Investment adviser recordkeeping requirements, applied to research

The investment adviser recordkeeping requirements live mainly in SEC Rule 204-2 under the Advisers Act: a registered adviser must keep a defined list of books and records, true, accurate and current, for at least five years from the end of the fiscal year in which the last entry was made, the first two years in an appropriate office, and, if they are electronic, arranged so any one of them can be found and handed to an examiner promptly. For a research team the hard part is not the rule but the material: reasoning spread across memos, inboxes, chat, Excel models revised weekly and expert-call transcripts in three systems. Botminds' Research Management System exists for that problem. It files each item to the name and thesis version it supported, keeps it under a retention class, and produces it, with its versions and access history, when an examiner asks.

The rule text quoted here is the eCFR's, current to October 23, 2026. The worked examples come from the solution's fictional sample firm, Quillfield Capital, a global asset manager; nothing on this page is legal advice.

What records must an investment adviser keep?

Rule 204-2(a) lists the books and records every SEC-registered adviser must "make and keep true, accurate and current": some twenty categories, from journals and ledgers to client agreements, advertisements, code of ethics reports, proxy votes and, since the 2024 Regulation S-P amendments, incident-response documentation under paragraph (a)(25). Paragraphs (b) and (c) add records for advisers with custody and for those who manage portfolios or vote proxies. The list is specific on purpose: the rule tells an adviser what it must be able to show, not how to run its business.

Most of the list belongs to operations and finance. Four paragraphs reach the research desk directly. Paragraph (a)(7)(i) covers written communications received and sent that relate to any recommendation made or proposed and any advice given or proposed. Paragraph (a)(3) requires a memorandum of each order that identifies the person who recommended the transaction and the person who placed it. Paragraph (a)(16) keeps the internal working papers needed to demonstrate any performance figure the adviser publishes. And paragraphs (a)(12) and (a)(13) keep the code of ethics, its violations, the names of access persons, their reports, and every pre-approval decision "and the reasons supporting the decision".

Is investment research a book and record?

Partly, and the part that is not is where firms get into trouble. Rule 204-2 never uses the word research. What it captures is communication: a memo that recommends a rating change to a portfolio manager, the email that sends a model to the committee, the broker report and the expert-call transcript received and relied on are all written communications relating to a recommendation or to advice proposed. The SEC's examination staff read paragraph (a)(7) this way in its December 14, 2018 risk alert on electronic messaging, which applied it to texts, instant messages and personal email used for business, whatever the device.

What the rule does not name is the analyst's own working material that never leaves the desk: notebook pages, scratch models, a draft thesis no one else saw. Those become required records when they are sent, or when they form the basis of a published performance figure. Until then they are kept, or not, under firm policy. Most firms keep them anyway, for three reasons a compliance officer can defend: the code of ethics and Section 204A policies are tested on whether the firm can show where an idea came from; the CFA Institute's Standard V(C) asks members to retain records that substantiate "the scope of their research and reasons for their actions or conclusions"; and a portfolio manager asking why the firm cut a stock needs the reasoning, not only the email that announced it.

The CFA Institute also closes a gap the rule leaves open. Its Standard V(C) applies the retention duty not only to decisions to buy or sell but also to reviews that end with the position unchanged (CFA Institute, Standard V(C)). A quarterly review that keeps a Hold is a decision too, and the file should show it. Model versions are the other gap: a workbook saved over itself has kept no record of what the model said when the rating changed, which is why the firm's own model deserves version control and a diff for every published change.

How long must an RIA keep records?

At least five years from the end of the fiscal year in which the last entry was made on the record, with the first two years in an appropriate office of the adviser, under Rule 204-2(e)(1). Three details change the arithmetic. The clock starts at the end of the fiscal year, not on the date of the document. It starts from the last entry, so a living file, such as a list of access persons or a thesis that keeps gaining versions, restarts its clock each time it changes. And several categories carry their own clocks.

Advertisements and performance working papers under (a)(11) and (a)(16) run five years from the end of the fiscal year in which the adviser last disseminated the communication, under (e)(3). Pre-approval decisions for access persons run "at least five years after the end of the fiscal year in which the approval is granted". Partnership articles, charters and minute books stay in the principal office until three years after the business ends, under (e)(2). And an adviser that winds down must still arrange for the records to be preserved for the rest of their period and tell the SEC where they are, under paragraph (f).

Firms rarely run several clocks for research. They set one class, longer than the longest rule that touches it, and keep the rule-by-rule reasoning in the retention schedule. The sample firm in this guide keeps research records seven years and its audit trail ten. A record under a legal hold stops its clock altogether.

Can records be kept electronically?

Yes. Rule 204-2(g) allows any records under the rule to be kept on micrographic or electronic storage media, including "any digital storage medium or system that meets the terms of this section". The terms are short and practical. The adviser must arrange and index the records so that any particular one can be located, accessed and retrieved easily; keep a separate duplicate copy for the full retention period; and, for electronic records, maintain procedures that safeguard them from loss, alteration or destruction, limit access to authorised personnel and the Commission, and ensure that any scan of a paper original is complete, true and legible.

The investment adviser must provide promptly any of the following that the Commission (by its examiners or other representatives) may request: a legible, true, and complete copy of the record in the medium and format in which it is stored.

Rule 204-2(g)(2)(ii), 17 CFR 275.204-2

The production duty is where research archives fail. An adviser can keep every email and still be unable to produce, quickly, "all research supporting the May 2025 decision", because the notes sit in a notebook application, the models on a shared drive, the transcripts with three expert-network vendors and the chat in an archive indexed by sender. The rule asks for indexing that lets the firm find a particular record; a research archive indexed only by date and author meets the letter of that and fails the examiner's real question. What an examiner asks for, and how quickly, is set out in the guide to the SEC exam request list.

Advisers are not bound by the broker-dealer rule, but it is the benchmark many records teams use. Since the SEC's amendments of October 12, 2022, Rule 17a-4(f) lets a broker-dealer keep electronic records either in a non-rewriteable, non-erasable format or with a complete time-stamped audit trail of every modification and deletion that permits the original to be re-created (SEC press release 2022-187). Rule 204-2(h) also lets an adviser rely on records kept under 17a-4 if they are substantially the same.

The records the compliance rule and the code of ethics add

Two other Advisers Act rules generate records that a research team creates every day without thinking of them as records. The compliance rule, Rule 206(4)-7, requires written policies and procedures and a review of their adequacy "no less frequently than annually" (17 CFR 275.206(4)-7), and Rule 204-2(a)(17) keeps both the policies in effect over the past five years and the records documenting each annual review. When the SEC adopted the compliance rule in 2003, it listed the issues an adviser's policies should address at a minimum, including "the accurate creation of required records and their maintenance in a manner that secures them from unauthorized alteration or use and protects them from untimely destruction" (Release IA-2204, 68 FR 74714).

The code of ethics rule, Rule 204A-1, makes analysts access persons when they are involved in making securities recommendations or have access to recommendations that are nonpublic (17 CFR 275.204A-1(e)(1)). That brings their holdings and transaction reports, their pre-clearances and any violation into the books and records. For a research team the practical consequence is that the expert-call log, the restricted list and the record of who could read which note are not housekeeping: they are the evidence that the firm's Section 204A policies work, which is the subject of the expert network compliance guide.

What the CFA Institute recommends, and why firms pick seven years

The CFA Institute's default is seven years: where neither a regulator nor the firm sets a period, its Standard V(C) recommends keeping records for at least that long. Meeting a regulator's or the firm's own period satisfies the standard. The standard is broader than the SEC rule in what it covers. Its examples of supporting records include notes from meetings with the covered company, the company's press releases and presentations, model outputs and model input parameters, risk analyses, notes from client meetings and outside research reports, and it names emails, text messages, blog posts and social media posts as formats that must be kept.

Seven years is common in firm policy for a practical reason, not a legal one. It covers the SEC's five years with room for a late examination, and it matches the CFA Institute's default, so one class can serve a firm with analysts who hold the charter. The standard also puts the duty where the files are: it says the responsibility to keep records that support investment action "generally rests with the firm rather than individuals", and that a member must not use historical recommendations from a previous firm "if the supporting documentation is unavailable" (CFA Institute, Standard V(C)). An analyst's reasoning, in other words, is the firm's to keep and the analyst's to leave behind.

The UK five-or-seven rule, and what it covers

The UK rule most often quoted for "five years, seven if the regulator asks" is about recorded communications, not research files. FCA rule SYSC 10A.1.14 requires that recordings of telephone conversations and electronic communications kept under that chapter be "kept for a period of five years and, where requested by the FCA, for a period of up to seven years", and the handbook notes that it implements article 16(7) of MiFID (FCA Handbook, SYSC 10A.1). The chapter applies to communications relating to transactions and to client orders.

A UK or EU research team therefore runs two clocks: the recorded-communications rule for calls and chats with brokers and clients about orders, and the firm's general record-keeping duties for the rest of its research. Neither replaces Rule 204-2 for an adviser registered with the SEC, and a global manager usually sets one research class long enough to satisfy all three.

Why missing records cost more than kept ones

The price of a record the firm should have kept is set by the regulator, not by the storage bill. Between December 2021 and early fiscal 2025 the SEC settled recordkeeping cases over business conducted on personal devices and messaging apps that the firms had not kept; the Commission's own fiscal 2025 results put the total at 95 actions and $2.3 billion in penalties. The current Commission calls those cases a misallocation of resources, but it has not changed Rule 204-2, and paragraph (a)(7) still reaches a rating discussed on a phone. What the off-channel sweeps cost, firm by firm, is set out in its own guide.

Missing research records cost in a quieter way too. When an examiner asks why a rating changed and the firm cannot show the expert call behind it, the question becomes whether the call was logged and reviewed at all, which is one of the Section 204A deficiencies the SEC's examination staff listed in its April 2022 risk alert.

How Research Management System sorts research into retention classes

Research Management System treats every captured item, from a memo to a model version to an expert-call transcript, as a record from the moment it arrives, so the research archive and the books and records are the same store. Its Records Keeper applies retention classes, legal holds and data residency, proposes disposal batches for two people to approve, and never deletes anything itself. On the sample firm it holds 538,214 items, two active legal holds covering 4,624 of them, and 12,488 items proposed for disposal and waiting for the records manager and the chief compliance officer.

Research Management System: retention classes for research, with the reason each is kept

Each item also carries its own retention line, so the rule is visible on the record rather than buried in a schedule. The model version behind the sample firm's cut of Tessaro Health to Hold, saved on May 13, 2025, shows its class, its end date of December 31, 2032, the legal hold that currently freezes it, the immutable copy and its hash, and who may read it.

One model version, with its retention date, legal hold and readers

Questions people ask

What is Rule 204-2?

Rule 204-2 is the SEC's books and records rule for investment advisers, 17 CFR 275.204-2, adopted under section 204 of the Advisers Act. It lists the records a registered adviser must make and keep, sets how long and where they are kept, and sets conditions for keeping them electronically. Examiners use it as the starting point of almost every request.

Do investment advisers have to keep text messages?

When the messages relate to a recommendation, advice, an order or the other subjects in paragraph (a)(7), yes, whatever the device or app. The SEC's examination staff said so in a December 2018 risk alert, and many of the off-channel settlements since 2021 charged advisers under Rule 204-2 for business texts that were not kept.

Where must the first two years of records be kept?

In "an appropriate office of the investment adviser", under Rule 204-2(e)(1); the remaining three years in "an easily accessible place". The rule does not define either phrase further. Electronic records that staff in the office can retrieve promptly are how most advisers meet both today.

How long must an RIA keep emails?

Emails that are required records, such as those relating to recommendations, advice or orders, follow Rule 204-2(e)(1): at least five years from the end of the fiscal year in which they were sent or received, the first two in an appropriate office. Emails outside the listed categories follow firm policy, and many firms keep all business email for the same period because sorting them costs more than storing them.

Does a state-registered adviser follow Rule 204-2?

Rule 204-2 applies to advisers registered or required to be registered with the SEC. State-registered advisers follow their state's books-and-records rule, which in many states mirrors the SEC rule closely, and an adviser that moves from state to SEC registration must keep the records the state required, under Rule 204-2(k).

What does the CFA Institute recommend for record retention?

At least seven years, where no regulation or firm policy sets a period, under Standard V(C). The standard also says records created for an employer are the firm's property and that the firm, more than the individual, carries the duty to keep them.