Cloud Services Agreements for Broker-Dealers: The Rule 17a-4 and FINRA Points

Updated October 2026 to cover the 2022 amendments to Rule 17a-4. First published March 2024.

When the SEC rewrote the electronic recordkeeping parts of Rule 17a-4 in 2022, one of the problems it set out to fix was the cloud. Broker-dealers were storing regulatory records on servers run by cloud providers, and the rule required whoever held a firm's records to sign an undertaking that many cloud providers said they couldn't sign. The adopting release, dated October 12, 2022, quotes commenters saying the files "are often encrypted and accessible only by the Regulated Entity." The amendments took effect January 3, 2023, and firms had to comply by May 3, 2023, according to FINRA's books and records page.

This post covers what a broker-dealer's agreement with a cloud provider needs to support under the SEC's rules and FINRA's guidance. It isn't a negotiation guide. Large providers rarely change their standard terms, so for each point the practical question is whether the provider's documents already cover it, and if not, how your firm meets the obligation another way.

1. The Rule 17a-4(i) Undertaking

Under Rule 17a-4(i), an outside entity that prepares or keeps a broker-dealer's required records has to file a written undertaking. The traditional version says the records are the broker-dealer's property, will be surrendered promptly on request, and may be examined by the SEC at any time, with hard copies on request.

The 2022 amendments added an alternative for the cloud case. If the records sit in an electronic recordkeeping system on servers the outside entity owns or operates, and the broker-dealer has independent access to them, the provider can instead undertake to "facilitate within its ability, and not impede or prevent" access, examination, download, or transfer of the records by the SEC and its designees, and by a SIPA trustee if the firm is liquidated. "Independent access" means your firm can reach the records regularly without the provider's involvement. The SEC's reasoning was direct: even when the firm holds the keys, the provider can block access, so the rule still applies.

What to confirm: that the provider has filed one of the two undertakings, or will, and that your configuration actually gives you independent access. And keep in mind paragraph (i)(2): the agreement doesn't relieve your firm of its own duty to make and keep the records.

2. The Recordkeeping System Itself

The undertaking covers the provider. The system that stores the records has its own requirements, and those are your firm's. Under Rule 17a-4(f), the system has to either keep a complete, time-stamped audit trail for the retention period or store the records in a non-rewriteable, non-erasable format, often called WORM. Your firm also needs an undertaking from a designated executive officer or a designated third party, filed with your designated examining authority. The amendments also require you to produce records in a reasonably usable electronic format.

A general-purpose cloud storage account doesn't meet these requirements until someone sets it up to. Retention locks, audit logging, and export tools have to be turned on and kept on, and someone at your firm has to own that setup. If you're relying on a provider's immutability feature, keep the documentation that shows how it's set up. Our guide to SEC Rule 17a-4 covers retention periods.

3. FINRA's Outsourcing Expectations

FINRA's starting point is still Notice to Members 05-48 from 2005: outsourcing "does not relieve members of their ultimate responsibility for compliance," and regulators should have the same access to the provider's work as if the firm did it itself. Regulatory Notice 21-29 (2021) lists questions your firm should be able to answer about any vendor, cloud providers included:

• Whether you assessed the provider's "ability to protect sensitive firm and customer non-public information and data," for example through its SOC 2 Type II report.
• Whether you evaluate the provider's controls over its own sub-contractors.
• Whether the contract covers "notification to your firm of cybersecurity events and the Vendor's efforts to remediate those events."
• What happens to your data at the end: "ownership and disposition of firm and customer data at the end of the Vendor relationship."
• Whether you have "contingency plans for interruptions or terminations of Vendor services."

Our post on reading a SOC 2 Type II report covers the first two.

4. Breach Notice Under Regulation S-P

If the provider holds customer information, the amended Regulation S-P requires your firm's procedures to make the provider notify you as soon as possible, and no later than 72 hours, after it becomes aware of a breach that resulted in unauthorized access to a customer information system it maintains. Your own 30-day clock for notifying customers starts when you become aware of the incident. The 72-hour term belongs in the contract or in the provider's standard security terms, and you should know which.

5. Getting Out

Exit terms matter more to a broker-dealer than to most cloud customers, because records must stay available for their full Rule 17a-4 retention period, which can outlast the contract. Before you sign, know how you'll get every record out, in what format, how long it will take, and how you'll prove the copy is complete. Then decide when the provider deletes its copies, and how it confirms that it has.

A Note on SaaS Vendors

A software vendor that keeps copies of records it processes for you raises the same questions in a smaller form. Our own position is on our vendor due diligence page: Loffa retains what it processes, with a time-stamped audit trail, but isn't your firm's books-and-records keeper, and your Rule 17a-4 obligations stay with your firm. Ask every SaaS vendor to state its position that plainly.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.