Books and records requirements for investment advisers

Rule 204-2 under the Investment Advisers Act requires an SEC-registered adviser to make and keep a defined list of records, true, accurate and current, and to preserve most of them for at least five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the adviser. Records may be kept electronically if the firm can find them, produce them promptly and protect them from loss or alteration.

The rule applies to every adviser registered or required to be registered with the SEC under Section 203, whatever its size. The code of ethics, the Marketing Rule, the compliance program and Regulation S-P each have a paragraph in Rule 204-2 saying which of their records must be kept, so most of an examiner's request list traces back to this rule.

What records the rule requires

Paragraph (a) lists the records. They fall into a few groups.

Financial and business records

• (a)(1) and (a)(2): journals, including cash receipts and disbursements, and general and auxiliary ledgers.
• (a)(4) to (a)(6): check books, bank statements, cancelled checks, cash reconciliations, bills and statements (paid or unpaid), trial balances, financial statements and internal audit working papers.
• (a)(10): every written agreement with a client or otherwise relating to the advisory business.

Trading and client account records

• (a)(3): a memorandum of each order and each client instruction, showing its terms, who recommended the transaction, who placed the order, the account, the date and the broker. Discretionary orders must be marked as such.
• (a)(8) and (a)(9): a list of discretionary accounts and the powers of attorney or other evidence of discretionary authority.
• (c)(1): for clients receiving supervisory or management services, a record of each client's purchases and sales, and the ability to say promptly which clients hold a given security and how much.
• (c)(2): if the firm votes proxies, its voting policies, proxy statements, votes cast, documents material to each decision, and client requests for voting records with the responses.

If the adviser has custody of client funds or securities, paragraph (b) adds a transaction journal, a separate ledger for each client, copies of confirmations, and a position record showing which clients hold each security and where it is held.

Communications

Rule 204-2(a)(7) requires originals of written communications received and copies of those sent that relate to:

• any recommendation made or proposed, or advice given or proposed
• any receipt, disbursement or delivery of funds or securities
• the placing or execution of any order to buy or sell a security
• predecessor performance and the performance or rate of return of managed accounts, portfolios or securities recommendations

Since the SEC's move to T+1 settlement (Release 34-96930, compliance date 28 May 2024), (a)(7)(iii) also requires, for transactions subject to Exchange Act Rule 15c6-2(a), each confirmation received and each allocation and affirmation sent or received, with a date and time stamp.

The list is defined by subject matter, not channel. A text or WhatsApp message about a recommendation is a written communication under (a)(7) just as an email is. In April 2024 the SEC charged Senvest Management LLC, a registered adviser, over business discussed on personal texting and messaging apps that it did not preserve, with a civil penalty of 6.5 million dollars (press release 2024-44). See the guide to off-channel communications.

Compliance program records

• (a)(12): the code of ethics, records of violations and the action taken, and each supervised person's written acknowledgment of the code.
• (a)(13): access person holdings and transaction reports, the list of access persons, and each decision (with its reasons) approving an access person's purchase in an IPO or limited offering. See the guide to code of ethics requirements.
• (a)(14): each Form ADV Part 2 brochure and brochure supplement, each Form CRS, every amendment, any separate summary of material changes, and a record of the dates each was given to a client or to a prospective client who became one.
• (a)(17): the compliance policies and procedures adopted under Rule 206(4)-7, any records documenting the annual review, and any internal control report obtained under the custody rule.
• (a)(18): for firms that advise government entities, the pay-to-play records: covered associates, government entity clients and investors, and political contributions in chronological order.
• (a)(25): the Regulation S-P records added in 2024: the safeguards and disposal policies, the incident response and service provider oversight policies, documentation of each incident and the response, any investigation into whether notice was required and its basis, and copies of notices sent.

Paragraphs (a)(20) to (a)(24), added for the 2023 private fund adviser rules, are now reserved: after the rules were vacated on 5 June 2024, Release IA-6773 (89 FR 91252) removed them, effective 19 November 2024.

Marketing records

• (a)(11): a copy of each advertisement the adviser disseminates, directly or indirectly, and of any communication sent to ten or more people other than its own staff. For oral advertisements, the firm may instead keep the written or recorded materials used. It must also keep any questionnaire or survey behind a third-party rating, if it obtains a copy.
• (a)(15): records of the testimonial and endorsement disclosures (if not in the advertisement itself), the documentation of the firm's reasonable basis for believing a testimonial, endorsement or third-party rating complies with the Marketing Rule, and the names of affiliated persons whose testimonials or endorsements rely on the rule's exemption for them.
• (a)(16): everything necessary to form the basis for, or demonstrate the calculation of, any performance shown in a communication to anyone outside the firm. For managed accounts, keeping the complete account statements and the worksheets behind the calculation satisfies this.
• (a)(19): a record of the "intended audience" for hypothetical performance.

The guide to performance advertising explains what (a)(16) has to support.

How long to keep records

The general rule is in Rule 204-2(e)(1): at least five years from the end of the fiscal year during which the last entry was made on the record, the first two years in an appropriate office of the adviser, and throughout in an easily accessible place.

The clock starts at fiscal year end, not on the document's date. A client letter sent in March 2026 by a firm with a December fiscal year is kept until at least the end of December 2031. And a record still being added to, such as a ledger or a discretionary account list, runs from the fiscal year of its last entry.

Several records have their own periods:

These are minimums. Many firms set one longer period for everything rather than administer several.

Where records must be kept

"An appropriate office of the investment adviser" for the first two years is a location requirement, not only a retention one. Whatever the medium, the firm has to be able to produce a record promptly when an examiner asks for it, and that is what it will be tested on.

Other location rules:

• Records required by a state before SEC registration. Under Rule 204-2(k), an adviser that moved to SEC registration after 8 July 1997 must preserve the books and records its home state required it to keep before it registered.
• Non-resident advisers. Rule 204-2(j) requires copies of records at a notified place in the United States, unless the adviser files a written undertaking to furnish copies within 14 days of a written demand.

Electronic storage

Rule 204-2(g) allows any record required under the Advisers Act rules to be kept on micrographic media or on electronic storage media, "including any digital storage medium or system" that meets the rule's terms. Since the Commission's 2001 amendments (Release IC-24991, 66 FR 29224, effective 31 May 2001), that includes records that began on paper and were scanned.

Under (g)(2), the adviser must:

1. Arrange and index the records so that any particular record can be located, accessed and retrieved easily.
2. Provide promptly on request from the Commission's examiners a legible, true and complete copy in the medium and format in which it is stored, a legible, true and complete printout, and the means to access, view and print the records.
3. Keep a separate duplicate copy of each record, on any permitted medium, for the full retention period.

Under (g)(3), the firm must also have procedures to safeguard electronic records from loss, alteration or destruction, to limit access to authorized personnel and the Commission, and to make sure scans of paper originals are complete, true and legible.

Unlike the broker-dealer rule, Rule 204-2 does not require write once, read many (WORM) storage: the Commission considered and declined it for advisers in 2001.

In practice these requirements are usually met by vendors (the email archive, portfolio system, CRM and cloud drive), which makes them vendor oversight questions: what each system keeps, for how long, who can delete, and how the firm gets its records out if the contract ends.

What examiners look for

The SEC Exam Handbook (Form 2389, published 1 October 2026) says records should be available within 24 hours in most circumstances. Common findings:

• Retention counted from the document date instead of fiscal year end.
• Advertisements kept without the performance calculations and source data behind them.
• Business communications on texting or messaging apps the firm does not archive.
• A code of ethics or compliance manual where only the current version survives, so the firm cannot show what applied two years ago.
• Access person reports, Form ADV delivery dates or annual review work papers that cannot be found.
• Electronic records with no separate backup, or a departing employee's mailbox deleted under an IT policy that nobody checked against the rule.

Common questions

How long does an RIA have to keep records?

At least five years from the end of the fiscal year in which the last entry was made, with the first two years in an appropriate office of the adviser (Rule 204-2(e)(1)). Advertisements and performance records run from the end of the fiscal year the advertisement was last disseminated. Organizational documents are kept until three years after the firm terminates.

Do text messages count as books and records?

Yes, if their subject is covered by Rule 204-2(a)(7): advice or recommendations, money or securities moving, orders, or performance. The rule does not distinguish by channel. A firm that cannot capture a channel should prohibit business use of it and supervise that prohibition.

Can an RIA keep its records in the cloud?

Yes. Rule 204-2(g) permits any digital storage medium or system that meets its conditions: indexing, prompt production, a separate duplicate copy, and procedures against loss and alteration with access limited to authorized people. WORM storage is not required.

Does the annual compliance review have to be documented?

Rule 206(4)-7 does not itself require a written report. A requirement to document the review in writing was added in 2023 and removed in November 2024 after the private fund rules were vacated. But Rule 204-2(a)(17)(ii) requires the firm to keep any records that do document the review, and an examiner will ask for them. See the annual compliance review checklist.

What happens to records when an RIA closes?

Under Rule 204-2(f), before it stops doing business the adviser must arrange for its records to be kept for the rest of each retention period and notify the SEC in writing of the exact address where they will be held.

Do state-registered advisers follow Rule 204-2?

No. Rule 204-2 applies to advisers registered or required to be registered with the SEC under Section 203. State-registered advisers follow their state's books and records rule, which may differ in the records, periods and locations it requires, so check the state rule directly. An adviser that moves to SEC registration must preserve the records its state required (Rule 204-2(k)).

Keep the list and the record together

Luna's books and records policy template sets out which records the firm keeps, retention periods and location, electronic storage, production and destruction. The electronic communications policy template covers approved channels and the off-channel prohibition. Luna's email archive keeps each business email as it arrived, for at least five years from the end of your fiscal year; it captures email only. The rule and its summary are in the library at Rule 204-2.