Which books and records must an RIA keep, and which can software hold?

All of them, if the system meets paragraph (g). Rule 204-2(a) lists 19 paragraphs of records, and a firm may keep them on electronic storage that is indexed, producible promptly on request, and backed by a separately stored duplicate. Which paragraphs apply to your firm is a decision for your CCO and counsel. This page is information, not legal advice.

What this means for your firm

• Go down the table below and write beside each paragraph where your firm’s copy lives and who can produce it.
• For any record in a system you cannot export from on request, test an export this week. Paragraph (g)(2)(ii) asks for prompt production.
• Check the fiscal-year end your retention clocks count from, and write it down.

Next: Does a small RIA need email archiving? and the SEC Marketing Rule checklist.

Rule 204-2(a) opens by listing what an adviser must “make and keep true, accurate and current” (17 CFR 275.204-2(a)). Each cell paraphrases one paragraph. The last column names where small firms usually keep that record.

Source for the paragraph text: 17 CFR 275.204-2(a) (eCFR). The last column is common small-firm practice, not part of the rule.

• Who must keep them: “Every investment adviser registered or required to be registered under section 203 of the Act” (Rule 204-2(a))
• Retention floor: Five years from the end of the fiscal year in which the last entry was made on the record, the first two years in an appropriate office (Rule 204-2(e)(1)); for advertisements and performance support, from the fiscal year last published or disseminated ((e)(3)(i))
• Electronic storage: Allowed on a digital storage medium or system that meets paragraph (g): indexed, producible promptly, with a duplicate stored separately (Rule 204-2(g))

Paragraph (a) opens by saying whom it binds:

“Every investment adviser registered or required to be registered under section 203 of the Act (15 U.S.C. 80b-3) shall make and keep true, accurate and current the following books and records relating to its investment advisory business”

17 CFR 275.204-2(a)

That is an SEC-registered adviser, or one required to be. A state-registered adviser follows its state’s recordkeeping rule. NASAA’s model rule 203(a)-2, amended May 4, 2026, says on its first page: “This rule is intended for jurisdictions that have adopted the Uniform Securities Act of 1956.” It is a model; your state’s own rule governs. See What changed for state-registered RIAs’ marketing in 2026?

Paragraph (a)(7) names the mail:

“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given;”

17 CFR 275.204-2(a)(7)(i)

Items (ii) to (iv) add funds and securities, orders, and performance. A proviso excuses “unsolicited market letters and other similar communications of general public distribution not prepared by or for the investment adviser” ((a)(7)(iv)(A)).

The rule turns on subject: it does not say “to or from clients” or “internal”. We found no SEC rule or staff statement that excludes purely internal messages on those four subjects. Turret archives sent and received mail so the right subset can be found; that is a product choice, not an SEC requirement. See which emails an RIA must keep and how long Rule 204-2 email records are kept.

The Marketing Rule added records to Rule 204-2. Paragraph (a)(11)(i) starts:

“A copy of each (A) Advertisement (as defined in § 275.206(4)-1(e)(1) of this chapter) that the investment adviser disseminates, directly or indirectly, except: …”

17 CFR 275.204-2(a)(11)(i)(A)

The exceptions cover oral advertisements and compensated oral testimonials; item (B) adds communications sent “to ten or more persons (other than persons associated with such investment adviser)”. Paragraph (a)(15) adds testimonial, endorsement and rating documentation, (a)(16) the basis for performance figures, and (a)(19) the intended-audience record.

What examiners found missing. The SEC staff’s April 2024 risk alert (a staff view with no legal force) reports some advisers “did not maintain copies of information posted to social media” ((a)(11)(i)), “did not maintain documentation to support performance claims included in advertisements” ((a)(16)), and, having completed third-party-rating questionnaires, “did not maintain a copy of such questionnaires” ((a)(11)(ii)). Related: Do RIAs need to archive their website? and How long must an RIA keep advertisements?.

For most records, Rule 204-2(e)(1) sets not less than five years from the end of the fiscal year during which the last entry was made, the first two years in an appropriate office. Advertisements and performance support run from the fiscal year last disseminated.

“…for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.”

17 CFR 275.204-2(e)(1)

Paragraph (e)(3)(i) covers (a)(11) and (a)(16), counting from the fiscal year “during which the investment adviser last published or otherwise disseminated” the communication. Paragraph (e)(1) also carves out (a)(12)(i), (a)(12)(iii), (a)(13)(ii), (a)(13)(iii) and (a)(17)(i); check the rule for their periods. As we read the rule, (a)(15) and (a)(19) fall under (e)(1): neither is named in (e)(3)(i) or in that carve-out list.

Yes. Rule 204-2(g)(1)(ii) allows electronic storage media, including any digital storage medium or system that meets the terms of the section. Those terms include indexing, prompt production for examiners and a separately stored duplicate copy.

The duplicate-copy term reads:

“Separately store, for the time required for preservation of the original record, a duplicate copy of the record on any medium allowed by this section.”

17 CFR 275.204-2(g)(2)(iii)

Paragraph (g)(2) also asks the adviser to index records for easy retrieval and to provide examiners promptly with a legible, true and complete copy and printout of a record. The test is outcomes, not a product. The SEC’s 2001 release adopting these amendments (IA-1945) allowed advisers to keep all of their records electronically. The Marketing Rule’s adopting release (IA-5653, p. 245) accepts e-mail archives, including in cloud storage or with a third-party vendor, for advertisement records if the adviser can promptly produce them. Paragraph (g)(3) adds procedures against loss, alteration or destruction and to limit access.

No. Turret holds email from connected mailboxes, advertisements submitted for review with their approval records, and your website versions. Ledgers, trade records, the code of ethics and client agreements stay in your other systems.

Turret fits a small RIA on Google Workspace or Microsoft 365: about ten minutes to set up, no setup fee, 15-day free trial. It computes each submitted ad’s Rule 204-2(e)(3) clock; email and website snapshots follow your firm’s retention policy. Texts and chats are not captured. Email $99/mo with 5 mailboxes; Marketing $99/mo.

Sources opened October 27, 2026.

1. eCFR, 17 CFR 275.204-2, Books and records to be maintained by investment advisers
2. Cornell LII, 17 CFR 275.204-2, Books and records to be maintained by investment advisers Cross-check of the rule text.
3. SEC, Investment Adviser Marketing, Release No. IA-5653 (Dec. 22, 2020)
4. SEC, Electronic Recordkeeping by Investment Companies and Investment Advisers, Release Nos. IC-24991, IA-1945 (May 24, 2001)
5. SEC Division of Examinations risk alert, Initial Observations Regarding Advisers Act Marketing Rule Compliance (Apr. 17, 2024) A staff view; it has “no legal force or effect”.
6. NASAA, Recordkeeping Requirements for Investment Advisers, Model Rule 203(a)-2 (amended May 4, 2026)