Text messages are books and records too

Published August 2026 · By the UltimateCRM team · Educational overview as of August 2026 — not legal, tax, or compliance advice. Confirm requirements with your compliance counsel.

The enforcement wave, briefly

Starting with a landmark action against a major bank in December 2021, the SEC (joined by the CFTC) has systematically swept the industry for off-channel communications — business conversations happening in personal texts, WhatsApp, and similar apps that were never captured into the firm's records. Penalties across the sweeps total well over $2 billion, and the actions moved down-market year by year: from bulge-bracket banks to mid-size broker-dealers to, more recently, investment advisers. The conduct being punished was rarely the content of the messages — it was that the records didn't exist.

What the rule actually says

Nothing in the rules bans texting. What Rules 204-2 and 17a-4 require is that written business communications — advice, recommendations, orders, money movement — be retained wherever they happen. A client's text saying "go ahead and sell the bond fund" is a required record. If it lives only on an advisor's personal phone, the firm has a books-and-records violation running quietly in its pocket.

The uncomfortable truth: clients text. They will keep texting, because it's how they communicate with everyone else in their lives. A policy that says "don't text clients" doesn't stop the texting — it just guarantees the records are missing when someone asks.

What compliant texting looks like

• A sanctioned channel. Give every advisor a business number on a firm-controlled system (for example, RingCentral) and make it the number clients actually have.
• Automatic capture. Messages archive because the system archives them — not because anyone remembers to screenshot or forward.
• Everything, not just matched contacts. Capture firm-wide, including numbers you haven't linked to a client yet. Examiners don't accept "we only kept the ones we recognized."
• A written policy plus attestation. Tell advisors which channels are approved, have them attest to it, and be able to show both.
• Supervision. A review process that samples or flags communications — kept as evidence that supervision actually happened.

How UltimateCRM handles it

UltimateCRM ingests RingCentral calls, SMS, MMS, voicemail, and recordings, read-only and firm-wide — every message is retained whether or not it matches a known contact, matched ones land on the client's timeline, and the rest sit in the firm-wide archive, searchable and exportable. Retention delete-guards keep protected records protected, and communications surveillance can flag messages into a review queue. Connecting it takes one firm-level authorization; the historical backfill typically recovers months-to-years of message history you may not know you still have.

Worth doing this quarter

• Ask five clients which number they text you on. If any answer is a personal cell, that's your gap.
• Pull one week of firm text history end-to-end. If you can't, you've just run a free mock exam and failed the cheap way.
• Put channel policy + capture + attestation on one page. It's a small project with a nine-figure industry price tag attached to skipping it.