Opens in a new tab

SEC Rule 204-2: Books and Records Requirements for Investment Advisers

Natasa Djalovic

SEC Rule 204-2

SEC Rule 204-2, also called Advisers Act Rule 204-2, is the books and records rule for SEC-registered investment advisers (RIAs).

It lists the financial, client, communications, and compliance records an adviser must keep and sets how they’re stored.

Most records must be kept for five years after the end of the fiscal year of the last entry, with the first two in an appropriate office.

Books and Records Required Under SEC Rule 204-2(a)

Paragraph (a) of Rule 204-2 lists the records every SEC-registered adviser must keep.

Paragraphs (b) and (c) add records for advisers that hold client assets, manage portfolios, or vote proxies.

Record typeParagraphWhat it covers
Financial records and ledgers(a)(1), (a)(2), (a)(4) to (a)(6)Journals, ledgers, bank statements, bills, trial balances, and financial statements
Order memoranda(a)(3)Each order or client instruction, who recommended it, and who placed it
Written communications(a)(7)Messages about advice, client funds or securities, orders, and performance
Discretionary accounts and client agreements(a)(8) to (a)(10)Discretionary accounts, powers of attorney, and written agreements
Advertising and performance(a)(11), (a)(15), (a)(16), (a)(19)Advertisements, testimonial and endorsement records, performance calculations, and intended audience records
Code of ethics and personal trading(a)(12), (a)(13)The code, violations, acknowledgments, access person reports, and trade approvals
Form ADV and brochure delivery(a)(14)Brochures, supplements, and Form CRS, with the dates each went to clients
Compliance records(a)(17)Compliance policies, annual review records, and internal control reports
Political contributions(a)(18)Covered associates, government clients, contributions, and paid solicitors
Customer information safeguards(a)(25)Regulation S-P policies, incident records, and notification decisions
Custody records(b)Transaction journals, client ledgers, confirmations, and securities positions
Managed accounts and proxy voting(c)Each client’s purchases, sales, and positions, plus proxy policies and votes

Most of these records live in accounting, trading, and compliance systems. The ones that end up in an email or messaging archive are mainly the written communications in paragraph (a)(7) and the advertisements in paragraph (a)(11).

Email Archiving and Other Written Communications Under SEC Rule 204-2(a)(7)

Paragraph (a)(7) covers written communications an adviser sends or receives about advice or recommendations, client funds or securities, orders to buy or sell, and performance. The rule judges a message by what it says, so the same test applies on every channel. That test decides what email archiving for SEC Rule 204-2 has to capture, and the table shows how it applies by channel.

ChannelWhat has to be keptParagraph
EmailMessages on the four (a)(7) topics, plus newsletters and notices sent to 10 or more people(a)(7), (a)(11)
Text messages, iMessage, and WhatsAppMessages on the four topics, including those sent from personal phones used for business(a)(7)
Microsoft Teams, Slack, and other chatMessages on the four topics(a)(7)
Social mediaPosts that promote the firm’s services and direct messages on the four topics(a)(7), (a)(11)
WebsitePages that promote the firm’s services(a)(11)
Phone calls and video meetingsNot required, though written or recorded materials used in an oral ad must be kept(a)(11)

Calls are out of scope because paragraph (a)(7) applies only to written communications, but a follow-up email or text about the same trade is in. Unsolicited market letters and similar mass mailings that nobody prepared for the adviser are also excluded.

The device doesn’t change the answer, so a recommendation sent from an adviser’s own phone has to be kept like one sent from the firm’s email. That makes text messages on personal phones one of the harder channels to capture.

Since paragraph (a)(7) depends on topic, some firms try to keep only the messages that qualify. Sorting messages by topic when they’re sent rarely works, so most firms capture email, texts, and chat platforms like Microsoft Teams in full and apply retention rules afterward.

Posts and web pages that promote the firm count as advertisements under the Marketing Rule, so paragraph (a)(11) requires a copy of each version the firm puts out. Because pages change often, firms usually archive their website on a schedule and capture social media as it’s posted.

“Promotional website content falls under the Marketing Rule, and the recordkeeping rule requires an adviser to retain a copy of every advertisement it disseminates. […] Having no copies is the problem because website pages change often. When an examiner asks six months later what a page said on a particular day, the answer is usually a screenshot, if somebody remembered to take one.”

Marko Dinic

Marko Dinic

CEO of Jatheon

How Long and Where Advisers Must Keep Records

Under paragraph (e)(1), most records must be kept in an “easily accessible place” for five years from the end of the fiscal year in which the last entry was made. For the first two of those years, they must be in an appropriate office of the adviser.

Some records run on their own clock. For advertisements and performance records, the five years start at the end of the fiscal year the adviser last sent the communication out, as paragraph (e)(3) sets out. The code of ethics and compliance policies are kept for as long as each version is in effect and for five years after.

Organizational documents have a longer rule. Partnership articles, articles of incorporation, charters, and minute books stay in the adviser’s principal office until at least three years after the firm ends, as paragraph (e)(2) requires.

What “appropriate office” means for a cloud archive

The rule was written for paper files, so it doesn’t say how an office applies to records stored online. In a 2009 no-action letter, SEC staff said a record is kept in an appropriate office if the adviser has essentially immediate access to it from a computer at that office.

A cloud archive can meet that test when staff can open any record from the office on demand.

When an adviser closes

The obligation continues after the business ends. Before it stops operating, an adviser must arrange for its records to be preserved for the rest of each retention period, as paragraph (f) requires.

It must also tell the SEC in writing the exact address where they’ll be kept.

Electronic Storage Requirements in Rule 204-2(g)

Paragraph (g) allows records to be kept on electronic storage media if the adviser meets a set of conditions. The table maps each one to what the archive has to do. A separate condition covers scanned paper originals, which must be complete, true, and legible when retrieved.

Rule 204-2(g) conditionWhat the archive has to do
Arrange and index records so any one can be located, accessed, and retrievedIndex every record and search all channels in one query
Promptly provide a legible, true, and complete copy, a printout, and a way to view and print recordsExport records in the format they’re stored in, with metadata intact
Store a separate duplicate copy for the full retention periodKeep a redundant copy in separate storage
Safeguard records from loss, alteration, or destruction and limit access to authorized staff and the SECUse role-based access controls and audit logs that show who opened, searched, or exported records

The rule doesn’t define “promptly,” but the SEC addressed it in its 2001 adopting release. It said a delay of more than 24 hours should happen only in unusual circumstances, and that advisers who can produce a record within a few hours are expected to.

WORM storage and dual registrants

Rule 204-2 doesn’t require WORM (write once, read many) storage.

The SEC considered a WORM requirement in the same 2001 release and decided against it, so any system that meets paragraph (g) can work.

Under paragraph (h), dual registrants can keep records to the SEC Rule 17a-4 standard instead, and those records count under Rule 204-2 when they’re substantially the same.

Rule 204-2 vs. SEC Rule 17a-4 vs. FINRA Rule 4511

Advisers keep records under Advisers Act Rule 204-2, while broker-dealers follow SEC Rule 17a-4 and FINRA Rule 4511. Dual registrants have to meet all three.

RequirementRule 204-2SEC Rule 17a-4FINRA Rule 4511
Applies toSEC-registered investment advisersBroker-dealersFINRA member firms
Communications in scopeWritten communications on advice, client funds, orders, and performanceAll communications about the business, including internal onesRecords required by FINRA rules, kept to the SEC Rule 17a-4 standard
Retention5 years for most records, the first 2 in an appropriate office3 years for communications and 6 for blotters and ledgers, the first 2 easily accessible6 years for FINRA records with no other set period
Storage formatAny system that meets paragraph (g)WORM or an electronic system with a complete audit trailThe SEC Rule 17a-4 format

Communications are where the rules differ most. A broker-dealer keeps every business message for three years, while an adviser keeps messages on four topics for five.

What the SEC Has Proposed for 2026

The SEC’s 2026 regulatory agenda lists a proposal to amend Rule 204-2 that would address which electronic communications advisers must keep, with a target date of October 2026.

The proposal follows the SEC’s off-channel cases against advisers, which made message capture a central part of RIA compliance requirements. Until a change is adopted, the current rule applies as written.

Separately, an October 2026 crypto custody proposal would add new custody records to the rule.

How Jatheon Supports Rule 204-2 Recordkeeping

Jatheon covers each condition paragraph (g) sets for electronic records:

  • Unified Search: Examiners usually ask for a specific set, such as every message with one client over a date range. Unified Search runs one query across email, texts, chat, and social media, so the full set comes back at once.
  • Export: A request isn’t met until the examiner has the records. Search results export as production-ready sets, so a complete copy can go out within minutes.
  • Retention Tags, global retention, and Expunge: Rule 204-2 periods differ by record type. Global retention sets the firm-wide default, Retention Tags apply other periods to specific records, and Expunge removes records once their period ends.
  • Legal Hold: Records tied to an exam, complaint, or dispute can’t be deleted on schedule. Legal Hold overrides retention and Expunge until the hold is lifted.
  • Audit Logs: Paragraph (g)(3) asks advisers to limit and safeguard access to their records. Audit Logs record user actions in the archive, including searches and exports, which gives the firm a dated trail to show examiners.
  • WORM storage: Firms that also operate as broker-dealers can keep records in WORM storage built for the SEC Rule 17a-4 standard, which also covers Rule 204-2 under paragraph (h).
Jatheon Unified Search results for one client across email, text, and WhatsApp messages, filtered by date range.

Jatheon helps SEC-registered advisers capture, retain, and produce business communications from email, text, chat, and social media in one archive. Get a demo to see how it works with your firm’s channels, or email sales@jatheon.com.

FAQ

When does the five-year clock start under Rule 204-2?

The clock starts at fiscal year-end, so records usually stay on file for more than five years. For a firm with a calendar fiscal year, a message sent in January is kept for close to six years. A ledger or client file that keeps getting new entries doesn’t start its clock until the last one is made.

Does Advisers Act Rule 204-2 apply to state-registered or exempt reporting advisers?

It applies to advisers registered, or required to register, with the SEC. State-registered advisers follow their state’s rules, and some states, such as Louisiana, adopt Rule 204-2 by reference. Exempt reporting advisers aren’t subject to Rule 204-2, but the SEC can still examine them and require records under Section 204 of the Advisers Act.

Do internal emails between staff count?

Rule 204-2 is less explicit here than the broker-dealer rule. SEC Rule 17a-4 names inter-office communications, while paragraph (a)(7) covers messages the adviser sends or receives without mentioning them. The SEC’s off-channel cases against advisers still counted internal messages about firm business, so many firms keep internal messages about advice and trades.

Do comments on the firm’s social media posts count?

Comments from clients and other users usually aren’t the firm’s advertisement, so they don’t have to be kept under paragraph (a)(11). That changes if the firm adopts a comment, for example by sharing it. An adviser’s reply that gives advice is a written communication under paragraph (a)(7), so it has to be kept.

Can records be stored with a third-party vendor?

Rule 204-2 doesn’t prevent it, and SEC staff confirmed in a 2009 no-action letter that advisers can use a third-party recordkeeper. The adviser stays responsible if the vendor fails, so the vendor’s system has to meet every paragraph (g) condition, including prompt production and a separate duplicate copy.

What are the penalties for violating Rule 204-2?

An exam that finds recordkeeping gaps usually ends with a deficiency letter the firm has to answer. When the SEC brings an enforcement case, settlements typically include a civil penalty and a censure. Senvest Management, the first standalone adviser charged in the off-channel sweep, paid $6.5 million in 2024 over unarchived messages.

Schedule Your Personal Demo

HS trigger