SEC Rule 204-2 email retention: 5 years or 7?

Five years, not seven. For an SEC-registered adviser, Rule 204-2(e)(1) requires most books and records, including email about advice and orders, to be kept at least five years from the end of the fiscal year of the last entry. The rule has no seven-year period. State-registered advisers follow their state's rule.

What this means for your firm

• Keep the floor and your own policy on separate lines, and never write that the rule requires seven.
• Know your fiscal year-end: every date turns on it, and the same email carries a different date at two firms.
• Mark the exceptions: advertisements and performance backup run from last dissemination, so keep the last-sent date for anything sent to ten or more people.

Turret's retention policy is 7 years, while you subscribe, longer than the five-year floor for most email records.

What to keep and review for email, with rule-text sources: get the one-page checklist (a PDF).

5 years

the rule's minimum

7 years

Turret's policy while you subscribe

• First 2 years in an appropriate office of the adviser
• Rest of the 5 years the rule requires
• Turret retention policy, while you subscribe

The rule counts from the end of the fiscal year in which the last entry was made (17 CFR 275.204-2(e)(1)). Turret's policy counts from the day each message is archived. The bars show policy, not how much a given firm has archived so far.

Retention periods in years: the SEC rule and Turret's policy

Period	Years
Rule minimum, 17 CFR 275.204-2(e)(1)	5
Of which in an appropriate office of the adviser	2
Turret retention policy, while you subscribe	7

Retention floor

For most records, including email on advice, funds, orders and performance, five years from the end of the fiscal year in which the last entry was made (Rule 204-2(a)(7), (e)(1))

First two years

Kept in an appropriate office of the adviser (Rule 204-2(e)(1))

Seven years in the rule

None; the section has no six-, seven- or ten-year period (Rule 204-2)

Advertisements and performance backup

Five years from the end of the fiscal year in which the adviser last disseminated the communication (Rule 204-2(e)(3)(i), covering (a)(11) and (a)(16))

Broker-dealer email

Three years under the broker-dealer rule, which binds broker-dealers, not advisers (Rule 17a-4(b), (b)(4))

Five, for most email. The operative text is paragraph (e)(1) of Rule 204-2 under the Investment Advisers Act (17 CFR 275.204-2). The rule binds an adviser "registered or required to be registered under section 203 of the Act", which means an SEC-registered adviser, or one required to be. A state-registered adviser follows its state's rule, covered below.

Paragraph (e)(1) governs the books and records required "under the provisions of paragraphs (a) to (c)(1)(i), inclusive, and (c)(2) of this section", except for the paragraphs it lists. Paragraph (a)(7), the written-communications paragraph, is not on that list, so email within (a)(7) falls under (e)(1). Those records:

"... shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser."

17 CFR 275.204-2(e)(1)

The clock. Five years is the floor, and it runs "from the end of the fiscal year during which the last entry was made on such record", not from the day a message is sent. Counted that way, the earliest date the rule allows deletion falls between five and six years after the message was sent, depending on when in the fiscal year it went out. The rule also requires "the first two years in an appropriate office of the investment adviser".

Paragraphs (a)(11) and (a)(16) are excepted from (e)(1), can reach email, and run on a different clock, covered below.

Take a firm with a December 31 fiscal year.

• An email is sent March 12, 2026. The last entry on it was made in fiscal year 2026, which ends December 31, 2026.
• Five years from that date is December 31, 2031. Measured from the day it was sent, that is 5 years, 9 months and 19 days.
• Sent January 2, 2026, the date is still December 31, 2031: just under six years from sending. Sent December 30, 2026, it is a little over five years.
• At a firm with a June 30 fiscal year, the same March 12, 2026 email carries the date June 30, 2031: 5 years, 3 months and 18 days from sending. The fiscal year is the firm's own, so the same email has a different date at two firms.

"Last entry" matters when a thread continues. If the March 12, 2026 exchange runs on until November 3, 2027, the last entry moves into fiscal year 2027 and the December-year-end date moves to December 31, 2032. Whether a thread is one record or several is a judgment for your CCO and counsel.

Rule 204-2 does not tell an adviser to keep every email. Paragraph (a)(7) names the written communications it wants:

"Originals of all written communications received and copies of all written communications sent by such investment adviser relating to:"

17 CFR 275.204-2(a)(7)

Four subjects follow: recommendations and advice, funds or securities, orders, and performance. The paragraph excepts "unsolicited market letters and other similar communications of general public distribution not prepared by or for the investment adviser".

Two other paragraphs can pull an email onto a separate clock:

• (a)(11) covers any advertisement the adviser disseminates, and any notice, circular, newspaper article, investment letter, bulletin or other communication it disseminates to ten or more persons other than persons associated with the adviser.
• (a)(16) covers records "necessary to form the basis for or demonstrate the calculation of any performance or rate of return" presented in those communications.

Both sit outside (e)(1). Paragraph (e)(3)(i) sets their clock:

"... not less than five years, the first two years in an appropriate office of the investment adviser, from the end of the fiscal year during which the investment adviser last published or otherwise disseminated, directly or indirectly, the notice, circular, advertisement, newspaper article, investment letter, bulletin or other communication."

17 CFR 275.204-2(e)(3)(i), as it applies to (a)(11) and (a)(16)

The number is still five. What changes is the trigger: the end of the fiscal year in which the firm last sent the piece out, not the year of the last entry on it. A piece sent again in 2027 restarts the count.

No federal adviser rule we found gives seven years for email. Seven appears in firm policy and in an accountant rule that has nothing to do with an adviser's email. The other periods you will run into are three, five and six.

Firm policy. A firm can choose a longer period. That is a policy decision, not the rule.

State rules. A state-registered adviser follows its state's recordkeeping rule. The NASAA model rule, 203(a)-2(e)(1), uses five years from the end of the fiscal year of the last entry, and was amended May 4, 2026. Oregon's rule, OAR 441-195-0040(5)(a), sets "not less than six years from the end of the fiscal year during which the last entry was made". Those are the two we checked. We found no state rule requiring seven, but we did not read them all, so check your own state's.

Rule 17a-4. It binds broker-dealers, not advisers. Paragraph (b) sets "not less than three years, the first two years in an easily accessible place" for the records it lists, and item (b)(4) puts communications there: "Originals of all communications received and copies of all communications sent". The six years in paragraph (a) cover other records. The longer answer is on Does SEC Rule 17a-4 apply to RIAs?.

Dual registrants. Rule 204-2(h)(1) addresses records kept under Rules 17a-3 and 17a-4 that are substantially the same as records Rule 204-2 requires. A dual registrant should read the two sets of rules together, (h)(1) included, and ask counsel how they apply.

Auditors. 17 CFR 210.2-06(a) requires an accountant to keep audit and review records "For a period of seven years after an accountant concludes an audit or review of an issuer's financial statements". The duty is the accountant's.

Every year a firm keeps is a year it has to be able to produce on request. Rule 204-2(g)(2)(ii) requires an adviser keeping records on electronic storage media to "Provide promptly any of the following that the Commission (by its examiners or other representatives) may request": "A legible, true, and complete copy of the record in the medium and format in which it is stored", a printout, and "Means to access, view, and print the records". A longer period puts more mail inside that duty. A litigation hold or an examination request sits outside any schedule.

1. Write the floor and the policy separately. Rule 204-2 requires five years from the end of the fiscal year of the last entry; our firm retains for seven. Do not write that the rule requires seven.
2. Know your fiscal year-end. Everything above turns on it. It is the one place the arithmetic needs your input.
3. Mark the exceptions. Advertisements and performance backup run from last dissemination. Keep the last-sent date for anything that goes to ten or more people.
4. Keep the records retrievable. If you keep records electronically, Rule 204-2(g) requires you to arrange and index them so any one can be found, and to maintain procedures to "reasonably safeguard them from loss, alteration, or destruction".
5. Treat deletion as a decision. For most email records, five years from fiscal-year end is the earliest date; delete on a schedule you wrote down.

Turret archives sent and received mail from Google Workspace or Microsoft 365, Trash included. Spam, drafts and chats are not captured. Its retention policy is 7 years, while you subscribe. That is a policy period, and it is longer than the five-year floor for most email records. Turret does not calculate a Rule 204-2(e)(1) date for each email; that arithmetic stays with your firm.

The period is fixed. It does not extend to match a longer firm policy, and when a message is past it, a nightly job deletes it. A firm-wide legal hold, set on request, stops scheduled retention deletion. It is for a legal or examination matter, not a way to set a longer schedule.

If you cancel, access continues to the end of the period you have paid for. The archive is then kept for 60 days, and a full export is available on request in that time. After that a named person deletes it, never an automatic timer. Rule 204-2 stays your firm's obligation after you leave, which is why the export exists.

More on what the archive does: Email compliance. Questions on retention: Talk to us.

Sources opened October 17, 2026.

1. 17 CFR 275.204-2, Books and records to be maintained by investment advisers, paragraphs (a), (a)(7), (a)(11), (a)(16), (e)(1), (e)(3)(i), (g), (h)(1) — eCFR and Cornell LII
2. 17 CFR 240.17a-4, Records to be preserved by certain exchange members, brokers and dealers, paragraphs (a), (b) and (b)(4) — Cornell LII
3. NASAA, Recordkeeping Requirements for Investment Advisers Model Rule 203(a)-2, amended May 4, 2026 — NASAA (PDF)
4. Oregon Administrative Rule 441-195-0040, as published by Oregon Public Law — oregon.public.law
5. 17 CFR 210.2-06, Retention of audit and review records — Cornell LII