Email retention requirements for investment advisers

An SEC-registered investment adviser must keep the emails it sends and receives that relate to advice or recommendations, the movement of client funds or securities, the placing or execution of orders, or performance, for at least five years from the end of the fiscal year in which they were sent or received, the first two years in an appropriate office of the adviser. The requirement comes from Rule 204-2(a)(7) and (e)(1) under the Investment Advisers Act. Email kept electronically must also meet the storage conditions in Rule 204-2(g).

The rule does not mention email by name. It speaks of "written communications," and email is where most of an adviser's written communications now are. This guide covers how the rule applies to email in particular: which messages it reaches, how long they are kept, how they must be stored, what an archive should capture, and how firms review it. For the full list of records Rule 204-2 requires, see books and records requirements.

Which emails the rule reaches

Paragraph (a)(7): communications about the advisory business

Rule 204-2(a)(7) requires originals of written communications received, and copies of those sent, relating to four subjects:

1. any recommendation made or proposed to be made, and any advice given or proposed to be given
2. any receipt, disbursement or delivery of funds or securities
3. the placing or execution of any order to purchase or sell a security, with added allocation and affirmation records for transactions subject to Exchange Act Rule 15c6-2(a)
4. predecessor performance and the performance or rate of return of managed accounts, portfolios or securities recommendations

In email terms, that is a client asking whether to sell a position and the reply, a wire instruction or a request to move assets, an email to a broker placing a trade, and a quarterly performance summary sent to a client or a prospect.

The rule carves out unsolicited market letters and similar communications of general public distribution that were not prepared by or for the adviser. Research newsletters arriving in an inbox are the usual example.

Other paragraphs that catch email

Several other paragraphs of Rule 204-2 reach email because of what is sent, not because it is a communication:

• Advertisements and mass mailings, (a)(11). A copy of each advertisement the adviser disseminates, and of any notice, circular, newsletter or other communication it sends to ten or more people other than its own personnel. A marketing email campaign sent through a separate email platform is covered just as much as one sent from Outlook.
• Performance support, (a)(16). The records needed to show how any performance in a communication to someone outside the firm was calculated. The email itself is an (a)(7) or (a)(11) record; the workpapers behind its numbers are (a)(16) records.
• Delivery records, (a)(14). A record of the dates each brochure, brochure supplement and Form CRS was given to clients and prospective clients who became clients. When those are delivered by email, the sent messages are often that record.
• Written agreements, (a)(10). Written agreements with clients or otherwise relating to the business, including a copy sent or signed by email.

Is every email a required record?

Read narrowly, no. The rule is defined by subject, so an email arranging lunch is not a required record under (a)(7). But no firm can sort messages by subject reliably as they arrive, and a single thread often moves from scheduling to a recommendation within a few replies. For that reason most advisers capture all business email, sent, received and internal, and let retention rules apply to the whole archive. Capturing everything also answers the question an examiner tends to ask, which is not whether a given message was required but whether the firm can produce all of the messages that were.

The rule refers to communications "received" and "sent" by the adviser. Whether purely internal email between employees falls within (a)(7) is less clear on the face of the text than client email. Internal messages about a recommendation or an order are often the most useful record of how a decision was made, which is one more reason firms keep them.

How long to keep email

Rule 204-2(e)(1) sets the general period: at least five years from the end of the fiscal year during which the last entry was made on the record, the first two years in an appropriate office of the adviser, and throughout in an easily accessible place.

For email, the "last entry" is in practice the date the message was sent or received. A message sent in June 2027 by a firm with a December fiscal year falls in fiscal year 2027, which ends on 31 December 2027, so it is kept until at least 31 December 2032. The period runs from fiscal year end, not from the date on the email, which means every message from a given fiscal year reaches the end of its minimum period on the same day.

Two refinements matter for email:

• Advertisements under (a)(11) run from the end of the fiscal year in which the advertisement was last disseminated (Rule 204-2(e)(3)). An email template reused each quarter is kept for five years after the last time it went out.
• The two years in an office. The rule does not say how the office requirement applies to records held electronically. Firms commonly rely on being able to access and produce the email promptly from the office, wherever the servers are.

These are minimums. Firms often keep email longer for litigation, client disputes or state requirements, and a legal hold overrides any scheduled deletion while it is in place.

How email must be stored

Rule 204-2(g) permits records to be kept on electronic storage media, "including any digital storage medium or system" that meets the rule's conditions. For an email archive, those conditions translate as follows.

Arranged and indexed for retrieval, (g)(2)(i). Any particular message must be easy to locate, access and retrieve. In practice that means search across sender, recipients, dates, subject, body and attachment text, so that "every email between this adviser and this client in 2025" can be answered quickly.

Producible promptly, (g)(2)(ii). On request, the firm must provide examiners a legible, true and complete copy in the format in which it is stored, a legible, true and complete printout, and the means to access, view and print the records. For email that usually means export of the original messages with their headers and attachments, plus a readable rendering.

A separate duplicate copy, (g)(2)(iii). A duplicate of each record must be stored separately for the full retention period. A mailbox in Microsoft 365 or Google Workspace and a separate archive can together serve this purpose. A mailbox alone may not, because users can delete from it.

Procedures against loss, alteration and unauthorized access, (g)(3). The firm must have procedures to reasonably safeguard records from loss, alteration or destruction, to limit access to authorized personnel and the Commission, and to make sure scans of paper originals are complete, true and legible.

The adviser rule does not require write once, read many storage. Rule 204-2(g) asks for safeguards against alteration and loss, not a particular technology. Broker-dealers are under a different rule, Exchange Act Rule 17a-4, with its own electronic storage requirements, and a dual registrant should look at both. Rule 204-2(h)(1) treats a record kept under Rule 17a-4 that is substantially the same as the one Rule 204-2 requires as kept in compliance with Rule 204-2.

What an email archive should capture

The rule describes outcomes, not configurations. The practical questions for a firm setting up or reviewing email retention are these.

• Capture at the server, before users can delete. A journaling rule in Microsoft 365 or Google Workspace copies each message to the archive as it passes through the mail system, so a message a user later deletes is still kept. Relying on users not to delete is not a safeguard against loss.
• Sent, received and internal mail. Including mail sent to and from shared mailboxes such as an operations or trading address.
• Attachments and headers. The attachment is often the substance, a performance report or a signed instruction, and the headers show who received the message and when.
• Every person who does business on behalf of the firm. New hires from their first day, and departing employees after they leave: a mailbox deleted under an IT offboarding routine is a retention gap if the archive did not already hold its contents.
• Every system that sends email for the firm. A marketing platform, a CRM that sends client email or a portal that sends notifications may sit outside the main mail server.
• Personal email accounts. The rule follows the communication, not the account. Firms commonly prohibit business use of personal email and require that any business message received there be forwarded into the firm system.

Before relying on an archive, test that it works: send a message, confirm it arrives in the archive, and check that a new employee's mail is being captured. Repeat the test periodically, because journaling rules can be changed or broken by unrelated IT work.

Texts, messaging apps and other channels

Everything above applies to any written communication, not only email. A text or messaging app message about a recommendation is an (a)(7) record in the same way. The practical choice for each channel is to capture it or to prohibit business use of it and supervise that prohibition. Those channels, the enforcement history around them and the Commission's current position are covered in the guide to off-channel communications, which this guide does not repeat.

One point connects the two. Email is often where off-channel use shows up: a client writes "as I said in my text," or an adviser writes "WhatsApp me." Reviewing email for those references is one of the few ways a firm can find business moving to channels it does not capture.

Supervising and reviewing email

Rule 204-2 is about keeping records. It does not require anyone to read them. The Advisers Act also has no rule that prescribes how an adviser reviews email, unlike the supervision rule that applies to FINRA member broker-dealers. Review comes instead from two broader obligations:

• Rule 206(4)-7, which requires written policies and procedures reasonably designed to prevent breaches of the Advisers Act. Where email is how advice, complaints, gifts and marketing travel, policies usually say how it is monitored.
• Section 203(e)(6) of the Advisers Act, under which the Commission may sanction an adviser for failing reasonably to supervise a person subject to its supervision. The section gives a defense where the firm had reasonable procedures and a system for applying them, and the person in charge reasonably discharged those duties.

Common review practices

None of these is required by a rule; they are how firms commonly make email review proportionate to their size and risk.

• Lexicon or keyword review. Flagging messages that contain words associated with risk, such as guarantees, complaints, gifts, account numbers in plain text, or steering toward text messages.
• Random sampling. Reviewing a sample of unflagged messages, so the review is not limited to what the keywords catch. Recording how the sample was drawn makes the review repeatable.
• Targeted review. Looking more closely at new hires, advisers with complaints, people on a restricted list matter, or periods around a significant event.
• Escalation and records of review. A reviewer who closes a flag records why, and anything that needs action goes to the chief compliance officer. A review that leaves no record is hard to show to an examiner.
• Independence. A person should not be the reviewer of their own email. At a small firm, that may mean someone else reviews the CCO's mail.

Testing that email review actually happens, and that captured mail is complete, is a natural part of the firm's compliance testing and its annual review under Rule 206(4)-7.

Privacy in the archive

An email archive is full of client nonpublic personal information. The safeguards rule in Regulation S-P (17 CFR 248.30) requires written policies and procedures to protect customer records and information, and since the 2024 amendments that includes an incident response program and service provider oversight. An email archive vendor is a service provider for that purpose. See the Regulation S-P compliance checklist.

Where the rule may be heading

The Commission's regulatory agenda includes amendments to the adviser recordkeeping rule addressing electronic communications. Until any amendment is adopted and takes effect, Rule 204-2(a)(7) applies to email as described here. The off-channel communications guide tracks the status.

Common gaps

• Relying on the mailbox itself as the archive, so a deleted message is gone.
• Retention counted from the email's date instead of fiscal year end.
• Mail from a marketing platform or CRM that never reaches the archive.
• Departing employees' mailboxes deleted before anyone checked the archive held their mail.
• Attachments stripped or stored separately so that the message cannot be produced complete.
• No record of email review, or reviews that only ever look at flagged mail.
• Business conducted from personal email accounts with no forwarding rule.

Common questions

How long do investment advisers have to keep emails?

Emails that are required records under Rule 204-2 must be kept for at least five years from the end of the fiscal year in which they were sent or received, the first two years in an appropriate office of the adviser (Rule 204-2(e)(1)). Advertisements sent by email run from the end of the fiscal year in which they were last sent.

Do RIAs have to archive all emails?

The rule requires emails about advice, recommendations, funds or securities moving, orders and performance, plus advertisements and mass communications. Because those cannot be separated reliably from other business email as it arrives, most advisers archive all business email.

Does email have to be stored in WORM format?

No. Rule 204-2(g) does not require write once, read many storage. It requires indexing, prompt production, a separate duplicate copy, and procedures to safeguard records from loss, alteration or destruction and to limit access. The broker-dealer rule, Rule 17a-4, is different.

Can an adviser delete email after five years?

Rule 204-2 sets a minimum, so email past its minimum period may be deleted under the firm's written retention schedule, unless a legal hold, a state rule, a litigation obligation or another requirement calls for longer.

Do state-registered advisers follow the same email rules?

Rule 204-2 applies to advisers registered or required to be registered with the SEC. State-registered advisers follow their state's books and records rule, which may be modeled on the federal rule but should be checked directly.

Keep the email you are required to keep

Luna's email archive receives a copy of every message through a journal rule in Google Workspace or Microsoft 365, stores each original in immutable storage using S3 Object Lock for at least five years from the end of your fiscal year, and puts flagged messages and a reproducible sample in front of a person to review. It captures email; it does not capture text messages, messaging apps, Teams, Slack or social media. The electronic communications policy template sets out approved channels and the review process, and the rule itself is in the library at Rule 204-2.