A firm that keeps its regulated records in a vendor system has made an operational decision and inherited a contractual problem. The obligation to preserve those records, keep them accessible and produce them on request has not moved anywhere. The ability to meet it now depends entirely on what the agreement with the vendor says.
For broker-dealers, the electronic recordkeeping requirements under Rule 17a-4 of the Securities Exchange Act set out how records may be preserved, for how long, and what must be true about accessibility and audit trail. The rule was amended in 2022 to permit an audit-trail alternative alongside the longer-standing write-once approach, and it continues to contemplate undertakings from third parties holding a firm’s records.
What follows is not a reading of the rule, which regulatory counsel will do better. It is a look at the five contract terms that determine whether a firm can actually comply through its vendor, and how to hold those terms somewhere a supervisory examiner can be shown them without a document hunt.
Five contract terms that carry the recordkeeping obligation
These terms appear, in some form, in most well-drafted technology agreements. What is usually missing is the specificity, because a general assurance about data handling does not answer a question about retrieval within a stated period or access after termination.
- Retention period and format, the categories of record covered, the retention period for each, and the format and medium in which they are preserved and produced.
- Access, quantified, response times for routine, regulatory and litigation requests, the delivery formats available, and confirmation that access survives termination.
- Audit trail integrity, creation, modification, deletion and authorisation events with actor identity, preserved to the same standard as the records themselves.
- Third-party undertakings, the vendor’s commitment to furnish records to the firm and, where the regime requires it, to the relevant regulator on request.
- Exit and records return, agreed export format, delivery window, verification step and cost basis, settled at signature rather than during a transition.
Taken together these five turn a service description into a compliance control. Taken separately, the first four can look adequate while the fifth quietly makes the other four unenforceable the moment the firm wants to leave.
Retention periods routinely outlast vendor relationships. If access ends when the contract does, the firm is left owing production on records it can no longer reach. Post-termination access for the balance of the retention period, with the same response times and formats, is the single highest-value sentence in this clause set and is frequently absent from agreements that otherwise look thorough.
Making the terms operational
Signed terms do not demonstrate a working control. Examiners ask how the firm knows retrieval works, who checked, and when. That means a handful of recurring duties need owners and evidence.
- Hold the terms as fields, not prose. Retention period, record categories, access response times and regime should be searchable fields on the vendor record so the portfolio can be queried in one pass
- Test retrieval on a schedule. A periodic retrieval test against a real request, timed and documented, is the evidence that the access clause functions. Make it an obligation with an owner and a dated artefact
- Refresh the undertakings. Where undertakings or attestations are required, treat them as expiring documents with renewal dates in the register, in the same way insurance certificates are handled
- Reconcile record categories annually. Systems acquire new record types over time. An annual reconciliation between what the system holds and what the contract covers catches scope drift before an examiner does
- Rehearse the exit, on paper. Walk the records return process once, confirm the export format is usable and the volume is deliverable in the agreed window, and record the result. Doing this during an actual exit is too late
A five-step roadmap for bringing recordkeeping terms under control
Step 1, identify every vendor holding regulated records
Start from the record categories rather than the vendor list, because the systems holding regulated communications and transaction records are often not the ones procurement classifies as critical. Communications archiving, collaboration platforms, trade capture and client onboarding tools all commonly qualify.
Step 2, extract the five terms per agreement
Read each agreement for retention, access, audit trail, undertakings and exit, and record present, partial or absent with the clause reference. A portfolio matrix makes the pattern obvious, and the pattern is usually that exit and post-termination access are the systematic gaps.
Step 3, fix the template and the fallback positions
Write the five terms into the standard technology agreement and the negotiation playbook, with the minimum acceptable position stated for each. Reviewers then stop conceding post-termination access as a low-value point, which is how it usually disappears.
Step 4, remediate by record criticality
Prioritise agreements covering the record categories with the longest retention and the highest production likelihood. An amendment or side letter adding access and exit terms is usually achievable at renewal and sometimes mid-term, particularly where the vendor wants a term extension.
Step 5, instrument the recurring duties
Load retrieval testing, undertaking renewals, category reconciliation and exit rehearsal into the obligation register with role owners and required evidence. Report on them alongside the rest of the vendor oversight programme rather than as a separate records exercise.
Make recordkeeping terms examinable
Aavenir holds retention, access and audit trail terms as fields on the vendor agreement, with retrieval testing and undertaking renewals as tracked obligations.
Why this sits badly in most vendor programmes
Third-party risk programmes are generally built around information security, resilience and concentration. Those are the right concerns, and recordkeeping falls between them. It is not a security question, not quite a resilience question, and rarely owned by the team that negotiates technology agreements. The result is that firms with mature vendor oversight can still have a systematic gap on retention and post-termination access, because nobody’s checklist asked. Adding the five terms to the existing vendor contract control matrix is a smaller change than building a parallel programme, and it puts the evidence where examiners already look.
Term, operational test and evidence
The table pairs each contract term with the test that shows it works and the artefact that records the test. The right-hand column is what an examiner asks for, and the point of the exercise is that it exists before they do.
| Contract term | Operational test | Owner role | Evidence retained |
|---|---|---|---|
| Retention and format | Annual category reconciliation | Records management | Reconciliation report with exceptions |
| Quantified access | Timed retrieval test against a live request | Operations | Request, response, elapsed time |
| Audit trail integrity | Sample trail review for completeness | Internal audit | Sample results and any findings |
| Third-party undertakings | Validity check before expiry | Vendor manager | Current undertaking with dates |
| Exit and records return | Paper rehearsal of export and verification | Vendor manager | Rehearsal note and format confirmation |
Recordkeeping is unglamorous and tends to be deferred until an examination or an exit forces the issue. Both of those arrive on someone else’s timetable, and both reward firms that wrote five specific terms into the agreement years earlier. The terms are not expensive to negotiate at signature, the recurring tests are light, and the alternative is discovering during a transition that the records a firm still owes are in a system it no longer has a right to reach. Institutions already running structured obligation management for financial services can absorb these duties into the register they already operate.
For related guidance, see OCC and FFIEC vendor oversight, the contract controls, A DORA guide to ICT third-party contract registers and Advisory fee billing accuracy starts in the contract.
