ATF 4473 Digital Storage Compliance

Created by Ezra Weinstein, Modified on Tue, Dec 13, 2022 at 1:39 PM by Hannah Harris

Each item in this article represents the minimum ATF Compliance Standard together with what coreSTORE offers in its 4473 Maintenance Module and how we comply with these standards. The items on the left column are the ATF Minimum Standard in storing, processing, and accessing electronic 4473 forms. The column on the right are the compliance methods done by coreSTORE to meet the ATF Minimum Standards.

coreSTORE Compliance with ATF 4473 Digital Storage Requirements as of 4/4/22
(based on revised ATF Minimum Standards 5/4/21)

	*ATF Minimum Standard* https://www.atf.gov/firearms/digital-storage-form-4473	*Compliance Method in CoreSTORE*
1.	Licensees must provide written notification to their local ATF Industry Operations Area Office 60 days prior to implementing a digital Form 4473 storage system.	N/A
2.	Transactions must first be completed using an eForm 4473 and must be completed entirely in a digital environment in accordance with ATF Ruling 2016 2 (or subsequent Rulings).	4473s are created in the Bound Books section of the CoreSTORE site; all sections of the 4473 form along with accessible ATF instructions are provided to the user.
3.	Forms 4473 must be saved in an unalterable format. The original ATF Form 4473 must be retained and may not be deleted, amended, replaced or otherwise altered.	Information entered into the 4473 eForms is initially captured and stored in a MySQL database. A 4473 in the CoreSTORE system can be in one of two states: "complete" and "incomplete". A 4473 is considered "complete" if all non-optional information has been provided (that is, in a state where it would normally be submitted to the ATF), otherwise it is considered "incomplete". When a Complete 4473 is to be sent to the ATF, the CoreSTORE system fills out ATF E-Form 4473 (5300.9) using the data in the database and generates a PDF that can be attached as an email attachment to be sent to the ATF or may be printed manually. This PDF is also stored on an Amazon S3 external server and is linked to the 4473 record in the database. Complete 4473s are unalterable from the CoreSTORE interface (you can view but not change any of the information), but may be corrected if errors are found after submission (see below).
4.	If errors are found on a Form 4473, corrections may be made to a copy of the original Form 4473. This copy should be attached at the end of the original Form 4473, and all changes have initials, and dates must be visible on the corrected copy.	If errors are found, the 4473 record may be corrected through a "versioning" process; the record in the system is cloned and links to the original record, and the new version of the record may be edited. Each version of a 4473 record is linked to each other in the database. Complete 4473s automatically generate a PDF when a change is submitted; Incomplete 4473s will generate a PDF on demand. The PDF is created in a "stack" where the original (initial) Form 4473 is on top and each subsequent changed version is attached at the end of the previous version. The Form 4473 version number is printed in red text in the top-right corner of the Form 4473: Changes between the versions are easily identifiable by the initials and dates printed in red next to the area where data has been changed, for example:
5.	All supplemental forms for a transaction (Multiple Sales, etc.) must be electronically attached at the end of Forms 4473 for continuity and ease of review.	Supplemental forms (such as Form 3310.4/3310.12) are stored in the database as well, and are internally linked to the 4473 record(s) to which they apply. When the PDF is generated, any supplemental forms are attached at the end of the Forms 4473.
6.	ATF must be provided uninterrupted access to the system to facilitate a compliance inspection. ATF access during inspections must be in a “read only” capacity.	The CoreSTORE system contains an "ATF User" mode that provides restricted access and specific rights allowing that person access only to the Bound Book area (which includes review of 4473s). When the ATF User logs in, it automatically implements Read Only access, and viewing any Section includes a header that states you are in "ATF Mode".
7.	ATF must be provided access to the system with a minimum of one digital access point or computer terminal for every 500 Forms 4473 executed over the previous 12 month period.	N/A
8.	A filter (or wall) must be created to store Form 4473s for completed transactions separately from Forms 4473 transactions that were not completed and a background check was initiated (i.e. NICS denied the transaction). If Forms 4473 without retention requirements under 27 CFR 478.129(b) are stored, a filter (or wall) must be created to ensure they are segregated from Forms 4473 that are required to be retained (i.e. the customer answered “yes” to a prohibiting question and the store stops the transaction before a NICS check).	Complete 4473 PDFs that are uploaded to Amazon S3 are stored in separate folders based on their NICS result ("proceed", "denied", "canceled", "no_response", and "not_required") and these folders act as a wall between those that required a background check and those that did not. (There is currently no intention to store Form 4473s that do not follow 27 CFR 478.129(b) as PDFs (only in the database), but should this change we would store them in a separate folder on Amazon S3.)
9.	The system must allow Forms 4473 to be printed upon request from ATF.	Clicking on any button marked "PDF" in the Manage 4473 screen will open the relevant "stack" of Forms 4473 as a single PDF. If the Forms 4473 are Complete, the previously-stored PDF on Amazon S3 will be retrieved. If the Forms 4473 are Incomplete, a PDF will be dynamically generated from the data in the database. In either case, the PDF is displayed in a separate browser tab and can be printed.
10.	The system must store Forms 4473s in alphabetical, chronological, or numerical order.	The system stores 4473s in numerical order based on the 'id' field in the 4473 database table. Additionally the PDFs stored on Amazon S3 are stored in numeric order.
11.	The system must back up the storage of Forms 4473 upon the completion of a transaction or when a transaction is stopped and the Form 4473 must be retained.	This is being handled by the Amazon S3 system, which automatically backs up our storage area that contains the uploads of Forms 4473 PDFs.
12.	The system must allow access to Forms 4473 and the acquisition and disposition record simultaneously (toggle back and forth).	When browsing 4473 records through the Manage 4473 interface, you can choose to open Section A, which will display the Firearms Table where there is a clickable link next to each firearm to view the corresponding A&D record.
13.	The system must provide the ability to flag or set aside specific Form 4473s to save for further review during inspections.	The Manage 4473 screen includes a "flagged" column, allowing for the flagging/unflagging of records.
14.	The system must allow or provide sorting of Forms 4473 during ATF inspections.	The Manage 4473 screen allows for column-based sorting.
15.	Electronically completed Forms 4473 must be downloaded and saved to a computer hard drive, server, Compact Disc (CD), Digitial Versatile Disc (DVD), Universal Serial Bus (USB) Flash Drive or other similar electronic storage device located at the licensed premises. If the licensee utilizes a contract host facility such as a remote server or cloud storage provider, all Forms 4473 must also be electronically saved to an onsite electronic storage device that is updated on a daily basis to protect the data from accidental deletion or system failure. In all cases, electronically stored ATF Forms must be downloaded in a format that is unencrypted with the required information readily apparent and retained on a device that is located at the licensed premises in accordance with 27 CFR 478.121(a) for the length of time prescribed by §478.129.	A separate coreSTORE component (an application called "coreFFL Sync") installs a system task on one or more desktop computers. This task runs daily and backs up the 4473s from Amazon's S3 system to a local drive or mounted server. The files retrieved by this task are unencrypted PDF files, ready for viewing or printing.
16.	All previously completed hard-copy ATF Forms 4473 must be retained on the licensed premises in the manner and for the length of time prescribed by the regulations.	N/A
17.	Upon discontinuation of business, Form 4473s shall be submitted electronically to the National Tracing Center - Out of Business Records Center in a format suitable for imaging, such as a TIFF, JPEG, or PDF. If the forms are submitted in PDF format, the licensee shall ensure that Optical Character Recognition (OCR) and Intelligent Character Recognition (ICS) are turned off/disabled. The Forms shall be submitted on a media device such as a USB drive, CD, DVD, etc. and shall be stored per regulation (alphabetically, chronologically by disposition date, or by transaction serial number). The submission of electronic Forms 4473 does affect the current requirement per ATF Ruling 2016-1 to submit electronic A&D records in a text format.	All PDFs from the Amazon S3 system can be retrieved and sent to the National Tracing Center.

NOTES:

We are not currently including attachments to Section C (Q26a, Q26b) in the PDF output. The reasons for this are:

The paper Form 4473 does not provide any instructions for photocopying or attaching these to the Form 4473, just to show the identification or documentation to the transferor
Some identification methods (like some US Military IDs) actually have printed on them that they are not to be duplicated.