The 12 email questions before an exam.
Use this with your compliance consultant before the next annual review.
- Are all client communications by email captured, including attachments? Journaling of 100% of mail, not mailbox retention.
- Can anyone delete a message from the record? Immutable storage for the retention period.
- How long are records kept, and are the first two years easily accessible? Five years; all searchable instantly.
- Can you produce by custodian, date range and keyword? Exports with integrity hashes.
- Is there a separate copy of the records? Cross-region copy.
- Do you review communications for prohibited claims? Keyword lexicon and sampling, logged outcomes.
- How do you handle off-channel communications (texts, personal email)? Policy, attestation, and a captured channel staff actually use.
- Are marketing emails and testimonials retained under the Marketing Rule? Same archive.
- Is client account data encrypted when emailed? Enforced TLS; encrypted delivery when needed.
- Is MFA on for every account, and are departed advisers removed promptly? Yes, with logs.
- Who at your vendor can access records, and under what agreement? Books-and-records vendor letter; logged access; no offshore access to content.
- What is your plan for an account takeover? Incident response with the archive as the source of truth.
Why these twelve
Each question traces to a paragraph of Rule 204-2 or to a related rule that examiners pair with it. Questions 1 and 8 come from (a)(7) and the Marketing Rule amendments: what counts as a required communication. Questions 2, 4, 5 and 11 come from (g): electronic records must be indexed, promptly producible, duplicated, safeguarded from alteration and access-limited. Question 3 is (e)(1): five years, the first two easily accessible. Questions 6 and 7 come from the compliance-program and off-channel sweep that examiners run alongside the records request. Questions 9, 10 and 12 are not in 204-2 at all; they come from Regulation S-P safeguards and from the account-takeover cases that generate most small-RIA incidents. An examiner will not read the rule to you; they will ask these questions and wait.
A worked answer sheet: Northwind Wealth
Five advisers, Google Workspace, Orion and Redtail. The CCO filled in the sheet before the annual review.
| # | Northwind’s answer | Evidence |
|---|---|---|
| 1 | All Workspace mail is journaled to PXCMail with attachments, including shared mailboxes | Journaling status in Console → Archive; last quarterly compliance report |
| 2 | No. Archive storage is immutable for the retention period; admins cannot shorten it | Retention setting in the console; books-and-records vendor letter |
| 3 | Five years from fiscal year end; all five years searchable in the console | Retention setting (RIA profile); compliance manual section 7 |
| 4 | Yes, by custodian domain, date range and keyword; PST export with sha256 manifest | Sample export from last review, with chain-of-custody statement |
| 5 | Cross-region replicated copy in us-west-2 | Continuity page, printed and filed |
| 6 | Keyword lexicon (“guarantee”, “no risk”, performance terms) plus a monthly sample | Review log with outcomes, exported quarterly |
| 7 | Written policy: no client business by text or personal email; quarterly attestation | Signed attestations in Redtail; policy in the manual |
| 8 | Yes. Quarterly letters and prospect emails sit in the same archive; performance backup lives in Orion | Archive search for the letter; Orion report ID noted in the marketing log |
| 9 | TLS enforced; account numbers trigger locked delivery automatically | Policy rule screenshot; audit trail entries showing the decision |
| 10 | MFA on every account; offboarding checklist removes access the same day | Console → Users export; last offboarding ticket |
| 11 | US-based PacinfraX staff only, on written request, logged; offshore support sees metadata only | Vendor letter; data residency page; access log (empty) |
| 12 | Incident plan: revoke sessions, reset, review the audit trail, notify clients and custodians from the archive record | Plan in the manual; first-hour guide linked |
How to use it before the exam
- Fill the sheet in with your compliance consultant at the annual review, not when the request list arrives.
- Run one real export now (one custodian, one quarter) and time it. If it takes days, question 4 is not answered.
- Check that the first two years are searchable without a restore; that is what “easily accessible” means in practice.
- Put the sheet, the vendor letter and a sample export in the exam binder next to the compliance manual.
- When the request list comes, map each request to a search, run it, and attach the manifest with the production.
FAQ
Do we need to archive internal emails between advisers?
Only those that relate to advice, funds or orders are required records, but separating them at send time is unreliable, so most firms journal everything and let retention apply uniformly.
What about texts and WhatsApp?
They are communications too. The usual answer for a small RIA is a written prohibition, a quarterly attestation and a captured channel staff prefer. Text capture is not something PXCMail does.
Does the examiner want the archive vendor’s name?
Usually yes, with the agreement that governs it. That is what the books-and-records vendor letter is for.
Is a broker-dealer covered by this checklist?
No. Rule 17a-4 asks more. A broker-dealer edition is ROADMAP.
Related
Rule 204-2, in plain English · Wealth & RIAs · Reading an SEC exam request list