SEC 17a-4(f)(3)(v): Designated Third Party

Asqav fits the unaffiliated designated-third-party (D3P) slot that SEC 17 CFR § 240.17a-4(f) sets out for broker-dealer electronic records. The signing service is independent of the broker-dealer, the receipt format is published in an IETF Internet-Draft, and the verify key is publicly retrievable.

The 2022 amendments to the rule (SEC Release No. 34-96034) give a broker-dealer two ways to execute the required undertakings: arrange for a designated third party (D3P) unaffiliated with the broker-dealer, or designate an internal executive officer to do it. The D3P route is one of the two alternatives, not a blanket requirement. Where a broker-dealer chooses the D3P route, Asqav supplies the unaffiliated-party operational property.

What the rule sets out: two alternatives for the undertakings. One is a designated third party, unaffiliated with the broker-dealer, who can access and download the electronic records. The other is an internal designated executive officer.

Where Asqav fits: the D3P alternative. A separate legal entity that signs each record under independent key custody and serves a published verification procedure.

Status to flag: Asqav provides the operational property today. The formal Letter of Undertaking with the SEC is not yet filed (see below).

What the rule says

SEC 17 CFR § 240.17a-4(f)(3)(v) describes the designated-third-party arrangement, in relevant part:

The member, broker, or dealer must have in place an arrangement with a designated third party (a person that is not affiliated with the member, broker, or dealer) who has access to and the ability to download information from the member's, broker's, or dealer's electronic recordkeeping system. 17 CFR § 240.17a-4(f)(3)(v)

A broker-dealer that picks the D3P route, rather than the internal designated-executive-officer route the 2022 amendments added, takes on this arrangement. The clause "a person that is not affiliated" is the structural property that disqualifies self-attestation in that route: a broker-dealer cannot be its own D3P, and a vendor that is contractually or operationally controlled by the broker-dealer in a way that defeats the unaffiliated-party test is also disqualified.

Asqav is incorporated as a separate legal entity, operates its signing service on its own infrastructure for the multi-tenant deployment, and holds receipt records under custody terms that the broker-dealer cannot retroactively modify. That is the unaffiliated-party property the D3P alternative describes.

How Asqav fits the D3P role

Asqav provides the operational property the D3P slot calls for:

Commercial terms (SLA, data-processing addendum, inbound-regulator response window, named-contact clause) are negotiated per engagement. Contact info@asqav.com for the templates and the response-window commitment.

The operational guarantees Asqav provides are:

The D3P role in 17a-4 originally arose for paper records, and there are established D3P services for paper records under the historical regime. Asqav addresses the analogous slot for AI agent action records, which is a category the original D3P providers do not cover.

Status of formal SEC recognition

Asqav has not yet filed a Letter of Undertaking with the SEC. The Letter of Undertaking is the formal mechanism by which a D3P provider asserts to the regulator that it accepts the operational obligations the rule requires.

The operational obligations Asqav already provides match what a Letter of Undertaking commits to: the unaffiliated-party property, the access-and-download ability, the records-retention period, and the response-to-regulator commitment. The filing is sequencing, not a feature gap. Customers running production workloads on Asqav obtain the operational property today. The Letter of Undertaking adds the formal recognition that closes the regulatory paper trail.

This is the only place in this docs cluster where Asqav documents a not-yet step explicitly. Asqav is candid about it because broker-dealer compliance teams will ask, and the honest answer is the only useful answer.

The 6-year retention requirement

17 CFR § 240.17a-4(b) sets the retention period for electronic records of broker-dealer activity at six years, with the first two years in an easily accessible place. AI agent action receipts that touch the broker-dealer's order, customer, or compliance pipeline fall under this retention rule.

Asqav's signing system uses ML-DSA-65 (NIST FIPS 204) post-quantum signatures over each receipt. A receipt signed under the current Asqav signing key remains independently verifiable across the full retention window without re-signing. See Post-quantum signed receipts for the threat model and the algorithm choice.

Adjacent rules in the same regulatory cluster

Asqav's signed-receipt layer is the evidence the (f)(3)(vi) senior-officer attestation rests on. The receipts demonstrate that the recordkeeping system actually preserved the action, that the action was signed at the time it happened, and that the signature can be independently verified.

How to wire Asqav into a 17a-4 compliance posture

  1. Identify the AI agent action surfaces that touch the broker-dealer's order, customer, or compliance pipeline. These are the surfaces that the audit-trail rule covers.
  2. Wire the Asqav SDK at each surface so that every action produces a signed receipt before the action takes effect. The SDK defaults to compliance_mode=True. Receipts that lack the required fields are rejected at the signer.
  3. Engage Asqav for the commercial terms that cover the D3P role: the SLA, the data-processing addendum, the inbound-regulator response window, and the named-contact clause. Contact info@asqav.com.
  4. Export the receipt set on a schedule the broker-dealer's compliance team agrees to. The default is daily, retained for the full six-year window.
  5. The compliance team writes the senior-officer attestation referencing the Asqav receipt set as the audit-trail evidence layer.

Customer security or legal questions about the D3P arrangement: info@asqav.com.