By Michael Branson

Quick answer. As of September 2026, FINRA and SEC recordkeeping and supervision in Microsoft 365 is framed by three rules, each linked here to its official text and read at source on September 21, 2026. FINRA Rule 4511 requires books and records to be preserved “in a format and media that complies with SEA Rule 17a-4”; SEC Rule 17a-4 requires communications relating to the business to be preserved “for a period of not less than three years, the first two years in an easily accessible place”, and lets an electronic recordkeeping system keep records either with a complete time-stamped audit trail or in a non-rewriteable, non-erasable format, with verification, download and backup requirements on both branches; FINRA Rule 3110 requires procedures for the review of “incoming and outgoing written (including electronic) correspondence and internal communications”, with those reviews “conducted by a registered principal” and “evidenced in writing, either electronically or on paper”. In Microsoft 365, Microsoft Purview retention policies and labels address the preservation side across Exchange, SharePoint, OneDrive and Teams, and communication compliance supports the review side; your firm still decides its record classes, its 17a-4(f) branch and its written supervisory procedures, and evidences each one.

When your compliance officer says the next FINRA exam will ask for Teams chat records and for proof that electronic records are kept the way SEC Rule 17a-4 requires, the tenant you inherited was probably not built for that request. Retention policies set up years ago for litigation hold, meeting recordings that land in someone’s OneDrive, private channels nobody scoped, and no written decision on which 17a-4(f) branch the firm relies on: those are the gaps the request exposes. The sections below quote each rule at source, as read on September 21, 2026, map it to the Microsoft 365 capability Microsoft documents for it, and end with the evidence set an examiner is shown.

Where the obligations come from: FINRA 4511, SEC 17a-4 and FINRA 3110

If you are asked which rule a given Purview setting is there for, the answer starts with three texts, and each one does a different job.

FINRA Rule 4511 sets the general duty and points at the SEC rule for format. Its paragraph (a) reads: “Members shall make and preserve books and records as required under the FINRA rules, the Exchange Act and the applicable Exchange Act rules.” Paragraph (c) reads: “All books and records required to be made pursuant to the FINRA rules shall be preserved in a format and media that complies with SEA Rule 17a-4.” Paragraph (b) sets a default period: “Members shall preserve for a period of at least six years those FINRA books and records for which there is no specified period under the FINRA rules or applicable Exchange Act rules.”

SEC Rule 17a-4, 17 CFR 240.17a-4, sets the periods and the electronic format. Its paragraph (b) opens: “Every member, broker or dealer subject to § 240.17a-3 must preserve for a period of not less than three years, the first two years in an easily accessible place:” and paragraph (b)(4) covers “Originals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer (including inter-office memoranda and communications) relating to its business as such”. Because 17a-4(b) specifies a period for those communications, the six-year default in Rule 4511(b) is not the period that governs them; the floor in 17a-4(b) is three years, the first two easily accessible. Your records schedule may keep them longer, and that is a decision for your compliance function.

FINRA Rule 3110 sets supervision. Paragraph (a) requires each member to “establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules.” Paragraph (b)(4) requires “procedures for the review of incoming and outgoing written (including electronic) correspondence and internal communications relating to the member’s investment banking or securities business,” and closes: “Reviews of correspondence and internal communications must be conducted by a registered principal and must be evidenced in writing, either electronically or on paper.”

Read together, 4511 and 17a-4 are preservation rules and 3110 is a review rule. Keep them apart in your design: a retention policy preserves a message and says nothing about whether a principal reviewed it.

Which Microsoft 365 content is a record: Exchange, SharePoint, OneDrive and Teams

When a message moves from email to a Teams chat, the rule text does not move with the application. Paragraph (b)(4) describes communications “relating to its business as such”, so the question your compliance officer answers is what a message says and who sent it, and the workload it was sent through is a location question for IT.

Microsoft’s page Learn about retention policies and labels to retain or delete lists the locations a retention policy can cover, among them Exchange mailboxes, SharePoint sites, OneDrive accounts, Teams channel messages and Teams chats, and it names the reason firms use them: “industry regulations and internal policies that require you to retain content for a minimum period of time”. The same page says where the retained copy sits: for SharePoint and OneDrive sites, “The copy is retained in the Preservation Hold library.”

What this leaves with your firm is the record-class map: which categories of content are books and records, under which paragraph, for how long. Compliance and counsel decide the classes; IT maps each class to a retention policy or label and a location. The wider governance model this sits inside is described on the i3solutions page Embedding Governance into How the Enterprise Operates and Scales.

The 17a-4(f) decision: audit trail or non-rewriteable storage

If nobody at your firm has written down which branch of 17a-4(f) your electronic recordkeeping relies on, your retention design has no stated target. SEC Rule 17a-4(f)(2)(i) gives a broker-dealer two ways to keep an electronic record: (A) “Preserve a record for the duration of its applicable retention period in a manner that maintains a complete time-stamped audit trail”, covering modifications, deletions, the date and time of actions, if applicable the identity of the individual, and any other information needed to keep the audit trail secure and authentic enough to permit re-creating the original record if it is modified or deleted; or (B) “Preserve the records exclusively in a non-rewriteable, non-erasable format”. The branch decides the audit-trail or immutability evidence, not the whole design.

Both branches carry the same further requirements in 17a-4(f)(2). The system must “Verify automatically the completeness and accuracy of the processes for storing and retaining records electronically”; must “Have the capacity to readily download and transfer copies of a record and its audit trail (if applicable) in both a human readable format and in a reasonably usable electronic format”; and must either “Include a backup electronic recordkeeping system” or “Have other redundancy capabilities”. Under 17a-4(f)(3)(iv) the firm provides regulators “all information necessary to access and locate records preserved by means of the electronic recordkeeping system.”

Microsoft’s SEC Rule 17a-4 compliance offering page describes both branches against its own services. For the audit-trail branch, it names Microsoft Purview “Data Lifecycle Management, eDiscovery (Premium), and Audit (Premium)”. For the non-rewriteable branch, it names Office 365 with Preservation Lock. Microsoft also publishes independent assessment reports of named Azure and Microsoft 365 services against 17a-4(f)(2); those reports describe the assessed features and their configuration, and they describe Microsoft’s services, not your firm’s configuration.

Preservation Lock is the setting that turns the non-rewriteable branch into an irreversible choice. Microsoft’s page Use Preservation Lock to restrict changes to retention policies says a locked policy cannot be turned off, deleted or made less restrictive, including by a global admin, and that once locked, “Locations can be added but not removed” and “You can extend the retention period but not decrease it”. Lock a policy whose scope or period is wrong and the error is kept for as long as the lock holds, which is the over-build cost the Quick Answer’s firm-side decisions are there to prevent.

Two different undertakings sit inside 17a-4, and Microsoft treats them differently. Under 17a-4(f)(3)(v)(A) the firm must “Have at all times filed with the designated examining authority for the member, broker, or dealer the following undertakings with respect to such records signed by either a designated executive officer or designated third party”. Microsoft’s offering page says: “Microsoft doesn’t provide Third-Party Undertaking letters or services. The broker-dealer and SBS Entity organizations are responsible for (a) designating either an executive officer of the firm or a third-party, (b) obtaining the required undertaking, and (c) submitting the undertaking to its designated examining authority.” A separate undertaking, under 17a-4(i)(1)(ii), is the one a third party that prepares or maintains a firm’s electronic records files with the Commission when the firm represents that it keeps records electronically, has independent access to them, and can produce them to the Commission on request. For that undertaking Microsoft has a stated path: its offering page says “Microsoft has established a process to provide an undertaking for compliance with SEC Rules 17a-4(i)(1)(ii) and 18a-6(f)(1)(ii)”, worked as a support request through the Microsoft 365 admin center that ends with Microsoft creating and electronically signing the letter and filing it with the SEC. The (f)(3)(v) undertaking is the firm’s own to obtain and file; the (i)(1)(ii) undertaking, where it applies, is the one Microsoft states it will file itself.

Which branch your firm takes is a determination for your chief compliance officer and counsel, and it comes before any Purview configuration. Records that a custom line-of-business application creates are a different design problem, covered on the i3solutions page How to Choose a Custom App Development Firm for Financial Services. The Purview rollout itself is covered on Microsoft Purview Deployment Guide: A Readiness Playbook for Regulated Enterprises.

Supervision in Microsoft 365: FINRA 3110 and communication compliance

When the review of Teams messages is carried out by whoever has time rather than by the principal your procedures name, the gap is in the procedure, not in the tool. Rule 3110(b)(4) makes the written supervisory procedure the obligation and a registered principal the reviewer.

Microsoft’s page Learn about Communication Compliance states that communication compliance “provides the tools to help organizations detect regulatory compliance (for example, SEC or FINRA) and business conduct violations”, and that “Reviewers can investigate email, Microsoft Teams, Microsoft 365 Copilot and Microsoft 365 Copilot Chat, Viva Engage, or third-party communications”. Microsoft’s verbs are detect and investigate: the tool surfaces messages for a reviewer. It does not preserve them, which is the retention policy’s job, and it does not decide who the reviewer is, which is your procedure’s job.

Three things make the review defensible. The reviewers assigned in the communication compliance policy are the registered principals your written procedures name. The policy scope includes the locations your firm has approved for business communication, Teams among them. The review is evidenced in writing, electronically or on paper, as 3110(b)(4) requires. If the reviewer list in Purview and the names in your procedures disagree, your procedures decide, and the policy is changed to match them.

Teams communications: a retention and supervision checklist for financial services

The Teams finding at a broker-dealer exam is rarely the chat nobody retained; it is the channel nobody approved and nobody blocked either. Teams carries four separate retention surfaces, chats, standard and shared channels, private channels, and meeting recordings and transcripts, and each needs its own line in your design.

Microsoft’s page Learn about retention for Teams states that “Teams chats messages and Facilitator interactions in meetings, channel messages, and private channel messages can be deleted by using retention policies for Teams” and that “Any shared channels inherit retention settings from the parent team.” It also describes a change, dated toward the end of 2025, in where private channel messages are stored: before the migration they sit in user mailboxes and need their own location in a policy, and after it the Teams channel messages location applies to them, with private channels inheriting settings from the parent team. For recordings, the page is specific: “for files and Teams meeting recordings and transcripts from user chats, you need a retention policy that includes the organizer’s OneDrive account as the location.”

Condition What to configure Evidence Owner
Teams is used for business communications A written decision on whether Teams chat, channels and meetings are approved channels, reflected in the Teams policies assigned to users The approval memo and the policy assignments read from the Teams admin center Chief compliance officer, with IT
Chats and standard channels carry business messages Retention for the Teams chats location and the Teams channel messages location, each with the period the record-class map sets The retention policy settings exported from the Microsoft Purview portal, showing both locations IT records administrator
Private or shared channels exist Confirmation that shared and migrated private channels inherit the parent team’s settings, or policies scoped to the parent teams where private channels need different settings The policy scope listing the parent teams, from the Microsoft Purview portal IT records administrator
Meetings are recorded or transcribed A retention policy that includes the organizer’s OneDrive account as a location, or an auto-apply retention label policy for recordings and transcripts The OneDrive location or the label policy, from the Microsoft Purview portal IT records administrator
Users chat with people outside the firm A decision on external access and guest access, set under Users, External access in the Teams admin center The external access settings read from the Teams admin center IT, with compliance
Teams messages are subject to supervisory review Teams included in the communication compliance policy scope, with reviewers named from the written procedures The communication compliance policy settings, from the Microsoft Purview portal Chief compliance officer
Reviews have been performed A review record for each reviewed item, kept for the period the firm’s procedures set The review record, exported from communication compliance or kept in the supervisory system your procedures name Registered principal

When two rows pull in different directions, for example a team that wants private channels unscoped and a record-class map that treats their messages as communications, the record-class map settles it, because it is the document your compliance officer signs. Which container should hold which content in the first place is covered on the i3solutions page Microsoft Teams vs SharePoint: Which Is Right for a Regulated Enterprise’s Collaboration Needs.

What to hand an examiner

When the exam request arrives, the question behind it is whether you can show, rule by rule, what you configured and why. The evidence set that answers it has seven parts, each produced from a named surface:

  • The record-class map, signed by compliance, naming each class, its rule paragraph and its period.
  • The retention policy and label configuration, exported from the Microsoft Purview portal, with each policy traced to a record class.
  • The 17a-4(f) branch in writing, with how the system addresses the verification, download and backup requirements of 17a-4(f)(2) documented against it.
  • The 17a-4(f)(3)(v) undertaking on file with your designated examining authority, signed by a designated executive officer or a designated third party.
  • The information needed to access and locate records, as 17a-4(f)(3)(iv) requires, held where your designated officers can produce it.
  • The written supervisory procedures and the communication compliance policy that implements them, with reviewers named.
  • The review records showing each review was conducted by a registered principal and evidenced in writing, as 3110(b)(4) requires.

Honest counter-case: when Microsoft 365 is not the whole answer

If your registered representatives text customers from their phones or use a chat application outside the tenant, no Purview setting reaches those messages. Communications outside Microsoft 365 need their own capture, and the approved-channel decision in the checklist is what tells you whether they are permitted at all.

A firm that relies on a designated third party or an external archive for its 17a-4 recordkeeping has architecture decisions this guide does not make, including where the authoritative copy lives and which undertaking the outside entity files under 17a-4(i). The decision about what counts as a record belongs to your compliance and legal functions, not to IT; IT’s job is to make each of their decisions traceable to a configuration. And a SOC 2 examination is a separate obligation from FINRA and SEC recordkeeping, with its own criteria, covered on the i3solutions page Microsoft 365 Compliance Consulting: CMMC, HIPAA, SOC 2, and NIST for Regulated Enterprises. A firm licensed or registered by the New York State Department of Financial Services carries a further, separate obligation, an annual access-review floor under 23 NYCRR Part 500, covered on the i3solutions page mapping that regulation to Microsoft 365 and Entra ID.

How i3solutions approaches it

This page sets out a framework for making this decision; it does not describe work i3solutions has delivered on this specific question. If your task is to show an examiner which rule each setting answers, the work is mapping first and configuration second: which rule, which record class, which Purview control, and which piece of evidence, in that order. On a FINRA and SEC recordkeeping question, that means the three rules above mapped to record classes, retention and label policies, communication compliance scope and the evidence set, with the determinations that belong to your compliance officer and counsel left with them.

If you want your Purview configuration and your written supervisory procedures read side by side against 4511, 17a-4 and 3110 before the next exam request, the conversation starts here.

Contact a senior architect

Key Takeaways

  • FINRA Rule 4511, read at source on September 21, 2026, requires that “All books and records required to be made pursuant to the FINRA rules shall be preserved in a format and media that complies with SEA Rule 17a-4”, and that members “preserve for a period of at least six years those FINRA books and records for which there is no specified period under the FINRA rules or applicable Exchange Act rules”.
  • SEC Rule 17a-4, 17 CFR 240.17a-4, read at source on September 21, 2026, requires a broker-dealer to “preserve for a period of not less than three years, the first two years in an easily accessible place” the business communications its paragraph (b)(4) describes, and its paragraph (f) offers an audit-trail branch and a non-rewriteable branch that share the same verification, download and backup requirements.
  • The 17a-4(f)(3)(v) undertaking is the firm’s own, signed by a designated executive officer or designated third party and filed with the designated examining authority; Microsoft states it does not provide third-party undertakings.
  • FINRA Rule 3110, read at source on September 21, 2026, requires that “Reviews of correspondence and internal communications must be conducted by a registered principal and must be evidenced in writing, either electronically or on paper”; Microsoft Purview communication compliance supports that review and does not replace the procedure.
  • Teams needs its own lines in the design: chats, standard and shared channels, private channels, and meeting recordings and transcripts, which are retained through the organizer’s OneDrive.

Frequently Asked Questions

Do we need WORM storage for Microsoft 365, or is the audit-trail option enough?

If your firm keeps broker-dealer records electronically, SEC Rule 17a-4(f)(2)(i) offers two branches: a complete time-stamped audit trail, or a non-rewriteable, non-erasable format. Both carry the same verification, download and backup requirements, so neither branch is a shortcut. Microsoft’s SEC Rule 17a-4 page names Microsoft Purview Data Lifecycle Management, eDiscovery (Premium) and Audit (Premium) for the audit-trail branch and Office 365 with Preservation Lock for the non-rewriteable branch. Which branch your firm relies on is a determination for its chief compliance officer and counsel.

Are Teams meeting recordings books and records?

When a Teams meeting is recorded, whether that recording is a book or record is decided by your compliance function against the rule text, for example the communications described in SEC Rule 17a-4(b)(4). If the recording is classed as a record, Microsoft’s Teams retention guidance states that recordings and transcripts from user chats need a retention policy that includes the organizer’s OneDrive account as the location, or an auto-apply retention label policy that identifies those files.

Compliance wants Teams channels reviewed; how does communication compliance do that?

When compliance asks for Teams channel review, Microsoft Purview communication compliance is the tool Microsoft documents for it: its policies check communications, including Microsoft Teams messages, for matches so that designated reviewers can investigate them. FINRA Rule 3110(b)(4) sets the rest: the review follows your written supervisory procedures, is conducted by a registered principal, and is evidenced in writing, electronically or on paper. The reviewers named in the policy are the principals your procedures name.

What do we show an examiner to prove our Microsoft 365 retention works?

When an examiner asks about Microsoft 365 retention, the answer is a set of records produced from named surfaces: the record-class map signed by compliance, the retention policy and label configuration exported from the Microsoft Purview portal, the written 17a-4(f) branch decision with its verification, download and backup documentation, the 17a-4(f)(3)(v) undertaking on file with the designated examining authority, the information needed to access and locate records, and the supervisory review records showing each review was conducted by a registered principal and evidenced in writing.