Record retention sounds like a compliance checkbox — a matter of keeping files for the required number of years and moving on. In practice, FINRA and SEC record retention requirements are far more technically specific than most financial firms in Queens realize, and the IT infrastructure required to genuinely comply is more demanding than simply "saving documents to a server."
FINRA examinations regularly cite record retention violations — not because firms don't know they need to keep records, but because their IT systems don't actually meet the technical specifications the rules require. Understanding what the rules actually demand technically is the first step to genuine compliance.
What the Rules Actually Require
FINRA Rule 4511 incorporates the requirements of SEC Rule 17a-4, which specifies not just that records must be retained, but how. The key technical requirements include: records must be preserved in a non-rewriteable, non-erasable format (commonly called WORM storage); records must be immediately accessible for the first two years, and accessible within a reasonable time for the remainder of the retention period; and records must be capable of being reproduced on paper or in a reasonably usable electronic format on request.
The retention periods vary by record type. General ledgers and blotters must be kept for six years. Original order tickets must be kept for three years. Communications (emails, texts, chats) must be kept for three years, with the first two years in an easily accessible place. Customer account records must be kept for six years after the account is closed.
💡 The email problem: Business-related emails, including those sent from personal accounts, are generally records you must preserve. SEC enforcement actions against several broker-dealers and advisers for off-channel communications are a reminder that this applies to text messages and personal email too, not just your firm's official email system.
Which Rules Apply to Your Firm?
It depends on how your firm is registered. Broker-dealers and FINRA member firms follow FINRA Rule 4511 together with SEC Rules 17a-3 and 17a-4. Registered investment advisers follow SEC Rule 204-2 under the Investment Advisers Act, which generally requires books and records to be kept for five years from the end of the fiscal year in which the last entry was made, with the first two years in an appropriate office of the adviser. Firms that are both (dual registrants) have to meet both sets of rules.
If you are not sure which applies to you, your chief compliance officer or counsel can confirm. This article is general information, not legal advice.
How Long Do You Keep Email and Text Messages?
For broker-dealers, FINRA explains in Regulatory Notice 11-39 that SEC Rule 17a-4(b)(4) requires communications relating to the firm's business to be kept for three years, the first two in an easily accessible place. What matters is the content of the message, not the device or app it was sent on, so business texts, chats, and personal-account email about firm business count. FINRA Rule 4511's six-year default applies only to records for which no other period is specified (see Regulatory Notice 11-19).
Investment advisers keep written communications relating to their advice and recommendations under Rule 204-2, generally for five years. The SEC has brought enforcement actions against several broker-dealers and advisers whose staff used personal messaging apps that the firm's archive did not capture. In practice, the real question is less "how long?" and more "can we capture it and produce it when asked?"
WORM Storage: What It Is and Why It Matters
WORM stands for Write Once, Read Many — a storage format where data, once written, cannot be altered or deleted before the end of the required retention period. This requirement exists specifically to prevent firms from modifying records after the fact during an examination or litigation.
Not all backup or archiving solutions are WORM-compliant. A standard backup drive, a shared folder on a file server, even most cloud storage platforms do not meet the non-rewriteable, non-erasable standard by default. Meeting this requirement requires either WORM-certified hardware storage or a cloud archiving solution that has been specifically certified for SEC Rule 17a-4 compliance — and you should have documentation from your vendor confirming that certification.
Email Archiving: The Most Common Gap
Email is the most common area where Queens financial firms have record retention gaps. A Microsoft 365 mailbox is not, by itself, a compliant email archive. Emails can be deleted from a mailbox. Retention policies can be changed. The mailbox is not WORM-compliant by default.
A compliant email archiving solution captures all inbound and outbound emails in real time, stores them in an immutable format that cannot be altered or deleted before the retention period expires, and provides search and retrieval capabilities that allow you to produce records on request. Microsoft 365 Compliance Center with appropriate litigation hold settings, or third-party archiving platforms like Smarsh or Global Relay, can meet this standard when properly configured.
Financial Firm Record Retention IT Checklist
- WORM-compliant storage or certified cloud archiving solution in place for all required records
- Email archiving capturing 100% of firm email in immutable format — including all associated accounts
- Social media and electronic communication archiving if those channels are used for business communications
- Mobile device policy addressing texting and off-channel communications
- Documented retention schedules specifying retention periods by record type
- Tested restoration process — you can actually retrieve and produce records when needed
- Annual review of retention policies against current FINRA/SEC requirements
Frequently Asked Questions
How long must a broker-dealer keep emails?
Communications relating to the firm's business must generally be kept for three years, the first two years in an easily accessible place (SEC Rule 17a-4(b)(4); see FINRA Regulatory Notice 11-39). Records with no other specified period fall under FINRA Rule 4511's six-year default. Confirm the current rule text for your registration.
Do investment advisers follow the same rules?
No. Registered investment advisers follow SEC Rule 204-2, which generally requires books and records to be kept for five years from the end of the fiscal year of the last entry, with the first two years in an appropriate office of the adviser. Firms registered as both broker-dealers and advisers have to meet both sets of rules.
Is a standard Microsoft 365 mailbox a compliant email archive?
Not by itself. Retention and hold settings can be part of a compliant setup, but firms usually need an archive that captures messages in a form that cannot be altered and lets them search and produce records on request. Your compliance officer should confirm the design.
Are text messages on personal phones covered?
If they relate to firm business, generally yes. FINRA has said that content, not the device, determines whether a communication is a record (Regulatory Notice 11-39). Firms typically restrict business communication to approved channels that can be captured, and prohibit or block the rest.
Sources and Rule Text
- FINRA Regulatory Notice 11-19 (Rule 4511 and the six-year default)
- FINRA Regulatory Notice 11-39 (communications and social media records)
- 17 CFR 240.17a-4 (broker-dealer record retention)
- 17 CFR 275.204-2 (investment adviser books and records)
Rules change, so confirm the current text for your firm. This article is general information, not legal advice. Last reviewed October 16, 2026.