Investment adviser books and records: what to keep, how long

An SEC-registered adviser keeps the books and records Rule 204-2 lists, and it keeps most of them for at least five years from the end of the fiscal year of the last entry, the first two in an appropriate office. Several records run on clocks of their own, set in the paragraph that requires them. Advertisements and the performance records behind them run from the last time a piece was used, not the first. The rule also asks for more than retention. It opens by requiring records that are “true, accurate and current,” which is where contemporaneous documentation starts.

This answer runs in eight parts:

• What to keep: the principal records Rule 204-2 lists, grouped by what they’re for.
• For how long, in one table, with the records that run on their own clocks.
• How records may be kept electronically.
• Contemporaneous documentation, and what it adds to retention.
• Redan’s position: the record can live with whoever produced it, and the pointer is written at the time.
• How it’s actually done.
• The record it should leave.
• Frequently asked questions, then the sources.

What to keep

Rule 204-2(a) requires every registered adviser to “make and keep true, accurate and current the following books and records relating to its investment advisory business.” The principal records, grouped by what they’re for:

The firm’s books

• Journals, including cash receipts and disbursements, and other records of original entry (204-2(a)(1))
• General and auxiliary ledgers (204-2(a)(2))
• Check books, bank statements, cancelled checks and cash reconciliations (204-2(a)(4))
• Bills and statements, paid or unpaid (204-2(a)(5))
• Trial balances, financial statements and internal audit working papers (204-2(a)(6))

Clients, orders and authority

• A memorandum of each order given and each instruction received, showing its terms, who recommended it, who placed it, the account and the date (204-2(a)(3))
• Written communications received and sent about advice, funds and securities, orders, and performance (204-2(a)(7))
• A list of the accounts where the adviser has discretion (204-2(a)(8)), and the powers of attorney granting it (204-2(a)(9))
• All written agreements with clients or otherwise relating to the business (204-2(a)(10))
• For an adviser that provides investment supervisory or management services: records showing separately for each client the securities bought and sold, with the date, amount and price of each, and information from which it can promptly say which clients hold each security and how much (204-2(c)(1))

Marketing and performance

• A copy of each advertisement the adviser disseminates, and each communication to ten or more people; a memorandum of the reasons for any recommendation of a specific security that doesn’t state them; and any questionnaire behind a third-party rating used in an advertisement (204-2(a)(11))
• Records for testimonials, endorsements and third-party ratings, including documentation of the adviser’s reasonable basis for believing they comply (204-2(a)(15))
• Everything “necessary to form the basis for or demonstrate the calculation of” any performance the adviser presents (204-2(a)(16))
• A record of who the “intended audience” is for hypothetical performance and for net performance calculated with a model fee (204-2(a)(19))

The compliance program and the code of ethics

• The code of ethics, any violation and the action taken, and every supervised person’s written acknowledgment (204-2(a)(12))
• Access persons’ reports, the names of access persons, and each decision to approve an access person’s acquisition of an IPO or limited offering “and the reasons supporting the decision” (204-2(a)(13))
• The compliance policies and procedures, “any records documenting” the annual review, and any internal control report obtained under the custody rule (204-2(a)(17))

Disclosure and privacy

• Each brochure, brochure supplement and Form CRS, their amendments, and the dates each was given to a client; and a memorandum explaining any decision not to disclose a disciplinary event that’s presumed material (204-2(a)(14))
• The Regulation S-P records: the safeguarding, service-provider and disposal policies, documentation of any detected unauthorized access and the response, the notification determination, and the contracts with service providers (204-2(a)(25))

Two paragraphs apply only to some advisers: records for advisers with custody of client funds or securities (204-2(b)), and proxy voting records for advisers with voting authority (204-2(c)(2)). Records relating to political contributions under the pay-to-play rule have their own paragraph (204-2(a)(18)). Paragraphs (a)(20) through (a)(24) are reserved: they were added in 2023 with the private fund adviser rules and removed after a federal court vacated those rules (Release IA-6773).

For how long

The default is in 204-2(e)(1): records are “maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.”

The same paragraph carves out records whose clock is set elsewhere:

A pitch book in use for six years is kept for five years after the fiscal year it was retired. The advertisement clock also applies to the performance working papers under (a)(16), and it reaches furthest there. A firm that keeps showing a since-inception track record keeps the records that support every year of it, back to inception, for as long as it shows the number and five years after.

The most common retention failure is a business message on a channel the firm doesn’t capture, so the record never reaches the firm at all. A text about advice, an order or money moving is a required record under 204-2(a)(7), whatever device it was sent from. If the firm has an off-channel policy, the uncaptured message is also a failure of that policy and of the supervision behind it. If it has no policy, the records violation is still there on its own. The 2024 off-channel actions charged advisers with both: the recordkeeping violation, and the failure to supervise.

Two other mistakes come up often. One is starting an advertisement’s clock when the piece was first used rather than last used. The other is deleting a departing employee’s mailbox while its records are still inside their retention period.

Before an adviser stops doing business, it arranges for its records to be preserved for the rest of the retention period, and tells the Commission in writing where they will be kept (204-2(f)).

How records may be kept

Records can be kept electronically. The rule sets conditions (204-2(g)):

• arrange and index them so any particular record can be located, accessed and retrieved
• provide promptly, on request, a legible, true and complete copy in the medium it’s stored in, a printout, and the means to access, view and print it
• keep a separate duplicate copy for the full retention period
• for electronic records, keep procedures to “reasonably safeguard them from loss, alteration, or destruction,” to limit access to authorized personnel and the Commission, and to make sure any scan of a paper original is complete, true and legible

Contemporaneous documentation

The rule doesn’t use the word “contemporaneous.” Its requirement that records be “current” (204-2(a)) points the same way, and in several places it asks for the reasoning behind a decision, not only the decision. The clearest is 204-2(a)(13)(iii): “a record of any decision, and the reasons supporting the decision.”

The Commission has pointed to contemporaneous records in the Marketing Rule’s substantiation standard. Advisers can show a reasonable basis for a material statement of fact “in a number of ways. For example, they could make a record contemporaneous with the advertisement demonstrating the basis for their belief.” The release also states the consequence: “if an adviser is unable to substantiate the material claims of fact made in an advertisement when the Commission demands it, we will presume that the adviser did not have a reasonable basis for its belief” (Release IA-5653, as quoted in the staff’s 2022 and 2024 Marketing Rule risk alerts).

The examination staff has made the same observation from the other direction. Its 2020 alert on compliance programs found advisers “that claimed to engage in ongoing or annual compliance reviews … but could not provide evidence that one occurred.” Its 2021 review of ESG investing found that detailed procedures, with specific documentation at each stage of the investment process, “resulted in contemporaneous documentation” of the factors considered in specific investment decisions.

In each, the record that holds up is the one made by the person who made the decision, at the time, saying what they looked at and why.

A CCO can’t make people remember to write things down later, so the record is built into the step itself. An approval doesn’t count until the reasoning is written with it. A matter reported to compliance goes into the intake log when it’s reported, with an owner and two dates: when the event happened and when compliance learned of it. Compliance often hears about something days or weeks after it happened. The record starts from the event, not from the report, and the gap between the two is part of what the log shows. The outcome is added when it closes. A confirmation from the business is written in the same pass as the review, naming the record and where it’s held. The work happens in the system that keeps the record, so the date on it is the date the decision was made. A memo written months later to explain a decision is still worth having, but it reads as a reconstruction.

Where a deadline runs from awareness, as the Regulation S-P notice clock does, the record adds a third date: when someone at the firm first knew.

Redan’s position: the record can live with whoever produced it, and the pointer is written at the time

For a claim about how the firm operates, the source, the calculation and the approval can sit with the business unit that generates them. The compliance officer confirms the statement is accurate with whoever produced it and writes down what they said, and doesn’t have to hold the file.

The confirmation is written when the claim is made, in the same pass as the work, and it names which record is held and where, so someone else could follow it after the person who wrote it has gone. Wherever the file sits, it’s the adviser’s record: the retention period in 204-2 and the duty to produce it promptly apply to it, so the practical test is whether the backup appears on demand, years later.

Where there’s no separate desk, because the person who produced the figure is the person who confirms it, compliance keeps the backup in a firm system it controls. The test is the same at every firm.

How it’s actually done

The practice below is professional practice, not a rule requirement.

A claim can be accurate and still unsubstantiated. A performance chart is supported when the source data, the calculation and the approval can be produced together on request. A careful firm can produce the piece, the underlying data, the worksheet that gets from one to the other, and the reviewer’s approval with the reasoning in the reviewer’s own words.

Never a silent fix. Any change that alters what approved content says goes back through approval. The old text and the new sit side by side with a line on why, and the superseded version is kept. A silent correction destroys the evidence that the wrong version ever existed.

An acknowledgment is its own record. The code of ethics acknowledgment is a separate signed and dated record for each person, collected on the code and on each amendment (204A-1(a)(5)). A course completion records attendance and does not replace the acknowledgment.

A departure doesn’t end retention. When someone leaves, suspend the account and keep the mail and the archive rather than deleting the mailbox.

A complaint is filed as received. Keep it in the client’s own words, with the date and who took it, and keep the correspondence, the analysis, the response and the closing date together. Rule 204-2 doesn’t name client complaints, so what to keep rests on the written-communications record and on practice.

Records made as the work happens. Everything the staff asks for should come out of the year’s ordinary work, made by the person who made the decision, in the moment, in the system where the work happened.

Beyond what the rule lists, a well-run firm keeps the records that show the program’s reasoning:

• The approved-channel governance document, with why each channel is approved and how it’s captured, and each review of the archive.
• The year’s developments list behind the annual review: each risk alert, enforcement action and internal event, whether it reached the firm, and the policy language drafted in response.
• The intake log, with every matter reported to compliance, its owner and its outcome, including “we looked and there was nothing here.”
• The off-channel incident log: each client message captured under the procedure, when it arrived and when the employee reported it. The message itself is a required record. The log of how it was handled goes beyond the rule.
• The reason for each vendor’s risk tier, and each attestation or confirmation between full reviews.
• The CCO’s authority and budget, in writing, and what the CCO asked for and was or wasn’t given.

Rule 204-2 doesn’t list these as such. Each is what an examiner reaches for when asking whether the program works.

The record it should leave

For the records a compliance officer makes personally, the record that holds up carries five things: what was examined, the rule or policy it was checked against, who decided, when, and the written reasoning.

That record is written at the time, in the same pass as the work, by the person who made the decision and in the system where the work happened, rather than assembled later.

A later correction doesn’t overwrite the record. Any change that alters what approved content says goes back through approval, the old text and the new sit side by side with a line on why, and the superseded version is kept.

Where Rule 204-2 requires the record, it’s kept for the period the table above sets for that record. For most records that’s five years from the end of the fiscal year of the last entry, the first two in an appropriate office (204-2(e)(1)). For an advertisement and the performance working papers behind it, the five years run from the end of the fiscal year the piece was last disseminated (204-2(e)(3)(i)).

Frequently asked questions

How long do investment advisers have to keep records? At least five years from the end of the fiscal year of the last entry, the first two in an appropriate office, under Rule 204-2(e)(1). Advertisements and performance records run five years from the end of the fiscal year the piece was last used. Organizational documents are kept until at least three years after the business ends.

What books and records does an RIA have to keep? The list in Rule 204-2: the firm’s books and ledgers, order memoranda, written communications about advice, orders, funds and performance, client agreements and discretionary authority, each client’s purchases and sales, advertisements and performance support, the code of ethics and personal trading records, the compliance policies and annual review, brochures and Form CRS, and the Regulation S-P records. Advisers with custody or proxy voting authority keep more.

Do investment advisers have to keep every email? Rule 204-2 lists records by subject, not by channel. An email is kept if it falls within one of those subjects, such as advice, an order, funds or securities moving, or performance under 204-2(a)(7), or an advertisement under 204-2(a)(11).

Do investment advisers need WORM storage? Rule 204-2(g) doesn’t name a storage format. It requires electronic records to be indexed, duplicated, produced promptly on request, access-controlled, and safeguarded from “loss, alteration, or destruction.”

What is contemporaneous documentation? A record made at the time of the decision it describes, by the person who made it, rather than assembled later. The Commission has pointed to a record “contemporaneous with the advertisement” as one way to show a reasonable basis for a marketing claim.

Do text messages count as books and records? Yes, if they concern the subjects 204-2(a)(7) lists, are an instruction to buy or sell, or are an advertisement under 204-2(a)(11).

Sources

Rule text and staff guidance below are quoted from the source documents. The Marketing Rule adopting release is quoted as the staff restated it in its risk alerts. Redan’s positions and the professional practice described above are labeled as such in the text.