Sec Speeches Cryptocurrency Burying the Technologically Primitive WORM: Open Meeting on Broker-Dealer Electronic Recordkeeping Requirements

The Commission finally is considering the adoption of a rule that will allow broker-dealers[1] to retire the antiquated systems using CD-ROMs or other similar write-once-read-many (or, appropriately primitive, WORM) technology that our current rules require.

This day has been long in coming. The current rule, which was adopted in 1997, specified that a broker-dealer must preserve its records “exclusively in a non-rewriteable, non-erasable format.”[2] This requirement was more flexible than the proposal, which had specified that firms keeping records electronically had to use “optical storage technology.”[3] Commenters on that proposal objected that the requirement was overly restrictive.[4] In the adopting release, the Commission acknowledged these concerns. Noting that other technologies also were “available in a WORM, non-rewriteable version,” the Commission declined to “specify[] the type of storage technology that may be used,” and instead established standards that the storage media had to satisfy to be acceptable under the rule.[5] In other words, the Commission moved from a proposed approach that would have required optical storage technology because it recorded data in a non-rewriteable, non-erasable manner to a final rule that simply articulated an apparently technologically neutral standard that specified only that the medium needed to be in a non-rewriteable and non-erasable format.

The standard soon showed its true colors. Only six years later, the Commission found it necessary to respond to repeated requests from broker-dealers that suggested that the original rule was not as technologically neutral as the Commission initially thought. Broker-dealers were asking “for guidance on whether this requirement limits them to using optical platters, CD-ROMs, DVDs, or similar physical mediums to achieve” preservation of their records “exclusively in a non-rewriteable and non-erasable format” as required under rule 17a-4.[6] The Commission explained that the rule “does not require that a particular type of technology or method be used to achieve the non-rewriteable and non-erasable requirement” and that a broker-dealer could use an integrated system of hardware and software control codes to comply with the rules.[7] However, the Commission expressly excluded from this interpretation any system that relied exclusively on software controls, as they do not prevent modification or destruction of records and thus were not compliant with the rule.[8]

Given the limitations of this interpretation, it appears that many, perhaps most, broker dealers continued to use various forms of optical storage technology to meet the requirements of rule 17a-4,[9] notwithstanding its many deficiencies. Many broker-dealers incur significant costs to maintain a system that has little or no business use; that may be incapable of capturing, in a usable form, the types of dynamic information that contemporary information systems produce; and that, by all appearances, regulators almost never use.[10] Significantly, broker-dealers bear these burdens while investment advisers and CFTC-regulated entities, some of which are also registered as broker-dealers, do not.

Given the inflexibility and costs of our current rules, I am happy to see this recommendation come before the Commission. The rule provides what appears to be a viable, less expensive, and more useful alternative to WORM that I hope will benefit both our regulated entities and the Commission as it supervises and examines them.

At the same time, our experience with the rule we adopted in 1997 nags at me. The release we are considering states that one of the goals of this rulemaking is to make the requirement “more technology neutral.” I hope these amendments achieve this goal, but, to be frank, our experience over the past quarter century with the existing rule leaves me in doubt. As commenters pointed out, even in the mid-90s, it would have been foolish to assume that optical storage technologies would continue to be a commonly used form of storage. Many people probably thought that a standard that required records to be kept in a non-rewriteable, non-erasable format would be much more durable. As I have already described, we had to revisit this question six years after we finalized the current rule. As a consequence, both firms and the Commission have been burdened with an expensive, obsolete, and probably, as a practical matter, unusable storage methodology for the better part of two decades.

What guarantees do we have that a rule that requires an “audit trail” will be any different? If the past twenty-five years have taught us anything, it is that technological developments consistently surprise us all. I hope that “audit trail” is sufficiently expansive to include all future technological solutions to identify changes to records and to reconstructing earlier versions of altered documents, but I fear that audit trail is to 2022 what WORM was to 1997.

We could be far more confident in the staying power of our rule if we were instead considering a principles-based approach that specified the objective we expected firms to achieve and allowed them to find the best technology available to them to reach this goal. For example, we could have specified that a broker-dealer needs to be able, upon request from the Commission, to retrieve any record it is required to maintain, as of any date specified by the Commission. This kind of rule would ensure that firms are capable of doing what we expect them to be able to do under the rule we are considering today. For many of them, an audit trail might be the best solution. For others—or for firms doing business a decade from now—other, more economical solutions might be available. Under a principles-based approach, the Commission could hold any firm liable for not maintaining a system capable of producing records required under the rules, but would not hold firms liable for failing to have systems that checked particular technological boxes.

Notwithstanding these concerns, I believe that this rule represents an improvement over our current, outdated requirement and am happy to support it. To be clear, however, I view this as an initial step toward a truly principles-based, technologically neutral future where our registrants are free to find the best solutions available to meet our regulatory requirements.

I would like to express my thanks to the staff for all the hours they have spent engaging with market participants to find a way to move beyond WORM, in discussing recordkeeping with me, and in drafting this rule.