WORM Archiving
WORM stands for Write Once, Read Many: a storage method in which data, once written, cannot be altered or deleted until a defined retention period expires. In financial services it is the traditional way firms preserve marketing records, including website content, in tamper-evident form for examiners.
WORM storage exists to answer one question convincingly: what did this record say on a given date, and can you prove it has not been changed since. Modern implementations achieve this through object lock features in cloud object storage or through purpose built archiving vendors.
The broker-dealer requirement
WORM has historically been associated with Exchange Act Rule 17a-4(f), which governed how broker-dealers may preserve records electronically. In 2022 the SEC amended that rule to permit an audit-trail alternative alongside the traditional WORM approach, giving firms a second compliant path.
The investment adviser picture
Registered investment advisers are governed by Advisers Act Rule 204-2, which requires retention of advertising and other records for specified periods but is written differently from the broker-dealer electronic storage rule. Many advisers adopt WORM style archiving as a practical matter rather than because a rule prescribes that specific mechanism.
What a website archive should capture
A defensible website archive captures rendered pages rather than database exports, preserves linked assets, records cryptographic hashes so integrity can be demonstrated, timestamps each capture, and can be restored and searched on demand.
Because the applicable requirements differ by registration type and firm, confirm your obligations with your CCO or counsel rather than relying on a general definition.
Why it matters for marketing
Most website vendors treat archiving as somebody else's problem, which is precisely why it is a differentiator. A website is a marketing record, it changes constantly, and unlike an email it leaves no natural trail of what it used to say.
The operational point is that archiving has to be wired to the publish event, not run as an occasional crawl. If a page goes live Tuesday and changes Thursday, a weekly crawl never saw Tuesday's version. Publishing should trigger capture automatically.
The commercial point is that this converts compliance from a promise into a deliverable. A dated evidence pack containing a capture manifest and an approval log is a tangible artifact a CCO can hand to an examiner. That is a product, and it can be priced as one.
Common questions
Do investment advisers have to use WORM storage for their website?
Requirements differ by registration type. WORM has been closely associated with the broker-dealer electronic recordkeeping rule, which the SEC amended in 2022 to also permit an audit-trail alternative. Registered investment advisers fall under a differently worded recordkeeping rule and often adopt WORM style archiving as a practical control rather than a prescribed mechanism. Confirm your firm's obligations with your CCO or counsel.
Why does a website need archiving if it is already backed up?
Backups are built for recovery and are typically overwritten, mutable, and organized around the database rather than the rendered page. An archive is built for evidence: it captures what a visitor actually saw, timestamps it, hashes it so integrity can be proven, and prevents alteration for a retention period. A backup answers whether you can restore the site. An archive answers what the site said on a specific date.
Related terms
This entry is general information for marketers and does not constitute legal, compliance, or investment advice. Confirm your specific obligations with your compliance officer or counsel before acting on it.