How to read an SEC exam request list and answer the email items in an afternoon
The request list from the Division of Examinations arrives as a PDF with dozens of numbered items and a short clock. The communications items look like this; here is what each is really asking, and how Rule 204-2 frames the answer.
“All electronic communications for the following personnel for the period…”
They want proof you captured everything, not a mailbox search. Journaling, a copy of every message written before anyone could delete it, is the answer. Export by custodian and date range with a manifest and hashes.
“Policies and procedures regarding electronic communications, including off-channel”
Your written policy, the attestation your advisers sign, and evidence the captured channel is one they actually use. If advisers text clients, you need either capture or a credible prohibition with monitoring.
“Evidence of review of electronic communications”
A log of periodic reviews: lexicon hits (“guaranteed”, “promise”, performance claims), sampling, who reviewed, what was escalated. The review log is as important as the archive.
“Advertisements and marketing communications”
Under the Marketing Rule, emails that advertise are records too. Same archive, filtered by keyword and recipient count.
“Description of the books and records system, including how records are protected from alteration”
Immutable storage, a separate copy, access controls and integrity hashes, which is what Rule 204-2(g) asks for, described in one page you can attach.
The afternoon
- Export custodian/date-range sets with manifests.
- Export the keyword review log.
- Attach your policy, attestation template and the vendor’s system description.
- Keep the chain-of-custody statement with the production.
Rule 204-2 doesn’t ask for enterprise archiving prices. Rule 204-2, in plain English → · What a 204-2 archive should cost →
Was this useful? Tell us at [email protected]. Related: checklists · regulations in plain English.
Sources
- 17 CFR 275.204-2, Books and records to be maintained by investment advisers, (a)(7), (e)(1) and (g) — defines the communications an adviser must keep, the five-year retention with the first two years easily accessible, and the conditions for electronic records.
- 17 CFR 275.206(4)-1, Investment adviser marketing — defines advertisements, which must be retained as records.
- SEC Division of Examinations — the office that issues exam request lists and publishes its annual priorities.
Priya leads security at PacinfraX and handles incident response for customers. She writes about business email compromise, wire fraud and what examiners and carriers actually ask for. About the team →
Reviewed against the regulation text cited above. Not legal advice.