SEC Rule 204-2 sets out the books and records requirements every SEC-registered investment adviser must follow: firms have to create and preserve financial ledgers, client communications and agreements, marketing and performance backup, a code of ethics with personal trading reports, political contribution logs, and business messages sent on any channel — usually for five years, with the first two years in an easily accessible location. The rule is codified at 17 CFR § 275.204-2 and gives SEC examiners the paper trail they use to test whether an adviser is handling client money honestly.
Who the Rule Applies To
Rule 204-2 covers every investment adviser registered with the SEC or required to register under Section 203 of the Investment Advisers Act of 1940. In practice, firms managing $110 million or more in client assets are required to register federally and fall squarely under the rule. Firms with between $100 million and $110 million in assets under management may register with the SEC but are not required to. Below $100 million, advisers generally register with a state securities regulator instead, though many states impose recordkeeping rules that closely mirror the federal ones.
The obligations apply uniformly whether the firm advises retail clients, pension funds, or institutions. Some categories of advisers, such as those advising only venture capital funds or qualifying as exempt reporting advisers, may not need to register — but a firm that does register cannot pick and choose which parts of Rule 204-2 to follow.
Financial and Accounting Records
The accounting requirements are the backbone of the rule. Advisers must maintain journals of all cash receipts and disbursements, and general and auxiliary ledgers reflecting every asset, liability, reserve, capital, income, and expense account tied to the advisory business.
Supporting documentation reaches well beyond the ledgers. Firms must preserve checkbooks, bank statements, canceled checks, and cash reconciliations, along with trial balances, financial statements, and internal audit working papers. Bills and statements paid or received in connection with the advisory business complete the file. Together, these records let examiners trace every dollar through the firm and identify discrepancies that might signal commingling or misappropriation of client funds.
Client Communications, Agreements, and Trading Authority
The rule requires originals of all written communications received and copies of all written communications sent that relate to investment recommendations, the delivery of funds or securities, or the placement of orders. Written communications include email, and as discussed below, the SEC treats text messages and chat app conversations the same way.
Every written client agreement must be kept, whether an advisory contract, financial planning engagement letter, or any other document governing the relationship. The firm also has to document the scope of its authority over each account by retaining powers of attorney, discretionary trading authorizations, and a current list of every account in which the firm holds discretion over client funds or securities. These records define the boundaries of what the adviser is authorized to do, and examiners typically ask for them first.
Marketing Materials and Performance Backup
Any advertisement, newsletter, or other communication distributed to ten or more people must be retained. When the firm sends such materials to a mailing list, it also has to keep a memo describing the list and its source.
Firms that use client testimonials or endorsements in marketing must retain a record of all disclosures provided to clients or investors in connection with compensated testimonials and endorsements. If a firm includes a third-party rating in an advertisement, it has to retain a copy of any questionnaire or survey used to produce that rating, assuming the firm obtained a copy. Advisers that advertise performance results must keep the records needed to demonstrate how those results were calculated, including records related to predecessor performance. A firm cannot advertise a track record it cannot reconstruct from its own files.
Code of Ethics and Personal Trading Reports
Every SEC-registered adviser must adopt a written code of ethics under Rule 204A-1 and keep a copy of every version that has been in effect during the past five years. When a violation occurs, the firm must document both the violation and any disciplinary action taken in response.
“Access persons” — employees who have access to nonpublic information about client trades or portfolio holdings — must regularly report their own personal securities transactions, and the firm has to collect and retain those reports. If an access person is front-running client trades or trading on inside knowledge, the personal trading reports create a trail examiners can follow. Firms must also keep copies of their current Form ADV and all amendments.
Political Contribution Records
The SEC’s pay-to-play rule, Rule 206(4)-5, bars an adviser from providing advisory services to a government entity for two years after the firm or a covered associate makes a political contribution to an official of that entity. To enforce this, advisers must maintain records of every political contribution made by the firm and its covered associates, including the date, amount, and recipient.
Off-Channel Business Communications
The largest recordkeeping enforcement trend in recent years involves off-channel communications: business conversations conducted over personal text messages, WhatsApp, Signal, WeChat, or similar platforms that the firm’s compliance systems do not capture. The SEC’s position is that if a communication relates to advisory business, it must be retained regardless of what device or app was used. A recommendation sent over iMessage is subject to the same preservation requirement as one sent through the firm’s official email system.
Between late 2021 and early 2025, the SEC and CFTC charged over 100 firms and imposed more than $3 billion in combined penalties for off-channel communication failures. In 2026, FINRA barred an individual from the securities industry entirely for off-channel messaging violations.
A policy telling employees not to text clients is not enough. The SEC expects written supervisory procedures covering every communication channel employees might use, documented evidence of regular review, and actual archiving capability. An adviser cannot review or produce records it never captured, and an inability to produce records promptly during an examination is itself a regulatory violation, even where the underlying communications were appropriate.
Custody-Related Records
Advisers deemed to have custody of client assets face additional documentation under Rule 206(4)-2. Custody triggers a requirement for an annual surprise examination by an independent public accountant, who must verify that client funds and securities actually exist and are properly accounted for. The accountant files Form ADV-E with the SEC confirming the examination took place. Firms managing pooled investment vehicles can satisfy this requirement through an annual fund-level audit by a PCAOB-registered auditor, provided audited financial statements reach investors within 120 days of the fund’s fiscal year-end. All records related to these examinations and audits are part of the firm’s books and records.
Employment Agreements and Whistleblower Language
Under Rule 21F-17 of the Securities Exchange Act, no person may take any action to prevent an individual from communicating directly with the SEC about a potential securities law violation. The SEC has brought enforcement actions against firms whose confidentiality or separation agreements contained language that could discourage employees from reporting misconduct, even where the firm never tried to enforce those provisions. Advisers should review and retain copies of all employment agreements, confidentiality policies, and separation agreements to confirm they carve out SEC communications. A restrictive clause buried in a template signed years ago can become an enforcement problem if the SEC finds it during an exam.
How Long Records Must Be Kept
Most records under Rule 204-2 must be kept for at least five years from the end of the fiscal year in which they were created. During the first two years, they must be stored in an easily accessible location, which typically means the firm’s principal office or a readily available electronic system. After that, records can be moved to less immediate storage but must remain retrievable.
Some categories carry different periods. Partnership articles and related amendments must be kept for at least three years after the firm stops using them. Code of ethics records must be retained for five years after the code was last in effect. Performance advertising records need to be kept long enough to support any performance claims the firm is currently making, which can mean retaining them well beyond five years if the firm advertises long-term track records.
Electronic Storage
Advisers may store all required records on electronic media, subject to specific conditions. The firm must arrange and index records so that any particular document can be located and retrieved quickly. It must be able to produce a legible, complete copy in whatever format the SEC requests, whether native digital format, a printout, or on-screen access during an exam.
The current version of Rule 204-2(g) does not mandate a specific storage technology. Instead, the firm must establish and maintain procedures that reasonably safeguard records from loss, alteration, or destruction, limit access to authorized personnel and the SEC, and ensure that electronic copies of non-electronic originals are complete and legible. The emphasis is on demonstrable safeguards rather than any particular hardware or software.
Duplicate Copy Requirement
Regardless of the storage medium, the firm must separately store a duplicate copy of every record for the full retention period. This backup must be on a medium permitted by the rule and stored apart from the originals, so a fire, flood, or system failure that destroys the primary copies does not leave the firm unable to produce its records.
What Happens When Records Are Missing
The SEC’s examination staff uses Rule 204-2 records as its primary tool for evaluating whether an adviser is meeting its fiduciary obligations. When examiners find gaps, the most common outcome is a deficiency letter identifying the shortcoming and requiring corrective action. A deficiency letter is not a fine, but repeated deficiencies in the same area can escalate into formal enforcement.
Penalties vary with severity and intent. The SEC can impose monetary fines, censure the firm, suspend or revoke its registration, or refer the matter for criminal prosecution in cases involving deliberate destruction of records. The off-channel communications sweep illustrates the upper end of the range, with individual firm penalties reaching into the tens of millions of dollars. Even without a formal action, a firm that cannot produce requested records during an examination faces immediate credibility problems; examiners tend to assume the worst when documentation is missing.