Rule 204-2 and email, in plain English.
Short answer: Rule 204-2 requires an SEC-registered adviser to keep the emails that contain advice, orders and money movements, to keep them for five years with the first two easily accessible, and, if they are stored electronically, to keep them indexed, producible on demand and protected from alteration. It does not require a specific product, a WORM device or a third-party downloader; those come from the broker-dealer rule. Below: the three paragraphs that matter, the Marketing Rule additions, how an exam asks for the records, and how a five-adviser firm answers.
What Rule 204-2 requires
Investment advisers registered with the SEC must keep books and records including originals of written communications received and copies of those sent relating to recommendations and advice, receipt or delivery of funds or securities, and orders. Records must be kept for five years from the end of the fiscal year in which the last entry was made, the first two years in an easily accessible place. Electronic records must be arranged and indexed, promptly producible, and protected by reasonable safeguards against loss, alteration and destruction, with a separate copy. State-registered advisers follow equivalent state rules.
The three paragraphs that matter
- (a)(7), what to keep. Originals of written communications received and copies of those sent that relate to any recommendation or advice, any receipt, disbursement or delivery of funds or securities, or the placing or execution of an order. Email with attachments is a written communication. Email that contains none of those three things is not a required record under this paragraph, but most firms capture everything because sorting at the time of sending is unreliable. Read 17 CFR 275.204-2.
- (e)(1), how long. Five years from the end of the fiscal year in which the last entry was made, the first two years in an appropriate office of the adviser. “Easily accessible” in practice means an examiner can have the records within the request window, not after a restore from tape.
- (g), electronic storage. Records may be kept electronically if the adviser arranges and indexes them for easy retrieval, provides prompt legible copies, keeps a separate duplicate, safeguards them from loss, alteration and destruction, and limits access to authorized people. This is the paragraph an email archive answers and a mailbox folder does not.
Marketing Rule records
The Marketing Rule amended 204-2 so that a copy of each advertisement, including an email sent to more than one person that offers advisory services, and the records supporting any performance or testimonial claims must be kept on the same five-year schedule. If an adviser emails a quarterly letter with performance figures to clients, the letter and the figures behind it are both records. The archive keeps the letter; the figures live in Orion or your performance system, and the CCO notes where.
How it differs from Rule 17a-4
Rule 17a-4 applies to broker-dealers and is stricter: non-rewriteable storage or an audit-trail system, serialization and verification, a designated third party able to produce records independently, and FINRA supervisory review under Rule 3110. RIAs are not subject to 17a-4 unless they are also broker-dealers. PXCMail’s RIA edition is built for 204-2; the broker-dealer edition is ROADMAP, not live.
How an exam requests records
The SEC Division of Examinations opens with a document request list, usually with a due date measured in days. Email requests tend to be phrased one of three ways: all communications with a named custodian or client over a date range; all communications containing specified terms (“guaranteed”, “complaint”, performance language); or a sample of communications for a set of advisers over a period. Examiners also ask how the firm ensures records cannot be deleted, and for the firm’s off-channel communications policy and attestations. Our blog walks through reading an SEC exam request list.
What examiners actually ask for
- All emails for named custodians over a date range.
- Emails containing specified keywords (performance claims, complaints, “guaranteed”).
- Evidence that records could not have been altered or deleted, and the firm’s retention policy.
- Marketing communications and testimonials under the Marketing Rule.
- Off-channel communications policy and attestation.
What PXCMail maps to
| Rule paragraph | What it asks | PXCMail |
|---|---|---|
| (a)(7) | Communications received and sent | Journaling of 100% of inbound and outbound mail with attachments, independent of what sits in any mailbox |
| (e)(1) | Five years, first two easily accessible | Five-year default retention on the RIA profile; the whole period is searchable in the console, not just the first two years |
| (g) | Indexed, producible, duplicated, safeguarded, access-limited | Indexed archive search; exports in EML, MBOX or PST with sha256 manifest; immutable storage with a cross-region copy; the Compliance role is read-only; every access logged |
| Marketing Rule amendments | Advertisements and supporting records | Marketing emails land in the same archive; a keyword lexicon flags performance and testimonial language for CCO review with logged outcomes |
What PXCMail commits to
- 100% journaling of inbound and outbound mail with attachments.
- Five-year default retention, all of it immediately searchable; immutable storage with a cross-region copy.
- Exports by custodian, date range and keyword with integrity hashes and a chain-of-custody statement.
- Keyword review workflow for the CCO with logged outcomes.
- Encryption of client account data in transit, with encrypted delivery when needed.
Example: Northwind Wealth
Northwind Wealth has five advisers on Google Workspace, with Orion for portfolios and Redtail for the CRM. The exam request list asks for all communications with two custodians from January 2024 through June 2025, and all emails containing “guarantee” or “guaranteed” for the same period. The CCO opens Console → Archive, runs the custodian search by domain and date range, then the keyword search across all five advisers. Each export arrives as PST with a sha256 manifest and a chain-of-custody statement, which she attaches to the response along with the books-and-records vendor letter from signup and the retention policy from the firm’s compliance manual. Off-channel attestations come from her own quarterly process, not from PXCMail; the archive gives advisers a captured channel so they have less reason to text.
FAQ
We are state-registered, not SEC-registered. Does this apply?
Most states adopt a books-and-records rule that mirrors 204-2, often with the same five-year period. Check your state rule; the controls are the same.
Do we have to review every email?
Rule 204-2 is a records rule, not a supervision rule; the duty to review comes from your compliance program. Most small RIAs do keyword and sampled review and log the outcomes, which is what the CCO workflow supports.
Does Google Vault satisfy (g) on its own?
It can retain mail, but a Workspace admin can change retention rules and the records sit in the same tenant as the mailboxes. Examiners ask for a separate copy and proof that records could not be altered; see how PXCMail compares with Workspace alone.
Is the broker-dealer edition available?
No. Rule 17a-4 support is ROADMAP. Advisers that are also broker-dealers should not rely on the RIA edition for 17a-4.
Wealth & RIAs overview → · The RIA email checklist → · Four rules, in plain English →