How do you review RIA email, and how often?

Set the cadence yourself, write it down, and keep proof you followed it. Rule 206(4)-7 does not say how often to review email; it requires written policies reasonably designed for your firm and an annual review of them. Build the cadence from lexicon flags, a random sample, a reviewer other than the sender, and a dated record of each review.

What this means for your firm

• Put the cadence in your written policy: what mail is reviewed, how often, by whom, and what happens when a review finds something.
• Combine keyword flags with a random sample, and write down how the sample is drawn.
• Keep a dated record of every review: reviewer, what was read, what was found, what was done.
• Feed that record into the annual review under Rule 206(4)-7(b), and revisit the cadence after a significant event.

Turret's part is under "Where Turret fits". Whether a cadence is adequate for your firm is for your CCO and counsel. Related: Does a small RIA need email archiving?

Six questions about how your firm keeps and reviews email: take the SEC email-readiness self-check. It scores your own practices.

Frequency

Rule 206(4)-7(b) sets a review of the policies "no less frequently than annually"; the rule does not set a frequency for email (Cornell LII)

Method

Staff wrote that a firm "may consider using sampling, spot checking, or lexicon-based or other search methodologies, or a combination of methodologies", about social media (SEC staff risk alert, January 4, 2012)

Evidence

Staff observed advisers that claimed to conduct reviews of their policies "but could not provide evidence that one occurred"; keep proof of every email review for the same reason (SEC staff risk alert, November 19, 2020)

Rule 206(4)-7 is the compliance-program rule. It makes it unlawful for a registered adviser to advise clients unless the firm does three things. Two matter here:

"(a) Policies and procedures. Adopt and implement written policies and procedures reasonably designed to prevent violation, by you and your supervised persons, of the Act and the rules that the Commission has adopted under the Act;

(b) Annual review. Review, no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation"

17 CFR 275.206(4)-7(a), (b)

The adopting release says an adviser should "first identify conflicts and other compliance factors creating risk exposure for the firm and its clients in light of the firm's particular operations, and then design policies and procedures that address those risks." Neither the rule nor the release mentions email review. Your firm decides whether and how to supervise email (also called email surveillance) and writes that decision into its policy.

We found no SEC rule or staff statement that sets how often an adviser must read or sample its email. The Compliance Rule sets an annual review of the program. Your firm sets the email cadence, writes it down and can show it.

The nearest staff language is about the program, not email. In 2020 the staff wrote: "Although the Compliance Rule requires only annual reviews, advisers should consider the need for interim reviews in response to significant compliance events, changes in business arrangements, and regulatory developments."

A 2012 staff alert on social media said a firm "using a risk-based approach" may conclude that "periodic, daily or real-time monitoring of the postings on a site is appropriate". Risk alerts are staff views, not rules. Neither alert sets a frequency for email.

Use both. Flags catch the words you listed; a sample catches what your list missed. FINRA's 2007 notice for broker-dealers says to consider complementary techniques.

"A firm may consider using sampling, spot checking, or lexicon-based or other search methodologies, or a combination of methodologies, to monitor social media use and content."

SEC staff risk alert, Investment Adviser Use of Social Media (January 4, 2012)

The 2018 staff alert on electronic messaging mentions vendors that can "compare postings to a lexicon of key words and phrases" for advisers that let staff use social media, personal email or personal websites for business. It excluded email on advisers' own systems from its review, so it is not a statement about firm email.

FINRA (broker-dealer rule), shown for comparison. It does not bind investment advisers. Its Regulatory Notice 07-59 says a firm using lexicon-based reviews should "periodically evaluate the efficacy of the lexicon", may use "a reasonable percentage sampling technique", and that frequency "may vary depending on the business."

Rule 206(4)-7 requires a designated chief compliance officer to administer the policies; it does not say who reads email. Use a reviewer other than the sender. That is our reasoning, not an SEC requirement.

A very small firm has a harder version of this: the CCO may also be the principal and a sender. The 2020 staff alert observed "CCOs who had numerous other professional responsibilities … who did not appear to devote sufficient time to fulfilling their responsibilities as CCO." Give the CCO's own mail a second reader, and name that person in the policy.

FINRA (broker-dealer rule), shown for comparison. It does not bind investment advisers. Rule 3110(b)(4) says reviews of correspondence "must be conducted by a registered principal and must be evidenced in writing".

Make the record while you review, not when an examiner asks. Copy this example log entry; it is a template, not a required form:

• Date: ___
• Reviewer: ___ (not the sender)
• Scope: the flagged queue for the week of ___, or a sample of ___ sent messages drawn by ___ from ___ to ___
• Items flagged: ___
• Disposition: for each item, reviewed, false positive or escalated, with a one-line reason
• Escalation: to whom, on what date, and the outcome

The 2020 staff alert is about reviews of policies and procedures, not email. It listed advisers that "claimed to engage in ongoing or annual compliance reviews of their policies and procedures to determine their adequacy and effectiveness of their implementation, but could not provide evidence that one occurred." Keep the same proof for email reviews. The rule does not prescribe an escalation path, so write your own into the policy. What the rule requires you to keep is covered in Which emails must an RIA keep?

This is an example for a firm of eight with the CCO also a principal. The numbers are placeholders, and no rule sets this schedule. Change it to fit your firm's risks.

1. Weekly: work the queue of flagged outbound mail; mark each flag reviewed, false positive or escalated.
2. Monthly: draw a random sample of 25 sent messages (every nth message, with n and the date range recorded) and read them, flagged or not.
3. Quarterly: compare the keyword list with what the flags found; add or drop terms and record the change.
4. After an event (a complaint, a new service, a departure, a rule change): an extra review of the affected mail.
5. Yearly: the Rule 206(4)-7(b) review reads the log and decides whether the cadence stays.
6. The CCO's own mail: a second principal or an outside reviewer reads a monthly sample.

To compare tools, see Best email archiving for small RIAs.

Rule 206(4)-7(b) asks for a review of the policies' adequacy and the effectiveness of their implementation. Use it to check the cadence itself: did the reviews happen, what does the log show, did the flags catch what mattered. The adopting release says the review "should consider any compliance matters that arose during the previous year, any changes in the business activities of the adviser or its affiliates, and any changes in the Advisers Act or applicable regulations that might suggest a need to revise the policies or procedures."

Rule 204-2 requires you to keep the evidence:

"(ii) Any records documenting the investment adviser's annual review of those policies and procedures conducted pursuant to § 275.206(4)-7(b) of this chapter"

17 CFR 275.204-2(a)(17)(ii)

The SEC's fiscal year 2027 examination priorities say examinations "will also typically analyze an adviser's annual compliance review." For record-keeping periods, see how long Rule 204-2 records are kept.

Microsoft Purview includes Communication Compliance, a review feature for Exchange Online mail, Teams and Viva Engage. Microsoft's plan page says covered users need a Purview Suite license, an Office 365 E3 license with the Advanced Compliance add-on, or Office 365 E5; Microsoft's Purview service description does not list Business Premium for it. For a small firm, the plan listing is the first thing to check. More: Is Microsoft 365 retention enough for SEC Rule 204-2? and Microsoft 365 email archiving. For Google Workspace firms, see Google Workspace email archiving.

Turret fits a small RIA on Google Workspace or Microsoft 365. It archives sent and received mail, Trash included, and checks each mailbox's outbound mail against 15 built-in patterns (14 on by default). Flags get AI triage, a confidence and a written reason; every disposition writes an append-only activity row. Turret does not sample unflagged mail, and inbound mail is archived and searchable, not pattern-checked. Turret does not capture texts or chat apps. Email is $99 a month with 5 mailboxes, no setup fee.

Sources opened October 27, 2026.

1. Cornell LII, 17 CFR 275.206(4)-7, Compliance procedures and practices
2. Cornell LII, 17 CFR 275.204-2, Books and records to be maintained by investment advisers
3. SEC, Compliance Programs of Investment Companies and Investment Advisers, Release No. IA-2204 (Dec. 17, 2003)
4. SEC OCIE risk alert, Investment Adviser Use of Social Media (Jan. 4, 2012)
5. SEC OCIE risk alert, Observations from Investment Adviser Examinations Relating to Electronic Messaging (Dec. 14, 2018)
6. SEC OCIE risk alert, Observations: Investment Adviser Compliance Programs (Nov. 19, 2020)
7. SEC Division of Examinations, Fiscal Year 2027 Examination Priorities
8. FINRA Rule 3110, Supervision (broker-dealer rule, shown for comparison)
9. FINRA Regulatory Notice 07-59 (Dec. 7, 2007; broker-dealer guidance, shown for comparison)
10. Microsoft Learn, Manage Communication Compliance policies
11. Microsoft Learn, Microsoft Purview service description (dated August 3, 2026)
12. Microsoft Purview, Plan for Communication Compliance