy issue requires the firm to reconstruct an email exchange.
Compliance, legal, the relevant supervisor, and an authorized investigator.
The investigator searches by participants, date range, and subject criteria available in the validated product configuration. Related inbound, outbound, and internal messages are reviewed in context, access is limited to the appropriate team, and follow-up is documented according to the firm’s approved process.
The team can reconstruct the relevant communication history while keeping the preserved records distinct from the findings or conclusions reached during the investigation.
Rules translated into operational questions
Broker-dealer recordkeeping requirements go beyond simply keeping copies of email. They address required records, electronic preservation, supervisory procedures, and the firm’s ability to locate and produce records when required.
What must be retained and how it must be preserved depends on the firm’s activities, the content and purpose of the communication, and the applicable rules.
This overview is provided for educational purposes, not as legal advice. Firms should evaluate these requirements against their specific facts and applicable rules.
FINRA Rule 4511 requires member firms to make and preserve books and records required by FINRA rules, the Exchange Act, and applicable Exchange Act rules. It also requires records maintained under FINRA rules to be preserved in a format and media that comply with Exchange Act Rule 17a-4.
For an archiving evaluation, “FINRA email archiving” should not be treated as a standalone product certification. The firm must identify the records created by its business and applicable rules, then determine whether its system and procedures preserve those records as required.
At a high level, Exchange Act Rule 17a-3 identifies records broker-dealers must make, while Rule 17a-4 addresses how those records and certain other broker-dealer records must be preserved.
FINRA’s Books and Records guidance explains that Rule 17a-4(b)(4) applies to originals of communications received and copies of communications sent that relate to the broker-dealer’s “business as such,” including internal and external electronic communications.
The content and business purpose of a communication matter. The fact that a message is an email does not, by itself, determine its retention requirement.
FINRA guidance describes a minimum three-year retention period for these business-as-such communications, with the first two years in an easily accessible place. This should not be treated as a universal retention setting for every record in an archive.
Other records may have different retention periods, and legal, regulatory, or firm-specific requirements may affect the applicable schedule. Retention should therefore be mapped by record category and aligned with the firm’s applicable requirements and policies.
FINRA Rule 3110 requires member firms to establish written supervisory procedures appropriate to their business, size, structure, and customers.
Its correspondence provisions address the review of incoming and outgoing written, including electronic, correspondence, as well as internal communications relating to the member’s investment banking or securities business.
The rule also requires specified reviews to be conducted by a registered principal and evidenced in writing. FINRA’s supplementary material indicates that review evidence should identify the reviewer, the communication reviewed, the date of review, and actions taken when significant regulatory issues are identified.
Simply opening a communication is not sufficient.
An archive can support this process through assignments, statuses, flags, and audit information. The firm, however, defines its review procedures and remains responsible for carrying them out.
The SEC’s 2022 amendments to Rule 17a-4 added an audit-trail alternative to the existing non-rewriteable, non-erasable preservation method commonly known as WORM.
Under the audit-trail method, the system must maintain a complete, time-stamped audit trail capable of recreating an original record if it is modified or deleted. The amended rule provides different compliance methods, each with specific requirements.
FINRA’s Books and Records guidance allows broker-dealers to use third parties to prepare or maintain records, while the firm remains responsible for meeting applicable FINRA and SEC requirements and overseeing the provider.
The amended Rule 17a-4 framework also establishes specific access and undertaking arrangements for electronic recordkeeping systems and certain third-party recordkeeping services.
These include alternatives involving a designated executive officer or designated third party, as well as different undertaking requirements depending on the arrangement.
A Third Party Letter of Undertaking addresses a specific part of the recordkeeping framework. It does not, by itself, satisfy every third-party recordkeeping obligation.
Regulatory Context
Requirements depend on the firm, its activities, the content and type of record, and the applicable rules. This content is provided for general information only and is not legal advice.
Broker-dealers should consult their compliance and legal professionals before selecting or configuring an electronic recordkeeping system.
A practical provider test
Treat the evaluation as a formal acceptance process, not a demonstration of a single convenient email. Require evidence for the selected Rule 17a-4 electronic recordkeeping method, the firm’s Rule 3110 supervisory process, timely access and production, and the applicable third-party and undertaking arrangements.
Document which party is responsible for demonstrating each requirement and identify any assumptions or open questions that remain before implementation.
Can the provider demonstrate a message from each approved email source and show how an ingestion failure or missing account becomes visible?
Inventory the mail systems, domains, aliases, shared accounts, and user populations in scope. Confirm how inbound, outbound, and internal email enters the archive, which message components are captured, and how the firm is alerted when expected content does not arrive.
Ask how new users, role changes, departures, aliases, and new domains are reconciled over time so capture remains aligned with the firm’s approved email environment.
Which Rule 17a-4 preservation method does the proposed configuration use, and what evidence can the firm examine to validate it?
Determine whether the electronic recordkeeping system uses the WORM method or a qualifying audit-trail alternative, and clarify which party is responsible for meeting each applicable requirement.
Review verification, timestamps, audit information, redundancy, retention controls, and the ability to recreate or reproduce records under the selected method. Do not treat a general “17a-4 compliant” statement as a substitute for understanding the underlying technical controls.
Can the firm reconstruct who reviewed a communication, when the review occurred, what was identified, and what action followed without relying on informal notes outside the workflow?
Map the firm’s written procedures to the product: population selection, sampling or lexicon criteria, assignment, review, escalation, disposition, and reporting. Identify which actions the archive records and which remain in another system.
Confirm that role design limits inappropriate self-review and provides the responsible principal with the visibility and oversight required by the firm’s procedures.
Can the firm’s authorized team repeat a query, explain its scope, validate the results, and produce the approved records without provider-only access or an undefined manual process?
Build a sample request using multiple criteria rather than a convenient keyword. Examine available search fields, date behavior, participants, saved queries, permissions, result validation, and export controls.
Confirm which human-readable and reasonably usable electronic formats are available, what metadata and audit information accompany the results, and how large productions are quality-checked before release.
If the firm changed providers, exactly what would it receive, in what format, with which metadata and audit information, and under what approved commercial terms?
Clarify who owns the records, how the firm accesses them during normal service and an outage, what undertaking arrangement applies, and what happens when the relationship ends. Review legacy import, full export, formats, metadata, audit information, timing, fees, and transition assistance in writing.
Validate claims about data ownership, portability, service levels, fees, and other commercial terms against the current agreement before treating them as commitments.
A strong demonstration should expose assumptions. If a provider cannot clearly show the boundaries between capture, preservation, supervision, and production, the firm has identified an issue to resolve before implementation.
Bring one real client or record journey and ask Patrina to show how the platform supports it.
Rule 17a-4 addresses communications received and sent that relate to the broker-dealer’s “business as such,” and FINRA guidance explains that this can include both internal and external electronic communications.
The content and business purpose of a communication matter; not every message is retained simply because it was sent or received by email.
The firm should map applicable record categories, business activities, and retention periods with its compliance or legal team, then configure the archiving environment to reflect that framework.
FINRA Rule 4511 generally requires member firms to make and preserve the books and records required by FINRA rules, the Exchange Act, and applicable Exchange Act rules. It also requires records maintained under FINRA rules to be preserved in a format and media that comply with Exchange Act Rule 17a-4.
Rule 17a-4 addresses the preservation of broker-dealer records, including requirements concerning the applicable preservation method, accessibility, and production.
Together, these rules make both record identification and the electronic preservation method important parts of an archiving evaluation; neither rule constitutes a vendor certification.
WORM remains one permitted preservation method under Rule 17a-4. The SEC’s 2022 amendments also provide an audit-trail alternative for an electronic recordkeeping system that maintains a complete, time-stamped audit trail capable of recreating the original record if it is modified or deleted.
A broker-dealer should confirm which preservation method its system uses and evaluate all requirements associated with that method. Patrina should confirm the preservation architecture used in the proposed deployment and the specific Rule 17a-4 requirements it is designed to address.
No. Mailbox backup is generally designed to restore data after loss, corruption, or service disruption.
Broker-dealer email archiving must be evaluated against the applicable requirements for preserving records, maintaining record integrity and accessibility, locating records, controlling access, supporting supervision, and producing records when required.
A backup can support business continuity and resilience, but a recoverable mailbox does not, by itself, demonstrate that the firm’s recordkeeping and supervisory workflows are satisfied.
An archive can provide the preserved communications and workflow tools needed to select a review population, assign reviews, document reviewer activity, escalate items, and report on completion. The firm’s written supervisory procedures determine what is reviewed, by whom, and how the review is documented.
Technology supports the supervisory process; it does not replace the registered principal’s responsibilities or turn stored email into evidence that a required review occurred.
Ask about capture scope, preservation method, record integrity, access, redundancy, audit information, search, production formats, supervisory workflows, security, business continuity, undertaking arrangements, service levels, and exit procedures.
Ask the provider to demonstrate these capabilities using a realistic business scenario rather than a prepared example.
Outsourcing recordkeeping activity does not transfer the firm’s responsibility to oversee the arrangement or satisfy applicable regulatory requirements. The firm should document the provider’s role, controls, responsibilities, and contractual commitments as part of its evaluation.
No product should be treated as a guarantee of FINRA or SEC compliance. An archiving system can provide capabilities that support record preservation, access, supervision, search, and production, but the broker-dealer remains responsible for appropriate policies, configuration, training, oversight, and execution.
Regulatory requirements depend on the firm’s activities and the records involved. Patrina can demonstrate its product capabilities and controls; the firm’s compliance and legal professionals determine how those capabilities fit the firm’s specific obligations.
See Patrina archiving in action
Bring a real process to the conversation. A focused demonstration can show the relevant product path, clarify configuration questions and identify what your team should validate next.