Which emails must an RIA keep?

An RIA must keep the written communications it sends and receives on four subjects: recommendations and advice, funds and securities, orders to buy or sell, and performance. Other paragraphs of Rule 204-2 also reach advertisements and the records behind performance figures. The rule sorts mail by subject, not by whether it went to a client.

What this means for your firm

• Write down which subjects you treat as within paragraph (a)(7) and who decides the edge cases. Start with the sorting test below.
• List where business is actually done: firm mailboxes only, or also personal email, texts and chat apps. A message on the four subjects is the same question wherever it was sent.
• Record your position on internal email. The rule does not settle it, so a written position beats an unstated habit.
• Capture sent and received mail without sorting it by subject first, and make sure capture runs before staff delete anything.

Turret archives sent and received mail from the mailboxes you connect, Trash included.

Six questions about how your firm keeps and reviews email: take the SEC email-readiness self-check.

What (a)(7) covers

Originals of written communications received and copies of those sent, on advice, funds and securities, orders, and performance (17 CFR 275.204-2(a)(7), Cornell LII).

What else reaches email

(a)(11) covers advertisements and communications sent to ten or more persons; (a)(16) covers the records behind performance shown to any person (17 CFR 275.204-2, Cornell LII).

Not settled

Whether purely internal email on the four subjects must be kept. The rule text does not settle it, and neither do the sources below. The Senvest order concerns texts.

Rule 204-2 applies to every adviser “registered or required to be registered under section 203 of the Act”. Paragraph (a)(7) is the main paragraph that reaches email. It says “written communications”, not email, and covers those received and those sent, on four subjects:

“(7) Originals of all written communications received and copies of all written communications sent by such investment adviser relating to:

(i) Any recommendation made or proposed to be made and any advice given or proposed to be given;

(ii) Any receipt, disbursement or delivery of funds or securities;

(iii) The placing or execution of any order to purchase or sell any security; and, for any transaction that is subject to the requirements of § 240.15c6-2(a) of this chapter, each confirmation received, and any allocation and each affirmation sent or received, with a date and time stamp for each allocation and affirmation that indicates when the allocation and affirmation was sent or received;

(iv) Predecessor performance (as defined in § 275.206(4)-1(e)(12) of this chapter) and the performance or rate of return of any or all managed accounts, portfolios (as defined in § 275.206(4)-1(e)(11) of this chapter), or securities recommendations;”

17 CFR 275.204-2(a)(7)(i) to (iv)

Two provisos follow item (iv). An adviser need not keep “unsolicited market letters and other similar communications of general public distribution not prepared by or for the investment adviser”. And when it sends an advertisement offering a service to more than ten persons, it need not keep the recipients' names and addresses, though it must keep a memorandum describing any list used.

The text sorts mail by subject. It has no “to clients” limit and no internal-email exception.

Two other paragraphs can apply to an email you send. Paragraph (a)(11)(i) requires a copy of each:

“Notice, circular, newspaper article, investment letter, bulletin, or other communication that the investment adviser disseminates, directly or indirectly, to ten or more persons (other than persons associated with such investment adviser)”

17 CFR 275.204-2(a)(11)(i)(B)

As we read it, a market-commentary email or newsletter sent to ten or more people fits that description. Advertisements, as the Marketing Rule defines them, are covered by (a)(11)(i)(A).

Paragraph (a)(16) concerns the records behind a performance figure. It requires “All accounts, books, internal working papers, and any other records or documents that are necessary to form the basis for or demonstrate the calculation of any performance or rate of return” of the accounts, portfolios or recommendations presented in a communication the adviser disseminates “to any person (other than persons associated with such investment adviser)”. That is “any person”, not ten or more.

If you plan to show performance earned at a previous firm, see email archiving for a new RIA.

A working test built from the rule text.

1. Did the firm send or receive it, and does it relate to advice or a recommendation, funds or securities moving, an order to buy or sell, or performance?
2. Is it an advertisement, or did it go to ten or more people or show performance figures to anyone (not counting persons associated with the firm)? Then (a)(11) or (a)(16) may apply.
3. Is it an unsolicited market letter of general public distribution not prepared by or for the firm? Then (a)(7) does not require it.

Under (a)(7), keep it when question 1 is yes and question 3 is no.

(a)(11) and (a)(16) are separate paragraphs: use question 2.

If unsure, keep it. Keeping a message you did not need costs storage; losing one you did need cannot be undone.

The test omits the recipient-list proviso.

A client asks you to wire funds: question 1. A colleague asks about buying a security for a client: question 1 (internal; see next section). A newsletter to clients: question 2.

The text of Rule 204-2(a)(7) has no internal-email exception, and we found no SEC rule or staff statement that excludes purely internal messages on its four subjects. In its settled Senvest order, about texts, the SEC found numerous messages among the firm's staff and others within (a)(7).

Paragraph (a)(11)(i)(B) expressly excludes “persons associated with such investment adviser”. Paragraph (a)(7) has no such carve-out.

None of these settles it. SEC staff wrote in 2012 that “the content of the communication is determinative” (a staff view, in a risk alert on social media). In Senvest, the Commission found that “Numerous messages related to matters within the scope of Advisers Act Rule 204-2(a)(7) and thus were required to be preserved by Senvest.” One law-firm summary, from October 2023 (before the Senvest order), said “What communications fall within Rule 204-2(a)(7) remains uncertain”.

Whether a given internal email relates to one of the four subjects is for your CCO and counsel to decide. Until they do, treat it as in scope.

They can. SEC staff wrote in 2012 that the obligation “does not differentiate between various media” and that “the content of the communication is determinative.” In a settled 2024 order, the SEC found numerous messages sent on personal texting apps within Rule 204-2(a)(7).

The order says employees used “personal texting platforms and other non-Senvest electronic communication services” for Senvest-related business and finds violations of Rule 204-2(a)(7) (order, paragraphs 2 and 19). Press release 2024-44 announced the charges.

The staff's 2018 risk alert left email on advisers' own systems out of its review, because firms “have decades of experience complying with regulatory requirements with respect to firm email”. Among practices it noted for advisers that let staff use personal email, social media or personal websites for business is adopting “policies and procedures for the monitoring, review, and retention of such electronic communications.”

The question is the same for personal accounts and apps. Turret does not capture texts or chat apps; a firm that uses them needs another tool. See the buyer's guide for small RIAs.

No SEC source we found says an adviser must keep, or may not keep, every email. Rule 204-2(a)(7) defines what must be kept by subject. Archiving sent and received mail without sorting it by subject first keeps that subset available. The SEC does not require it; we recommend it.

Our reasoning: sorting by subject has to happen somewhere, and capture is the risky place. A filter that runs when mail is copied must decide, before anyone asks, whether a message relates to the four subjects. A miss cannot be fixed later: a message not captured, then deleted, is not in the archive.

Turret takes the other route: it polls each mailbox hourly and copies Trash and Deleted Items, so a deleted message is still captured if Turret copied it before it was purged.

Keeping the mail unsorted moves the sorting to the day you need the records. Paragraph (g)(2)(i) asks that records be indexed for “easy location, access, and retrieval of any particular record”; full-text search is one way to find the subset.

For the (a)(7) records, paragraph (e)(1) sets the period:

“…shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.”

17 CFR 275.204-2(e)(1)

Records under (a)(11) and (a)(16) have their own clock in paragraph (e)(3)(i): five years from the end of the fiscal year in which the adviser “last published or otherwise disseminated” the communication.

Paragraph (g)(2)(ii) asks the adviser to “Provide promptly” what examiners request. Turret has full-text search over the archive and, on request, runs an export for you, a ZIP of .eml files with a manifest; there is no self-serve button.

The period counts from a fiscal year-end, not from the day a message was sent. How long Rule 204-2 records are kept covers the difference in practice, and does email archiving capture deleted email covers mail a user removes. To see how review fits alongside the archive, see how to review RIA email.

Turret fits a small RIA on Google Workspace or Microsoft 365. It archives sent and received mail from every mailbox you connect, Trash included, and hashes each message with SHA-256. Review is outbound-only: each flag gets a written reason. Email is $99 a month for 5 mailboxes, with no setup fee and a 15-day free trial. Spam and drafts are not captured. Retention follows your firm's policy (7 years by default), counted from archiving, while you subscribe.

Sources opened October 27, 2026.

1. Cornell LII, 17 CFR 275.204-2, Books and records to be maintained by investment advisers
2. SEC OCIE risk alert, Investment Adviser Use of Social Media (Jan. 4, 2012)
3. SEC OCIE risk alert, Observations from Investment Adviser Examinations Relating to Electronic Messaging (Dec. 14, 2018)
4. SEC, In the Matter of Senvest Management, LLC, Advisers Act Release No. 6581 (Apr. 3, 2024)
5. SEC press release 2024-44, SEC Charges Advisory Firm Senvest Management with Recordkeeping and Other Failures (Apr. 3, 2024)
6. Summary: Sidley Austin LLP (Oct. 4, 2023)
7. Quick table, Smarsh: Smarsh, Email channel page (smarsh.com), Smarsh, Mobile channel page (smarsh.com), Smarsh, RIA Compliance Software & Solutions (smarsh.com), Smarsh, Compliance Solutions for SMB (smarsh.com)
8. Quick table, Global Relay: Global Relay Google Workspace connector, Global Relay for Microsoft 365 Exchange Online connector, Global Relay Archive (industries and channels), Global Relay Archive (product page), Global Relay solutions for finance