A Guide to Compliance Tools: Which Systems the Rules Require
Updated October 2026. First published March 2024.
The 2024 version of this guide listed nine kinds of software a firm would need for T+1, from trading platforms to cloud storage. It read like a shopping list. T+1 took effect on May 28, 2024, and the more useful question now is narrower: which compliance tools does a rule actually require, and which are a choice about how you produce evidence?
The split matters for budgets and for exams. A required system has properties a rule spells out, and an examiner can test each one. An optional tool is judged by the records it leaves behind.
Systems a Rule Describes
These rules describe what a system or program has to do. If your firm is in scope, you need something that meets the description, whether you build it or buy it.
| Rule | Who it covers | What it requires |
|---|---|---|
| SEC Rule 17a-4(f) | Broker-dealers that keep required records electronically | Records kept in a non-rewriteable, non-erasable format, or with a complete time-stamped audit trail that lets an altered or deleted record be recreated. Records produced in a reasonably usable electronic format on request. |
| SEC Rule 15c3-5, the Market Access Rule | Broker-dealers with market access, including those that give customers access through their MPID | Documented risk management controls and supervisory procedures, including pre-set credit or capital thresholds and checks that reject erroneous orders. The CEO certifies them each year. |
| FINRA Rule 6830 | Industry members that report to the Consolidated Audit Trail | Reportable events recorded as they happen and reported by 8:00 a.m. ET on the next trading day. |
| FINRA Rule 3310 | All member firms | An anti-money laundering program with procedures that can reasonably be expected to detect and cause the reporting of suspicious transactions, independently tested every year at most firms. |
| Regulation S-P, as amended in 2024 | Broker-dealers and other covered institutions | An incident response program that can detect, respond to, and recover from unauthorized access to customer information, with notice to affected individuals within 30 days. |
| FINRA Rule 4370 | All member firms | A written business continuity plan that covers data back-up and recovery and every mission critical system, reviewed each year. |
Two of these changed recently. In October 2022 the SEC amended Rule 17a-4(f) to add the audit-trail option next to WORM storage. It also let a designated executive officer, instead of an outside third party, give the undertaking to furnish records to regulators (SEC fact sheet). Broker-dealers had six months from Federal Register publication on November 3, 2022 to comply.
The Regulation S-P amendments, adopted in May 2024 (SEC press release), applied to larger firms from December 3, 2025 and to smaller firms from June 3, 2026. Both dates have passed, so an examiner can now ask to see the program.
Rule 3310 doesn't say "software." At any real volume, though, procedures that can reasonably be expected to detect suspicious transactions mean a surveillance system and a person who works its alerts.
Outcomes a Rule Describes, Where the Tool Is Your Choice
Most of the counterparty work in operations falls here. The rule sets the result and the deadline. It doesn't say how you send, track, or file.
- Letters of Free Funds. Under Regulation T, 12 CFR 220.8(c)(2)(ii) lets the executing broker avoid the 90-day freeze by relying on the custodian's written statement, accepted in good faith. The rule asks for the statement. It doesn't set a format or a channel.
- The quarterly securities count. Rule 17a-13 requires a count each quarter, verification of securities loaned, borrowed, pledged, failed, or in transit for more than 30 days, and recording of unresolved differences within 7 business days.
- Prime brokerage documentation. The SIA-150 and the F1SA are industry forms that put the conditions of the SEC staff's 1994 prime brokerage letter on paper. No rule says where you keep them.
"Your choice" doesn't mean there's no requirement. The request and the reply in each of these are communications under Rule 17a-4(b)(4), kept for three years, the first two in an easily accessible place. The tool you choose decides how long it takes to produce them. A shared mailbox can hold every letter and still take a week to answer one examiner request.
The Tool Stays Your Responsibility
Buying a tool for any item above doesn't move the obligation. FINRA's Regulatory Notice 21-29, from August 2021, repeats its earlier guidance that outsourcing an activity "does not relieve members of their ultimate responsibility" for compliance. Rule 4370 says the same thing in its own terms: if you rely on another firm for a mission critical system, your continuity plan has to address that relationship.
For the questions to ask a vendor before you sign, see How to Choose a Workflow Platform Your Examiners Will Actually Trust.
Build the Inventory
A one-page inventory answers most of what an examiner or a new COO asks about compliance technology. For each rule that applies to your firm, write down:
- The system or tool that does the work, and whether you built it or bought it.
- The person who owns it.
- The record it produces, and where that record is kept.
- When it was last tested, and by whom.
- What happens if it's down for a day, with a pointer to the section of the continuity plan that covers it.
Loffa's products sit in the second group. They handle the letters, the quarterly confirmations, and the prime brokerage forms exchanged between firms, and they keep the records they process. The Rule 17a-4 obligation for those records stays with your firm.
This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.