Rule 204-2 email archiving without enterprise prices

A registered investment adviser needs an archive that keeps every email about advice, orders and client money for five years, with the first two years easy to reach, in a form that cannot be quietly changed. That is what Advisers Act Rule 204-2 asks for. It does not ask for supervisory sampling queues, a designated third party or WORM attestation letters. Those belong to broker-dealers under a different rule. A five-adviser RIA that is paying for them is paying for someone else’s compliance program.

Northwind Wealth is a five-adviser SEC-registered RIA on Google Workspace, with Orion for portfolio reporting and Redtail as the CRM. Its CCO told us the firm’s archiving bill was larger than Redtail’s. The vendor was built for broker-dealers: WORM storage with vendor attestations, supervisory review workflows, designated-third-party undertakings. All of it is required under Exchange Act Rule 17a-4. None of it is required under Rule 204-2, which is the rule that actually applies to a registered investment adviser.

What 204-2 requires

• Which records. Rule 204-2(a)(7): originals of written communications received and copies sent that relate to any recommendation or advice, any receipt or delivery of securities or funds, or the placing or execution of an order. For a small RIA that is most client email, so capture everything rather than try to sort it.
• How long. Rule 204-2(e)(1): five years from the end of the fiscal year in which the last entry was made, in an easily accessible place, with the first two years in an appropriate office of the adviser.
• In what form. Rule 204-2(g): electronic records are allowed if you arrange and index them so any record can be located, provide a legible copy and the means to read it promptly on request, keep a separate duplicate copy, and maintain procedures that reasonably safeguard them from loss, alteration or destruction and limit access to authorized people. Examiners read “safeguard from alteration” as immutable storage with integrity hashes and “separate copy” as a second location.

What an exam request looks like

The communications items on a typical Division of Examinations request list read like this. “All electronic communications, including email, for the following persons for the period January 1 to December 31”, with the firm’s five advisers named. “Policies and procedures concerning electronic communications, including the use of personal devices and messaging applications.” “Evidence of the adviser’s review of electronic communications during the period.” “All advertisements, as defined in Rule 206(4)-1, disseminated during the period.” And: “A description of the adviser’s books and records system, including how electronic records are protected from alteration.”

For Northwind the answers are four exports and two documents. Exports by custodian and date range for each adviser, each with a sha256 manifest and a chain-of-custody statement. A keyword export for the marketing items. The written communications policy and the attestation each adviser signs. A one-page system description from the vendor covering journaling, immutable storage, the separate copy and access roles. We go through the items one by one in how to read an SEC exam request list.

What it should cost

Journaling, immutable storage and a search index are commodity infrastructure now. The expensive parts of broker-dealer products, supervisory sampling workflows, third-party undertakings and FINRA-specific reporting, are what a small RIA is paying for and not using. A books-and-records archive built for a small adviser should cost about what a lunch costs, per seat, per month.

Here is the math for Northwind. PXCMail Gateway with the RIA books-and-records archive profile is $10 per seat per month billed yearly: five advisers is $50 a month, or $600 a year. The $49 organization minimum does not bind, because five seats already clear it; a firm with four seats would pay the $49 minimum instead. That price includes journaling of 100% of mail, five-year retention with the first two years easily accessible, legal hold by person, matter or date range, exports in EML, MBOX or PST with a sha256 manifest, and the books-and-records vendor letter signed during signup. The CCO keeps Google Workspace exactly as it is.

Compare that with the enterprise approach, without naming anyone’s price list. Broker-dealer archiving is usually quoted with a platform fee and a seat minimum sized for firms much larger than Northwind, and the supervisory module is often a separate line. Ask any vendor two questions: which parts of this quote exist only because of Rule 17a-4, and what is the price without them. If the answer to the second is “the same”, you are paying for the wrong rule.

Setting it up at Northwind

1. Sign the books-and-records vendor letter and the Data Processing and Safeguards Addendum during signup; file both with the compliance manual.
2. Turn on journaling so every message, inbound and outbound, is copied to the archive before anyone can delete it.
3. Set the retention profile to wealth/RIA: five years, first two easily accessible.
4. Give the CCO the Compliance role, which is read-only over audit and archive, so review and production never need an admin password.
5. Run a test production: one adviser, one quarter, exported with its manifest and opened on a laptop that has never seen the system.
6. Write the off-channel policy and collect attestations; the archive only proves what it captures.

Questions

Do we need WORM storage?

Rule 204-2(g) requires procedures that reasonably safeguard records from loss, alteration or destruction. Immutable object storage with integrity hashes meets that plainly. “WORM” as a labelled requirement, with vendor attestations and a designated third party, comes from Rule 17a-4 for broker-dealers.

Does the archive have to review messages for us?

No rule requires an RIA to run a supervisory sampling workflow. Examiners do ask for evidence that you review communications under your own compliance program, so keep a short review log: what you searched, what you found, what you did. Keyword search over the archive is enough tooling.

What about texts and personal devices?

Email archiving does not capture them. You need either a capture tool for those channels or a written prohibition with attestations and some evidence it is followed. Examiners have asked this question of larger firms for years and will ask Northwind too.

Five advisers, but we also have two operations staff. Do they need archive seats?

If they send or receive client communications about advice, orders or funds, yes. Most small RIAs archive every mailbox because sorting is more expensive than the extra seats: seven seats at Northwind would be $70 a month.

Is “easily accessible” for the first two years met by a cloud archive?

Yes, provided search returns results and exports run promptly, which is the point of the test production in step five. Keep the test export and its timestamps; they are useful evidence of accessibility.

That is the premise of PXCMail for wealth and RIAs. If you are a broker-dealer, you need more, and we say so on the broker-dealer page.

Sources

• 17 CFR 275.204-2, Books and records to be maintained by investment advisers, (a)(7), (e)(1) and (g) — defines which communications an adviser must keep, the five-year retention with the first two years easily accessible, and the conditions for electronic records.
• 17 CFR 275.206(4)-1, Investment adviser marketing — defines advertisements, which are records too under Rule 204-2.
• SEC Division of Examinations — the office that issues adviser exam request lists and publishes its priorities.