Key takeaways

  • Broker-dealers must preserve business-related communications, including email, under SEC Rule 17a-4, and FINRA Rule 4511 ties FINRA members to the same standard.
  • Registered investment advisers have their own books-and-records rule, Rule 204-2 under the Advisers Act, with a five-year retention period for many records.
  • Since the 2022 amendments, an electronic archive can meet the standard either with write-once storage or with a complete audit trail that lets you recreate the original record.
  • Mailbox retention settings are not an archive. A regulator-ready archive is searchable, protected from edits and tested.
  • The regulator, not the vendor, judges compliance. Confirm your design with your compliance officer or counsel.

Start with the answer: if you are a broker-dealer or a registered investment adviser, business email is a record you must keep, keep unaltered, and be able to produce quickly. A normal mailbox does not do that on its own. People delete messages, administrators change retention, and a mailbox migration can drop items. An archive built for the rules solves this by capturing a copy of each message as it arrives or leaves, protecting that copy from change, and making it searchable for the whole retention period.

Which rules apply

  • SEC Rule 17a-4 (Securities Exchange Act): sets how broker-dealers preserve the records Rule 17a-3 requires, and also communications relating to their business. It covers the retention period, the storage format, indexing and the ability to produce records on request.
  • FINRA Rule 4511: requires FINRA members to make and preserve books and records as the FINRA rules and the Exchange Act rules require, and to keep them in a format that meets Rule 17a-4. Where no period is set, FINRA's rule defaults to six years.
  • Advisers Act Rule 204-2: the books-and-records rule for registered investment advisers. It lists the records to keep, including written communications about advice, orders and recommendations, and sets a general five-year period, with the first two years in the office.
  • State rules and your own written policies can add requirements. A bank affiliate, a dual registrant or a firm in several states often has more than one set to satisfy.

What 'tamper-proof' means after the 2022 amendments

For years, Rule 17a-4 was known for the WORM requirement: write once, read many, meaning records stored so they cannot be rewritten or erased. In 2022 the SEC amended the rule so a firm can also meet the standard with an electronic recordkeeping system that keeps a complete, time-stamped audit trail of every change, so the original record can always be recreated. Either route has to give you the same result: a record that was not quietly altered. The amended rule also changed the old third-party undertaking process: a firm names a designated executive officer or a designated third party who can access and produce the records. Read the current text with your counsel, because the details matter.

What a regulator will want to see

  • Completeness: every message in scope is captured, including mail sent from phones, shared mailboxes and any distribution lists. Journaling at the mail platform, rather than copying users' mailboxes later, is the usual way.
  • Immutability or audit trail: stored copies cannot be changed or deleted before the retention period ends, even by an administrator.
  • Retention: the right period for each record type, then controlled disposal, with legal holds that suspend deletion.
  • Searchability: you can find messages by sender, recipient, date and content, and export them in a usable form without long delays.
  • Duplicate or backup copy: a second copy stored separately, so a failure at one place does not lose the record.
  • Supervision: archived email feeds the review programme that your policies describe. Keeping messages you never review is a different gap.

Common ways firms fall short

The first is leaning on the mail platform. Retention policies in a cloud mailbox are useful, but an administrator can generally change them, and they were designed for productivity, not for a regulator. The second is a partial capture, such as archiving the main domain but not a subsidiary, a shared inbox or an old acquired domain. The third is a migration: moving from one mail system to another is when messages vanish. The fourth is staff using other channels. Text messages and chat apps are a separate recordkeeping problem, which we cover in our article on off-channel communications. An email archive helps only with email.

How to choose and check an archive

Ask five questions. Where is the data stored, and can you name the storage mode that makes it unalterable? Can the vendor show an audit log of access and changes? How long does a search across several years take, and who can run it? What happens to your records if you leave the vendor, and in what format do they come back? And who is the designated person or third party the regulator can ask? Then test it: run a sample request as if an examiner had asked for all messages between two people over a quarter, and time it. Write down the result. Do the test again after any change in mail platform.

Policies around the technology

The system is only half the answer. Your written supervisory procedures should say what is archived, for how long, who may search it, how legal holds work, and how exceptions are handled. Staff should know that business must be done on approved channels. Train them once a year and when they join. Review access to the archive itself, because a person who can search every message has a sensitive role.

A short checklist

Name the rules that apply to your registration. Capture mail at the platform through journaling. Store it unalterable or with a full audit trail. Keep the right retention for each record type, with legal holds. Test search and export on a schedule. Document the designated person or third party. Cover other channels in policy. Our team designs and operates email archiving and continuity for regulated firms. Start with our Email Security, Archiving and Continuity service.

Sources

This article is general information, not legal or compliance advice. Rules and enforcement priorities change; confirm what applies to your firm with qualified counsel and your regulator's current guidance. Last reviewed .

Keep reading

Need help with this?

Filter threats out of mail, keep every message in an immutable archive you can search, and keep email working when the mail platform goes down.

Email Security, Archiving & Continuity