The examiner’s request list, answered from one archive.
Advisers Act Rule 204-2 requires you to keep client communications for five years and produce them promptly. The SEC’s exam request lists ask for emails by custodian, date range and keyword — and for evidence that nobody could have deleted them. PXCMail journals 100% of mail into an immutable archive and exports it the way the list reads.
| Custodian | Range | Msgs | Integrity |
|---|---|---|---|
| j.park@ | 2025 | 18,402 | sha256 ✓ |
| All advisers | H2 2024 | 61,117 | sha256 ✓ |
| “guaranteed” | 2 yrs | 37 | reviewed |
Overview
Journaling, not mailbox search
A copy of every message before anyone can delete it; mailbox clean-ups never touch the record.
Keyword review for the CCO
“Guaranteed”, “off-channel”, “text me” and your own lexicon flag messages for periodic review; reviews are logged.
Marketing Rule records
Advertisements and testimonials sent by email are in the same archive with dates.
Moments that matter
- Exam notice arrives — export every message for the period, with hashes, in an afternoon.
- Adviser leaves for another firm — their mail stays; access ends.
- Client disputes an instruction — the original, timestamped, retrieved in minutes.
- Custodian statement with account numbers emailed to a client — encrypted automatically.
Works beside
Orion, Redtail, Wealthbox, Salesforce FSC, eMoney, RightCapital; Schwab, Fidelity, Altruist custodian portals. Compliance consultants: ask about the partner program.
Pricing
Gateway + books & records $10 per seat. Firm minimum $49.
What Rule 204-2 asks of an RIA’s email
Three paragraphs of Rule 204-2 decide what an RIA has to do with email. Paragraph (a)(7) says keep originals of written communications received and copies of those sent about any recommendation or advice, receipt or delivery of funds or securities, and the placing or execution of orders. Paragraph (e)(1) sets the period: five years from the end of the fiscal year of the last entry, the first two in an easily accessible place. Paragraph (g) allows electronic storage as long as you can arrange and index the records, produce them promptly, and keep a separate copy with reasonable safeguards against loss or alteration. The Division of Examinations turns that into a request list: all electronic correspondence for named advisers, by date range, by custodian, plus evidence the record is complete. PXCMail journals 100% of mail into immutable storage, keeps it five years under the wealth profile, and exports the way the list reads. It is not a supervision consultancy and it does not capture texts; it is the email record.
A week at Northwind Wealth
Northwind is a five-adviser SEC-registered RIA on Google Workspace with Orion and Redtail. The CCO is one of the advisers. An exam notice arrived on a Monday in October.
- Monday. The request list asks for all electronic communications for three advisers between January 2024 and June 2025, plus any message containing “guaranteed” for two years. The CCO runs four exports; each returns with a sha256 manifest and a chain-of-custody statement.
- Tuesday. A client emails that she wants to move $40,000 to her Schwab account. The adviser’s reply confirming the instruction is journaled before delivery; the thread is retrievable in seconds if she later disputes it.
- Wednesday. A custodian statement with account numbers goes to a client from Orion through the firm’s Google account. Detection sees the account number; the message goes by locked delivery and the open is logged.
- Thursday. Marketing sends the quarterly letter, which includes a client testimonial. Under the Marketing Rule the advertisement, the date and the recipients are records; they are in the same archive without anyone filing them.
- Friday. An adviser gives notice. Access ends that afternoon; his mail stays under the five-year retention and remains in the exam export.
By the numbers
- 5 years, the first 2 easily accessible, under Rule 204-2(e)(1); electronic storage allowed under (g) with indexing, prompt production and a separate copy. (17 CFR 275.204-2)
- 58% of cyber claims in Coalition’s 2026 report were BEC or funds-transfer fraud; the average BEC loss was about $27,000 and the average claim about $116,000. Money-movement instructions by email are exactly the target. (Coalition 2026 Cyber Claims Report)
- 98% of claims in the NetDiligence 2025 study came from small and mid-sized businesses. (NetDiligence Cyber Claims Study 2025)
What the examiner asks
“Produce all electronic communications for these advisers and this period.” Export by custodian, address and date range in EML, MBOX or PST with a sha256 manifest. Export jobs up to 50 GB.
“How do you know nobody deleted anything?” Journaling captures every message before delivery; storage is immutable (S3 Object Lock); mailbox clean-ups never touch the archive. The audit log shows every admin action.
“Show your correspondence review.” The lexicon flags performance claims and off-channel invitations; each review is logged with reviewer, date and outcome. Sampling cadence is yours to set.
“Where are Marketing Rule records?” In the same archive, with dates and recipients; search by the campaign subject or the testimonial’s author.
“Who is your vendor and what did they undertake?” PXCMail, under the books-and-records vendor letter signed at signup, with export of everything within 30 days of leaving and a certificate of destruction.
Going live
- Start the trial with the RIA profile
14 days, $0 charged. The vendor letter and the Data Processing and Safeguards Addendum are signed in signup. - Connect Google Workspace or Microsoft 365
Journaling starts the day the connector is live; the DNS wizard re-checks every five minutes. - Set the five-year profile and the lexicon
Default terms plus your own; give the Compliance role to the CCO or your consultant. - Route Orion, Redtail and the custodian notifications
Anything sent through your Google or Microsoft account inherits the policy. - Test mode for a week, then enforce
Review what would have been encrypted and flagged; run one practice export so the first real one is routine.
What Northwind pays
- Gateway + books and records, 6 seats
- $60 per month, billed yearly ($10 per seat)
- Hosted Pro, 6 seats
- $108 per month with legal hold, SSO, audit API and a contractual SLA
- Compliance consultant seat
- Read-only Compliance role, included
Organization minimum $49. Invoicing is available on annual plans over 25 seats.
Questions CCOs ask
Is journaling different from the archive Google already keeps?
Yes. A mailbox archive follows the mailbox: deleted means gone, and an adviser can empty it. Journaling takes a copy before delivery into storage the adviser cannot touch.
Can the examiner be given direct access?
You export and hand over; nobody outside the firm gets console access unless you grant the Compliance role. Exports carry hashes so the examiner can verify integrity.
Does PXCMail meet Rule 17a-4 for our broker-dealer affiliate?
No. 17a-4 needs a designated third party and other elements that are a separate ROADMAP edition; see broker-dealers.
What about text messages?
Not captured. The lexicon can flag “text me” so the CCO sees invitations to go off channel, but PXCMail is email only.
How fast is an exam export?
An 18-month, multi-adviser export typically runs in an afternoon. The limit is 50 GB per job; larger requests run as several jobs.
Is SOC 2 done?
SOC 2 Type I is ROADMAP. We will say that on your vendor due-diligence form rather than imply otherwise.