RIA compliance is the set of SEC rules a registered investment adviser (RIA) has to follow under the Investment Advisers Act of 1940.
The core RIA compliance requirements are an up-to-date Form ADV, written compliance policies under Rule 206(4)-7, a chief compliance officer (CCO) who runs them, a code of ethics, an annual review of the program, and books and records kept under Rule 204-2.
Every part of the program produces records, and an SEC exam tests the program through those records.
For client communications, Rule 204-2 follows what a message says, so a text or WhatsApp message about a client trade has to be kept the same way an email would be.
Form ADV and Client Disclosures
Form ADV is the adviser’s registration form and its main disclosure document for clients.
Part 1A goes to the SEC through the Investment Adviser Registration Depository (IARD). Part 2A is the brochure on services, fees, conflicts, and disciplinary history. Part 2B is the brochure supplement on the individuals who give advice, and Part 3 is Form CRS, the relationship summary for retail investors.
Rule 204-1 requires advisers to amend Parts 1 and 2 at least once a year, within 90 days of the end of the fiscal year, and more often when the Form ADV instructions call for it. Rule 204-3 sets the delivery schedule.
New clients get the current brochure before or when they sign the advisory contract, and existing clients get a new brochure or a summary of material changes within 120 days of fiscal year end whenever something material has changed.
For a firm with a December fiscal year end, that puts the annual amendment around the end of March and client delivery around the end of April. Rule 204-2(a)(14) also requires the firm to keep every version of the brochure, supplements, and Form CRS, along with a record of the dates each one went to clients.
When delivery happens by email, the sent messages are often the simplest proof of those dates.
Compliance Policies, the CCO, and the Code of Ethics
Rule 206(4)-7 makes it unlawful for an SEC-registered adviser to give advice unless it has written policies reasonably designed to prevent violations of the Advisers Act, reviews them at least once a year, and names a chief compliance officer to run them.
The rule doesn’t list what the policies have to cover, so each firm builds them around its own business, clients, and conflicts. Deficiencies under this rule are among the most common the SEC’s exam staff cites, according to its risk alert on adviser compliance programs.
The rule itself only requires the CCO to be a supervised person of the firm.
The SEC’s adopting release for the compliance rule adds that the CCO should be “competent and knowledgeable regarding the Advisers Act” and have full authority to develop and enforce the firm’s policies. The CCO runs the annual review and usually coordinates the firm’s response to an exam request list.
Rule 204A-1 adds a written code of ethics.
It has to set a standard of business conduct that reflects the firm’s fiduciary duty, require staff to follow federal securities laws and report violations to the CCO, and require access persons to report their personal holdings and trades. Holdings reports are due within 10 days of becoming an access person and once every 12 months after that, and transaction reports are due within 30 days of each quarter end.
Access persons also need the firm’s approval before buying into an initial public offering or a limited offering.
Every supervised person has to acknowledge the code in writing, and Rule 204-2(a)(12) and (a)(13) require the firm to keep the code, those acknowledgments, records of violations, and the access person reports.
Advertising Under the Marketing Rule
The Marketing Rule governs how advisers advertise their services, and it replaced the old advertising and cash solicitation rules, with compliance required from Nov. 4, 2022.
An advertisement includes any communication that offers the firm’s advisory services to more than one person, so most website pages and social media posts that promote the firm fall under the rule.
The rule sets seven general prohibitions, such as making a material claim the firm can’t back up, and it allows client testimonials and endorsements when the required disclosures and oversight are in place.
Performance claims carry the most specific requirements.
Gross returns can’t appear without net returns shown with at least equal prominence, and performance for anything other than a private fund has to cover one-, five-, and 10-year periods.
Each of these pieces leaves records behind. Rule 204-2 requires a copy of every advertisement, the records behind any performance figures, documentation showing why the firm believed each testimonial, endorsement, or third-party rating complied, and a record of the intended audience for hypothetical performance.
The SEC’s 2026 exam priorities no longer list the rule as a separate focus area, which WilmerHale reads as a sign that examiners now treat it as part of every standard review.
What SEC Exams Actually Ask RIAs to Produce
An SEC exam is where every part of an RIA compliance program gets tested against your records.
The Division of Examinations reviews about 15% of registered advisers each year, according to its September 2023 risk alert on how exams are scoped. Most exams open with a letter and an initial request list, and unannounced exams can start with a request handed over on arrival.
The initial request goes well past Form ADV.
The risk alert’s attachment lists the compliance policies in effect during the exam period, annual and interim compliance reviews, the record of compliance exceptions, and client complaints and correspondence. It also asks how the firm monitors that correspondence, including electronic communication, and for marketing materials posted on websites, blogs, and social media.
Speed matters once the request arrives. Rule 204-2(g) requires advisers that keep records electronically to index them so any single record can be found, and to produce copies promptly when examiners ask.
A firm that has to pull texts from individual phones, or ask former staff for their chat history, will struggle to meet that standard.
The SEC’s off-channel sweep showed what falling short can cost.
Since fiscal year 2022, the SEC brought 95 actions and $2.3 billion in penalties against firms that failed to keep off-channel communications, according to its fiscal year 2025 enforcement results.
Current SEC leadership has criticized that approach, but the rule those cases enforced is still in force and still on the exam request list.
Which Client Communications RIAs Have to Keep
Rule 204-2 lists the books and records every SEC-registered adviser has to keep “true, accurate and current,” from ledgers and order memos to advertising and code of ethics records. For communications, the paragraph that matters most is 204-2(a)(7).
It covers written communications the adviser sends or receives that relate to:
- Any recommendation or advice given, or proposed to be given
- Any receipt, disbursement, or delivery of funds or securities
- Placing or executing an order to buy or sell a security
- Predecessor performance, or the performance or rate of return of managed accounts, portfolios, or securities recommendations
This scope is narrower than SEC Rule 17a-4, which requires broker-dealers to keep communications relating to their business as such.
Kirkland & Ellis makes the same point in its review of the off-channel cases. The narrower scope only helps if the firm can show which messages fell within it, which in practice means capturing every business channel first and classifying messages afterward.
These communications have to be kept for at least five years from the end of the fiscal year of the last entry, in an easily accessible place, with the first two years in an appropriate office of the adviser.
Advertising, performance records, compliance policies, and organizational documents each run on their own retention clock under Rule 204-2.
Why Personal-Device Texting Is the Live Off-Channel Risk for RIAs
Off-channel communications are business messages sent on channels the firm doesn’t capture, such as personal text messages, iMessage, WhatsApp, and Signal.
The SEC’s off-channel sweep began with broker-dealers in December 2021 and reached standalone advisers in April 2024, when Senvest Management agreed to a $6.5 million penalty.
The Senvest order is worth reading because the firm had already banned the behavior.
Its policies banned business communications on any messaging service the firm didn’t retain, and they even allowed the firm to inspect employees’ personal devices for off-channel messages. Staff at various levels still sent thousands of business messages from personal devices between January 2019 and December 2021, including messages about recommendations and advice.
Two details in the order apply to almost any RIA.
At least three senior officers had their phones set to delete messages after 30 days, so the firm couldn’t recover some of the messages it was required to keep. The firm also never checked whether staff followed its own ban, and the SEC charged that gap as a separate violation of Rule 206(4)-7, the compliance rule, and as a failure to supervise.
The order also found that some employees skipped the pre-clearance step the firm’s code of ethics required for their personal trades. The SEC charged that under the code of ethics rule, Rule 204A-1, as well.
Where enforcement stands now
The SEC’s posture has changed since the January 2025 settlements.
In its April 2026 enforcement results, the current Commission said the off-channel cases identified no direct investor harm and called them a misallocation of resources. Its regulatory agenda lists a deregulatory project to propose amendments to Rule 204-2 covering the scope of electronic communications advisers must keep, with October 2026 as the target date for a proposal.
As K&L Gates points out, the rule stays in force as written until it’s amended, and examiners will expect advisers to follow it.
Even the narrowest version on the table keeps client texts in scope.
The industry’s own reform request, a SIFMA letter to SEC Chairman Paul Atkins, asks the SEC to limit adviser retention to communications with clients and other outside parties that relate substantively to investment advice.
A client texting an adviser’s personal phone about a trade falls inside that definition, which keeps personal-device texting the live risk whichever way the rule goes.
RIA Compliance Checklist for the Annual Review
Rule 206(4)-7 requires advisers to review their compliance policies at least once a year, covering both whether the policies are adequate and how well they’re implemented.
The rule doesn’t prescribe a written report, but Rule 204-2(a)(17)(ii) requires advisers to keep any records documenting the review, and examiners ask for those reviews along with any reports prepared.
Work through the checklist below during the review and file the evidence for each item.
Program documents
- Form ADV annual updating amendment filed within 90 days of fiscal year end, plus any interim amendments the instructions require
- Brochure or summary of material changes delivered within 120 days of fiscal year end, with a record of the dates each client received it
- Every version of the compliance policies and code of ethics in effect in the past five years, with signed staff acknowledgments
- Holdings and quarterly transaction reports from every access person, with approvals for any initial public offering or limited offering purchases
Records to keep
- Written communications about advice, recommendations, trades, and client funds or securities, from every channel staff use with clients
- Advertisements and other marketing material, plus the records behind any performance figures they show
- Records documenting each annual compliance review
- Regulation S-P incident response policies and records of how any unauthorized access to customer information was handled
Storage and retrieval
- Retention settings checked against the Rule 204-2 period for each record type
- A duplicate copy stored separately, with a test restore from it
- Access rights reviewed and limited to staff who need them
- A legal hold process that stops deletion for records tied to an exam, complaint, or dispute
Off-channel controls
- A written policy naming the channels approved for client communication, with dated staff attestations and training records
- Capture in place for every texting and messaging app staff use with clients, including personal phones used for business
- Monitoring that checks whether staff follow the policy, with the lexicon or sampling rules documented
- A log of business messages found outside approved channels, how each was recovered, and the retraining or discipline that followed
Annual review evidence
- A channel inventory showing every client channel and whether it’s captured
- Capture tests that trace sample messages from each channel into the archive, dated and signed off
- Surveillance results showing the alerts reviewed and how exceptions were closed
- A timed retrieval drill showing the firm can find and produce a specific record on request
How Jatheon Handles RIA Recordkeeping and Off-Channel Capture
A written ban on texting doesn’t create a record, and a client who texts an adviser’s personal phone isn’t going to switch to a separate app.
Jatheon captures iMessage and WhatsApp natively, with no wrapper app for advisers or clients to adopt. Edits and deletions are stored alongside the original messages, so anything Jatheon has captured stays in the archive even after a 30-day auto-delete setting clears it from the phone.
Exam requests rarely stop at one channel.
Jatheon’s Data Connectors bring email, chat, social media, voice, and files from more than 25 channels into one archive, and Unified Search runs a single query across all of them. When examiners ask for every communication with a client over a set period, the compliance team runs one search and exports one result set instead of collecting from each system.
Rule 204-2 retention periods differ by record type, and a deleted record can’t be recovered once an exam starts.
Retention Tags apply the right period to each record type automatically, and Legal Hold suspends deletion for anything tied to an exam, complaint, or dispute. Audit Logs record user actions in the archive, including searches and exports, which gives the annual compliance review a dated evidence trail without a separate tracking spreadsheet.
