Guide
Email Archiving and Retention Requirements for Financial Firms
Advisers and broker-dealers must keep business emails, texts and chats for years and produce them when examiners ask. Here is what the SEC and FINRA rules require and how to set up archiving that meets them.
Key takeaways
- SEC-registered investment advisers keep written communications about advice, client funds or securities, orders and performance for five years, the first two in an appropriate office.
- Broker-dealers keep communications relating to their business for at least three years and store electronic records in WORM format or with a complete audit trail.
- The rules follow the content of a message, not the app or the device, so business texts and chats count too.
- Microsoft 365 retention settings help, but your setup must match the rule that applies to your firm, so confirm it with your compliance team.
The rules
Which email retention rules apply to your firm
Investment advisers: SEC Rule 204-2
SEC-registered advisers must keep originals of written communications they receive and copies of those they send that relate to advice or recommendations, the receipt, disbursement or delivery of client funds or securities, the placing or execution of orders, and performance. Most of these records must be kept for five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the adviser. Records may be kept electronically, as long as they are organized so any one of them can be found and produced promptly and are protected from loss, alteration and unauthorized access.
Broker-dealers: SEC Rule 17a-4 and FINRA Rule 4511
Broker-dealers must keep originals of all communications received and copies of all communications sent relating to their business as such for at least three years, the first two in an easily accessible place. Many other broker-dealer records must be kept for six years, and FINRA Rule 4511 sets six years for FINRA records with no other retention period. FINRA Rule 3110 also requires procedures for reviewing incoming and outgoing correspondence.
Electronic records must meet Rule 17a-4(f). Since the amendments that took full effect on May 3, 2023, a broker-dealer can keep records in a non-rewriteable, non-erasable format (WORM) or in a system that keeps a complete time-stamped audit trail of every change. A designated executive officer or a designated third party must also give regulators an undertaking to provide access to the records.
Dual registrants and other financial firms
Firms registered as both an adviser and a broker-dealer generally keep their broker-dealer records to the stricter Rule 17a-4 standard. Banks, credit unions, insurance agencies and accounting firms follow the retention rules of their own regulators and state law. Under the FTC Safeguards Rule, accounting and tax firms must also dispose of customer information no later than two years after it was last used, unless it is still needed or another law requires keeping it.
Every channel
Texts, chats and personal phones count too
The rules look at what a message says, not where it was sent. A recommendation sent by text, WhatsApp, Microsoft Teams chat or a social media direct message must be kept just like the same recommendation sent by email, including messages sent from an employee’s personal phone.
Since late 2021 the SEC has brought a long series of cases against broker-dealers and advisers whose staff discussed business on texting and messaging apps that were not archived, with penalties in some cases of more than $100 million. The practical lesson for any firm:
- Approve the channels staff may use for business, and capture every one of them in your archive
- Block or prohibit business use of channels you cannot capture
- Train staff on the policy and have them confirm it in writing
- Test the policy, for example by reviewing whether clients are texting advisers on unapproved apps
Microsoft 365
Can Microsoft 365 handle email archiving?
Microsoft 365 retention policies, retention labels and litigation holds can keep mailboxes, Teams chats and files from being deleted for a set period, and a preservation lock can stop anyone, including administrators, from weakening a retention policy once it is set. When an employee leaves, a retention policy or hold keeps the mailbox as an inactive mailbox instead of deleting it with the account.
Those settings are a strong foundation, but they do not capture text messages on phones or most social media, and a broker-dealer must still show that its setup meets Rule 17a-4(f), including the undertaking. Many firms add a dedicated archiving service that captures email, Teams, texts and social media in one searchable place with review tools for supervision. Whichever route you choose, confirm with your compliance team that it meets the rule that applies to your firm.
Checklist
Email archiving checklist for financial firms
- Confirm which rules apply: Rule 204-2, Rule 17a-4 and FINRA Rule 4511, state requirements or your own regulator’s rules.
- List every channel staff use for business: email, Teams, texting, messaging apps and social media.
- Choose an archive approach that meets your rule, such as Microsoft 365 retention with preservation lock or a dedicated archiving service.
- Capture every mailbox, including shared mailboxes, and keep former employees’ mailboxes instead of deleting them.
- Set retention periods by record type, and place legal holds when litigation or an investigation is expected.
- Limit who can search and export the archive, and log every search and export.
- Test that you can find and export all messages for a client or a date range quickly, the way an examiner would ask.
- Set up supervisory review of correspondence if your firm is a broker-dealer.
- Write the setup into your compliance manual or written supervisory procedures.
- Review the setup every year and whenever staff start using a new communication tool.
How FinFortify helps
How FinFortify helps with email archiving
Our Microsoft 365 managed services for financial firms cover the settings archiving depends on: retention policies, litigation holds, inactive mailboxes for departing staff, and the access controls and logging around them. We work with your compliance team and your archiving provider so mail, Teams and approved messaging channels are captured, and so you can produce records quickly when an examiner asks.
For the rest of your compliance program, see our IT compliance services and our Regulation S-P compliance checklist. Broker-dealers can also read our FINRA business continuity plan guide. To talk about your setup, request a quote.
FAQ
Email archiving: frequently asked questions
How long must investment advisers keep emails?
Under SEC Rule 204-2, written communications about advice, client funds or securities, orders and performance must be kept for five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the adviser.
How long must broker-dealers keep emails?
Under SEC Rule 17a-4, communications relating to the business must be kept for at least three years, the first two in an easily accessible place. Many other broker-dealer records must be kept for six years, and FINRA Rule 4511 sets six years for FINRA records with no other period.
Do text messages have to be archived?
Yes, when they relate to the business the rules cover, such as advice, recommendations or orders. That applies on any app and any device, including personal phones used for work.
Is Microsoft 365 enough for SEC and FINRA email archiving?
Microsoft 365 retention policies, litigation holds and preservation lock can keep messages from being deleted, but they do not capture texts on phones, and broker-dealers must confirm the setup meets Rule 17a-4(f). Many firms add a dedicated archiving service. Confirm your approach with your compliance team.
Get your email archiving right
Tell us about your firm and we will help you set up Microsoft 365 and your archive so records are kept and easy to produce.
