Email Archiving and Review Policy Template for RIAs
Advisers Act Rules 204-2(a)(7), 204-2(e) and 206(4)-7
How the firm captures business email, how long it is kept and under what protection, who reviews it and how messages are chosen for review, how privileged mail is handled, and how employees are told.
Included in Firm and Firm Plus. 14-day free trial.
What the rule requires
Rule 204-2(a)(7) requires an adviser to keep written communications it receives, and copies of those it sends, relating to its recommendations and advice, the receipt, disbursement or delivery of funds or securities, the placing or execution of orders, and the performance or rate of return of accounts. Rule 204-2(e) requires keeping them for five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser, and Rule 204-2(g) sets conditions for keeping them electronically, including safeguards against loss, alteration or destruction.
Since late 2021 the Commission has brought a series of enforcement actions against firms whose personnel used text messages and other unapproved channels for business without preserving them. A written policy on which channels may be used, and how the firm captures and reviews them, is the first thing an examiner asks to see.
What the policy covers
The sections of Luna's model Electronic Communications policy. Your draft includes only the clauses that apply to your firm.
- 1Purpose, scope and definitions
- 2Approved channels and the off-channel prohibition
- 3What to do when someone contacts you off-channel
- 4Social media and electronic marketing
- 5Firm and personal accounts and devices
- 6How email and any other approved channel is captured
- 7Retention, integrity, access and production to regulators
- 8Legal holds
- 9Supervision and review: rules, AI safeguards, sampling and escalation
- 10Privileged communications, MNPI and complaints
- 11Security: client information, phishing and payment instructions
- 12Joining and leaving the firm
- 13Notice, quarterly certification and training
- 14Testing, exceptions, sanctions and annual review
What Luna asks you
A few of the questions that shape the draft:
- Which channels are approved for business, and how any channel other than email is captured
- Whether personal devices may be used, and whether firm devices are issued and reviewed
- How many years archived email is kept, and who reviews it
- Which concerns the review looks for, and what share of other email is sampled
- How often personnel certify they have not used unapproved channels
- How quickly off-channel contact must be reported, and how departing employees are off-boarded
How drafting works
- 01Answer questions about your firm
Plain questions about how you operate. Where there is a common answer, Luna suggests it; where you are not sure, say so and it is flagged rather than assumed.
- 02Luna drafts the policy
Only the clauses that apply to your firm, in your firm's name, each traced to the rule or choice it comes from.
- 03Review what is left
Anything unanswered is marked in the text and listed for you, and the policy cannot be approved until each is settled.
- 04Edit, approve and roll out
It is your policy: edit it like any other, approve it, and have employees acknowledge it in the same place.
Read the source
Other policies
A summary of what the rule requires, current as of October 2026, so you can see what the policy covers. It is not legal advice. A policy drafted in Luna is your firm's draft to review, edit and adopt.