If an adviser or broker-dealer uses a channel for business communications, the SEC expects those messages to be captured, retained for the required period and produced on request. That includes email, Teams and Zoom chat, and text messages, and it applies whether the message was sent from an office computer or a personal phone.

Archiving used to mean journaling email to a vendor and forgetting about it. Since late 2021, the SEC's off-channel communications cases have made it clear that examiners look at every channel staff actually use, and that a policy prohibiting texting does not help if people text clients anyway. This article covers the recordkeeping rules, what a working archive setup looks like, and what examiners tend to ask for.

What the rules require

Investment advisers: Advisers Act Rule 204-2

SEC-registered advisers must keep originals of written communications they receive and copies of those they send relating to, among other things, recommendations made or proposed to be made and advice given, the receipt or disbursement of funds or securities, the placing or execution of orders, and performance. Electronic messages, including texts and chat, are written communications for this purpose.

The general retention period is five years from the end of the fiscal year in which the last entry was made, with the first two years in an easily accessible place, in an appropriate office of the adviser. Records kept electronically must be protected from loss and unauthorized alteration, and the adviser must be able to promptly produce them, including in a searchable form, when the SEC asks.

Broker-dealers: Exchange Act Rule 17a-4

Broker-dealers must keep communications relating to their business as such, generally for three years, the first two in an easily accessible place. FINRA Rule 4511 applies these requirements to member firms, and FINRA's supervision rules expect communications to be reviewed.

Rule 17a-4 also governs how electronic records are stored. Since the SEC's 2022 amendments, a broker-dealer can use either non-rewriteable, non-erasable storage, commonly called WORM (write once, read many) storage, or an electronic recordkeeping system that keeps a complete time-stamped audit trail of every modification and deletion, so the original record can be recreated. Either way, the firm has to be able to produce records promptly and keep them for the full period.

For background on which agency oversees which type of firm, see SEC and FINRA: who regulates financial firms.

Off-channel communications enforcement

Beginning in December 2021 and continuing through 2024, the SEC brought a long series of enforcement actions against broker-dealers and investment advisers for failing to preserve business communications sent through personal text messaging, WhatsApp, Signal and similar apps on personal phones. The CFTC brought parallel cases. Firms of many sizes paid penalties, and the orders typically required compliance consultants, policy reviews and ongoing reporting.

The common thread in these cases was that business communications happened somewhere the firm was not capturing, so the firm could not produce them when asked. The practical lesson for a smaller firm: decide which channels are approved, capture all of them, and have controls and training that make the unapproved ones the exception rather than the habit.

What a working archiving setup covers

Capture

• Email: all business mailboxes, including shared mailboxes and any mailbox for a departed employee, captured at the server level rather than from individual devices.
• Collaboration chat: Microsoft Teams, Zoom chat, Slack or Google Chat, if staff use them for anything client-related.
• Text messages: SMS and MMS from business phone numbers, whether through a business texting service, a cloud phone system, or a managed mobile app that captures messages on company and personal phones.
• Social media: business accounts on LinkedIn, Facebook, X and others, including direct messages if staff use them.
• Video and voice: if your firm records calls or meetings, or uses meeting chat, decide whether those recordings fall under your recordkeeping policy.

Retention and legal hold

• Retention set to the longest period that applies to your firm, typically five years for advisers, and longer where your policies or other rules require it.
• Records protected from editing and deletion during the retention period, by WORM storage or an audit trail.
• Legal hold that suspends deletion for specific people or topics when litigation, an exam or an investigation requires it.
• A defined process for what happens to the archive if you change archiving vendors, so records already captured stay retrievable.

Search and production

• Search by person, date range, keyword and channel, with results that can be exported in a usable format.
• At least two people at the firm who know how to run a search and export, so a request does not depend on one person being available.

Supervision and review

• A documented review process: who reviews which communications, how often, and how they record what they reviewed.
• Keyword or lexicon-based flagging for review, tuned to your firm so it surfaces useful items rather than noise.
• Records of the reviews themselves, kept with your other books and records.

Personal devices: policy, training and technical controls

Most off-channel problems start on a personal phone. A policy alone is not enough, and neither is technology alone. Firms that handle this well combine three things:

1. A written policy that names the approved channels for business communications, prohibits business use of everything else, and explains what to do when a client texts an unapproved number (respond on an approved channel and preserve the original message).
2. Training and attestations. Staff go through the policy at hire and periodically, and sign an attestation. Supervisors ask about it in reviews.
3. Technical controls. A business texting number or app that is captured automatically, mobile device management that separates work apps and data from personal ones, and conditional access so company email and files only open on enrolled devices. Our article on bring your own device (BYOD) explains how the separation works.

What examiners tend to ask for

• Your written recordkeeping and electronic communications policies and procedures.
• A list of the communication channels your firm permits, and how each one is captured.
• Evidence that capture works: sample searches, retention settings and reports showing each channel is still feeding the archive.
• Communications for specific people and date ranges, produced promptly.
• Records of supervisory review.
• Training records and staff attestations about personal device use.
• How you identify and remediate off-channel communications when they happen.

A common failure is an archive that worked when it was set up but quietly stopped capturing a channel after a license change, a new phone system, or a mailbox migration. Periodic checks catch this before an examiner does.

How NerdSquad helps

NerdSquad Managed IT Services, a Managed Service Provider (MSP) based in Naples, Florida, works with investment advisers, broker-dealers and wealth managers on the technology behind recordkeeping. Your compliance officer owns the policy and the review. We help put the controls, documentation and evidence in place:

• Setting up your archiving service and connecting it to Microsoft 365 or Google Workspace (see our Microsoft 365 support), collaboration chat and your business texting or phone system.
• Configuring retention and legal hold to match your written policy.
• Mobile device management and conditional access for company and personal phones.
• Checking that every channel is still being captured, especially after changes to licenses, mailboxes or phone systems.
• Making sure the right people at your firm can run searches and exports.

We also support the CRMs, portfolio and archiving platforms advisory firms use day to day; see financial platform support. For the cybersecurity side of the same obligations, read Regulation S-P amendments: what RIAs and broker-dealers must have in place.

NerdSquad is not a law firm. Confirm your firm's obligations with your compliance counsel.

Talk to NerdSquad

Already a client? Call (239) 465-0079 or submit a ticket. If something is down, call so we can start right away.

Not a client yet? NerdSquad Managed IT Services is a Managed Service Provider (MSP) based in Naples, Florida. We support businesses onsite across Southwest Florida and remotely nationwide. Book a discovery call or call (239) 465-0079.

Related: IT for financial advisers and wealth managers