The books-and-records rules, in plain English

Published August 2026 · By the UltimateCRM team · Educational overview as of August 2026 — not legal, tax, or compliance advice. Confirm requirements with your compliance counsel.

Two rules, two audiences

Rule 204-2 under the Investment Advisers Act is the RIA rule — if you're a registered investment adviser, this is yours. Rule 17a-4 under the Exchange Act is the broker-dealer rule. Dual registrants and hybrid firms live under both, which is why the two are usually mentioned in the same breath. The philosophies are the same: if it documents your advice, your trades, or your money flows, it must be kept, and you must be able to produce it.

What counts as a record

For an RIA under 204-2, the list includes the things you'd expect — advisory agreements, trade records, financial ledgers, your ADV, compliance policies, the code of ethics — and one category that catches firms out: written communications. Any written communication you send or receive relating to recommendations or advice, receipt or disbursement of funds or securities, or the placing or execution of orders must be retained. Since the Marketing Rule, advertisements and endorsements join the list.

"Written" was drafted in a paper world. Today it means email, text messages, chat apps, social-media DMs — the medium doesn't matter, the content does. A trade instruction in a text message is a required record exactly as if it were a signed letter. (This is the entire basis of the off-channel enforcement wave — covered in its own guide.)

How long, and where

• RIAs (204-2): most records must be kept for five years from the end of the fiscal year in which the last entry was made, with the first two years in an easily accessible place. Corporate/organizational documents live longer — for the life of the firm plus three years.
• Broker-dealers (17a-4): ledgers and blotters run six years; communications generally three; and the rule adds specific requirements for electronic storage systems.
• "Easily accessible" is the operative phrase in an exam: if producing a record takes weeks of vendor tickets, you have a finding waiting to happen.

What form is acceptable

Electronic records are fully acceptable — the rules care about integrity and accessibility, not paper. For broker-dealers, the 2022 amendments to 17a-4 modernized the old WORM ("write once, read many") requirement: firms may instead use an audit-trail alternative — a system that preserves a complete, time-stamped history of every version of a record so the original can always be reconstructed. Either way, the practical bar is the same: records must be complete, accurate, indexed, protected from casual deletion, and promptly producible.

The practical translation

• Capture at the source, not by policy memo. A policy asking advisors to forward important emails is a finding generator. Systems that sync the mailbox, the phone system, and the calendar capture everything without relying on memory.
• Guard against deletion. Retention means nothing if a well-meaning cleanup can purge a protected record. Look for delete-guards on records inside their retention window.
• Keep versions. For governed documents (ADV, policies, client agreements), keep every version with its approval history — supersede, don't overwrite.
• Rehearse production. Once a quarter, pretend the examiner asked for "all communications with household X for the last 18 months" and time yourself.

How UltimateCRM maps to this

UltimateCRM was built with these rules as requirements, not as an afterthought: email, calendar, calls, texts, voicemail, and recordings are captured automatically into each contact's record and a firm-wide archive; records under SEC 17a-4 / 204-2 retention carry a delete-guard; the compliance document register keeps approve/retire/supersede version history; and everything is exportable when someone official asks. Details on the compliance features tour.