Does SEC Rule 17a-4 apply to RIAs?

Not to an adviser-only firm. Rule 17a-4 is a broker-dealer rule; an investment adviser's recordkeeping rule is Advisers Act Rule 204-2, whose electronic-storage provision, 204-2(g), does not require WORM storage. If your firm is also a broker-dealer, or your people are registered through one, 17a-4 binds the broker-dealer side.

What this means for your firm

• When a custodian, auditor or form mentions 17a-4, ask which rule and which registration they mean.
• Write the 204-2(g) duties into your compliance manual and test them at your annual review under Rule 206(4)-7(b).
• Check whether your firm or your people are registered through a broker-dealer; if so, ask its compliance department what it needs captured.

Turret is built for Rule 204-2, not 17a-4: sent and received mail, a SHA-256 hash on each message, tamper-evident, not write-once.

What to keep and review for email, with rule-text sources: get the one-page checklist (a PDF).

5 years

the rule's minimum

7 years

Turret's policy while you subscribe

• First 2 years in an appropriate office of the adviser
• Rest of the 5 years the rule requires
• Turret retention policy, while you subscribe

The rule counts from the end of the fiscal year in which the last entry was made (17 CFR 275.204-2(e)(1)). Turret's policy counts from the day each message is archived. The bars show policy, not how much a given firm has archived so far.

Retention periods in years: the SEC rule and Turret's policy

Period	Years
Rule minimum, 17 CFR 275.204-2(e)(1)	5
Of which in an appropriate office of the adviser	2
Turret retention policy, while you subscribe	7

Who 17a-4 binds

Every member, broker or dealer subject to § 240.17a-3 (17a-4(a))

An RIA's recordkeeping rule

Advisers Act Rule 204-2; its electronic-storage paragraph names no WORM requirement and no audit-trail alternative (204-2(g))

RIA retention floor

Five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser (204-2(e)(1))

Broker-dealer communications

Three years, the first two easily accessible (17a-4(b), (b)(4))

The 2022 audit-trail alternative

Added to the broker-dealer electronic-records rule, effective January 3, 2023 (17a-4(f)(2)(i)(A))

Rule 17a-4 is an Exchange Act rule, in 17 CFR Part 240. Its first paragraph says who it binds:

Every member, broker or dealer subject to § 240.17a-3 must preserve for a period of not less than 6 years …

17 CFR 240.17a-4(a)

A registered investment adviser is not a member, broker or dealer. On the text, the rule does not reach a firm that is only an RIA. It reaches the broker-dealer, and the broker-dealer side of any firm that is also one.

Broker-dealer email sits in paragraph (b), which sets a different period:

(b) Every member, broker or dealer subject to § 240.17a-3 must preserve for a period of not less than three years, the first two years in an easily accessible place:

…

(4) Originals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer … relating to its business as such …

17 CFR 240.17a-4(b), (b)(4)

The three-year period comes from the lead-in to (b); (b)(4) identifies the communications it covers. Which paragraph governs a given message may depend on what the message is.

Paragraph (f) covers electronic recordkeeping. Since 2023 it gives a broker-dealer two routes:

(2) An electronic recordkeeping system must:

(i)(A) Preserve a record for the duration of its applicable retention period in a manner that maintains a complete time-stamped audit trail that includes:

(1) All modifications to and deletions of the record or any part thereof;

(2) The date and time of actions that create, modify, or delete the record;

(3) If applicable, the identity of the individual creating, modifying, or deleting the record; and

(4) Any other information needed to maintain an audit trail of the record in a way that maintains security, signatures, and data to ensure the authenticity and reliability of the record and will permit re-creation of the original record if it is modified or deleted; or

(B) Preserve the records exclusively in a non-rewriteable, non-erasable format;

17 CFR 240.17a-4(f)(2)(i)(A), (B)

Option (B) is WORM storage: write once, read many. Option (A) is the audit-trail alternative. The SEC adopted it on October 12, 2022 (Release 34-96034), effective January 3, 2023. It changed a broker-dealer rule.

An adviser's rule is 17 CFR 275.204-2. The general retention floor is in (e)(1):

… shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.

17 CFR 275.204-2(e)(1)

That sentence excepts, among others, (a)(11) and (a)(16), which cover advertisements, mass communications and performance support. Those run under (e)(3)(i): five years counted "from the end of the fiscal year during which the investment adviser last published or otherwise disseminated" the communication.

Two paragraphs matter most for email. Paragraph (a)(7) reaches written communications, received and sent:

(7) Originals of all written communications received and copies of all written communications sent by such investment adviser relating to:

(i) Any recommendation made or proposed to be made and any advice given or proposed to be given; …

17 CFR 275.204-2(a)(7)

Items (ii) to (iv) cover funds and securities, order placement and execution, and performance. Separately, (a)(11)(i)(B) covers a "Notice, circular, newspaper article, investment letter, bulletin, or other communication that the investment adviser disseminates, directly or indirectly, to ten or more persons (other than persons associated with such investment adviser)", so a client newsletter or mass email can fall there. For the period past the floor, see how long Rule 204-2 requires email to be kept.

Electronic storage is paragraph (g). It permits an adviser to keep records on:

(ii) Electronic storage media, including any digital storage medium or system that meets the terms of this section.

17 CFR 275.204-2(g)(1)(ii)

Those terms are in (g)(2) and (g)(3). The adviser must index the records so any one can be located and retrieved, provide promptly on the Commission's request a legible, true and complete copy, a printout and the means to access and view the records, and store a duplicate copy separately ((g)(2)(i) to (iii)). For electronic media it must also maintain procedures:

(i) To maintain and preserve the records, so as to reasonably safeguard them from loss, alteration, or destruction;

17 CFR 275.204-2(g)(3)(i)

and procedures to limit access to properly authorized personnel and the Commission ((g)(3)(ii)).

That is a list of things an RIA must be able to do, not a choice of storage technology.

A firm that is only an RIA is the clean case; the cases below are not. SEC Form CRS defines two terms "for purposes of Form CRS". They sort the cases; they are not a test under either recordkeeping rule:

Dual registrant: A firm that is dually registered as a broker-dealer under section 15 … and an investment adviser under section 203 … and offers services to retail investors as both …

Dually licensed financial professional: A natural person who is both an associated person of a broker-dealer … and a supervised person of an investment adviser …

SEC Form CRS, General Instruction 11.C and 11.B

A dual registrant is one firm with two registrations. As a broker-dealer it is bound by 17a-4, and (b)(4) reaches communications "relating to its business as such". Its advisory business is subject to 204-2. One mailbox can carry both.

A dually licensed professional is one person. Their firm may be only an RIA, or affiliated with a separate broker-dealer. The broker-dealer's obligations attach to broker-dealer business, and (b)(4) reaches communications "relating to its business as such". Whether a dually licensed person's advisory-side mail also belongs in the broker-dealer's archive, and how the broker-dealer wants it captured, is a judgment for your CCO and counsel and a question for the broker-dealer's compliance department. Do not assume the answer either way.

A label is the seller's own claim. "17a-4 compliant" is measured against a broker-dealer rule. It does not show that your firm is subject to 17a-4, and it does not show the product meets 204-2(g). Three questions to put to any vendor:

• Which rule, and which of your registrations, does the claim cover?
• Is the storage WORM or an audit trail, and can the vendor show you the audit trail or a verification report?
• Where is the duplicate copy that 204-2(g)(2)(iii) calls for, and can you export every record on request ((g)(2)(ii))?

Weighing a platform tool instead? See Is Google Vault enough for SEC Rule 204-2?

1. If your firm is only an RIA, your rule is 204-2. Rule 17a-4 does not bind you. The label alone does not show an adviser obligation.
2. Write the 204-2(g) duties into your compliance manual, and test them at your annual review under Rule 206(4)-7(b). If you adopt a stricter design reference, such as an audit trail or WORM storage, record that it is a choice and why.
3. Find out whether your firm or your people are registered through a broker-dealer. If so, ask its compliance department what it needs captured.
4. When a custodian, auditor or form mentions 17a-4, ask which rule and which registration they mean.

None of this is legal advice. For a mixed case, see the section on dual registrants above.

Turret archives Google Workspace and Microsoft 365 mail, sent and received, Trash included. Retention is 7 years, while you subscribe. Each message gets a SHA-256 hash in append-only audit tables. A re-verification run produces an Archive Integrity Verification Report. Search and export on request support 204-2(g)(2)(i) and (ii).

It is tamper-evident, not write-once: it detects alteration but cannot re-create an original record. Turret does not claim 17a-4 compliance. The architecture page says what is and is not provided.

Email is $99 a month for 5 monitored mailboxes, no setup fee. See pricing.

Sources opened October 17, 2026.

1. 17 CFR 240.17a-4: eCFR (mirror: Cornell LII)
2. 17 CFR 275.204-2: eCFR (mirror: Cornell LII)
3. 17 CFR 275.206(4)-7: eCFR
4. SEC, Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants, Release 34-96034 (adopted October 12, 2022; 87 FR 66412, November 3, 2022)
5. SEC Form CRS (General Instruction 11)
6. Turret, Security architecture