SEC 17a-4, FINRA supervision, and AI-generated answers

SEC Rule 17a-4 requires broker-dealers to preserve their business records, including communications and any approvals of them, and to furnish them promptly on request. FINRA Rule 3110 requires every member firm to maintain a supervisory system, with written supervisory procedures, reasonably designed to achieve compliance with the securities laws. An AI assistant at a broker-dealer sits inside both at once. What it says may be a record you have to keep and produce. What it tells registered representatives and customers has to be supervisable. What survives an examination is not a claim about the model. It is an evidence trail on every answer: a named approver, a timestamp, a source, a version, and retention.

What Rule 17a-4 actually requires

Rule 17a-4 is the preservation half of the SEC's books-and-records regime. Rule 17a-3 specifies the records a broker-dealer must make; 17 CFR 240.17a-4 specifies how long they must be kept, in what form, and how quickly they must be furnished. The schedule is granular. Records covered by paragraph (a) must be preserved for at least six years, the first two in an easily accessible place. Paragraph (b)(4) reaches communications: originals of all communications received and copies of all communications sent by the firm, and any approvals thereof, relating to its business as such, preserved for at least three years, the first two easily accessible.

Two phrases that matter once AI is in the stack

Two phrases in (b)(4) matter once an AI assistant enters the stack. "Copies of all communications sent" contains no carve-out for machine-generated text. And "any approvals thereof" assumes the approval exists as a record: the rule contemplates communications that carry approvals, which is exactly the artifact most AI deployments cannot produce, because nothing in the pipeline ever held one.

The 2022 amendments: an audit trail instead of WORM

For over two decades the answer to electronic storage was write once, read many. Records went onto non-rewriteable, non-erasable media, and the format itself was the integrity argument. In October 2022 the SEC adopted amendments adding an audit-trail alternative. Under it, electronic records may instead be kept in a way that lets you re-create the original if it is altered, over-written, or erased.

What the amended rule text requires

The amended rule text spells out what that trail must contain. Under paragraph (f)(2)(i), an electronic recordkeeping system has two options. Keep records only in a non-rewriteable, non-erasable format. Or maintain a complete time-stamped audit trail. That trail has to capture every modification and deletion, the date and time of each action, who did it where that applies, and anything else needed to re-create the original. The record and its trail must also download in a human readable format and a reasonably usable electronic one.

What that list looks like from the knowledge side

Read that list with an AI knowledge base in mind, meaning the set of entries an assistant is allowed to answer from. The audit-trail alternative is a regulatory description of versioning with named actors and timestamps. The Commission modernized the rule to accept as integrity evidence exactly the structure a governed knowledge system produces in the ordinary course of operating: who changed what, when, and what the record said before. A firm whose assistant answers from a corpus with that structure is not inventing a novel compliance story for its examiner. It is holding the kind of trail the recordkeeping rule now names.

Rule 3110: supervision assumes a reviewable object

FINRA Rule 3110 requires each member to supervise the activities of its associated persons. The system has to be reasonably designed to achieve compliance with the securities laws and with FINRA rules. Three things fall out of that. Written supervisory procedures for the types of business the firm conducts. Registered principals with designated supervisory authority. Review of correspondence in and out, and of internal communications.

Why sampling outputs afterwards is a weak control

Every element of that structure presumes a reviewable object and a responsible person. A conventional communication has an author, a draft, an approval, and a file. An AI answer synthesized at query time from a live index of everything the firm has ever written has none of these. It did not exist until the moment it was served, no principal saw it before the recipient did, and by the time anyone asks about it, the sources it drew from may have moved or changed. Supervision by sampling model outputs after the fact is the only control that architecture allows, and it is a weak one, because the population being sampled is unbounded.

FINRA has said this out loud

FINRA has addressed generative AI directly. Regulatory Notice 24-09 reminds member firms that FINRA rules are intended to be technology neutral and continue to apply when firms use generative AI and large language models, just as they apply to any other technology, and that a firm using these tools should address technology governance as part of its supervisory system, including model risk management, data privacy and integrity, and the reliability and accuracy of the model. There is no AI exemption and no separate AI rulebook. The existing rulebook is the AI rulebook.

Where the exposure accrues

An ungoverned assistant creates exposure in three distinct places, and it is worth being precise about which is which.

• Books and records. If assistant output is a communication sent, or an internal record the firm must retain, the firm needs to preserve it and to be able to say what it was based on. Capturing the output is the easy half. An answer assembled on the fly from an unversioned index cannot be reconstructed later: the source documents moved, the copies changed, and no record states what the model saw. The retention question has an answer. The reconstruction question, for that architecture, does not.
• Supervision. Written supervisory procedures must cover the business the firm conducts. An assistant that answers from an unbounded corpus is conducting an activity no procedure can describe, because nobody can say in advance what it will rely on. A governed corpus inverts this: the procedures designate who approves each entry type, the assistant serves only approved entries, and review happens before use rather than by sampling after it.
• Communications with the public. FINRA Rule 2210 sorts communications into correspondence, retail communications, and institutional communications, and holds them to content standards: fair and balanced, a sound basis for evaluating the facts, no misleading omissions. Whether a given AI answer falls into a 2210 category is a determination for compliance and counsel, and firms are reaching different conclusions for different use cases. What no firm escapes is the content standard itself, and a model paraphrasing a stale disclosure is a content-standard failure however the output is categorized.

What an evidence trail looks like

Strip the vendor language away. An evidence trail is five fields on the entry each answer came from, plus the discipline that nothing is served without them.

• Approver. A named person holding the authority the firm's procedures assign, on the record for the specific entry. Not a system account, not a team alias.
• Timestamp. When the approval happened and when each version took effect, so the firm can state what was in force on any given date.
• Source. The document or system the entry derives from, so the answer traces to something the firm actually said.
• Version. Which revision the approval attaches to, with superseded revisions archived rather than overwritten. Supersession is what stops a stale answer everywhere at once.
• Retention. Approval events, version history, and served content exportable to the firm's retention systems, in a format a records request can actually use.

The order of operations is the point

The order of operations is the point. Review happens when the entry is approved, once, before anything is served. The assistant then serves only what passed the gate, and every answer inherits the entry's provenance: who approved it, when, and from what source. When the examiner letter arrives, the response is a query, not an archaeology project: this entry, this approver, this date, this version, and this is what it said on the date in question.

What no software can claim

No software makes a firm compliant with Rule 17a-4 or Rule 3110, and a vendor who implies otherwise is describing regulation incorrectly. The rules assess the firm: its procedures, its designated principals, its retention program, its conduct when records are requested. What a governed knowledge system supplies is evidence toward those obligations: the named approver, the timestamp, the source, the version history, and the export, in the structure the audit-trail alternative already describes. That framing is less exciting than a compliance guarantee. It is also the only framing an examiner will respect.

The structural point, without the vendor language

The structural point stands on its own. Index-in-place tools point at content wherever it happens to live, which means they cannot version it, approve it, or attest to it. Verification-workflow tools confirm that a card of content was reviewed on a cadence, without holding an approval on the specific answer served. If "who approved what this thing says" is a question your firm must answer with names and dates, the knowledge behind the assistant needs to be a system of record, a store that holds the approved version itself, and the answer needs to arrive carrying its trail.