Books and Records, and How Long They Are Kept

The recordkeeping rule is three requirements operating together. It specifies which books must be made and kept, how long they must be preserved, and where they must be held during that period. A firm can satisfy any two and fail the third, and the resulting finding is the same. The location requirement is the one most often overlooked, because it is counterintuitive in a business whose records are now almost entirely electronic.

What must be made and kept

The list is long and falls into recognizable groups. Financial records come first: journals, general and auxiliary ledgers, checkbooks, bank statements, canceled instruments, bills and statements, and trial balances and financial statements. Then trading records: a memorandum of each order given, showing the terms, the person who recommended it, the person who placed it, the account, and whether it was discretionary. Then account records: a list of all accounts over which the adviser has discretion, and the powers under which discretion is exercised.

Client-facing records follow. Written agreements with clients, communications received and sent relating to recommendations, receipt or delivery of funds or securities, and the placing or execution of orders. Copies of every brochure and supplement, with a record of the dates on which each was given or offered. Advertisements and communications distributed to ten or more persons, together with the materials supporting any performance figures they contain.

Finally the compliance records. The code of ethics, records of personal securities transactions by access persons, the written policies and procedures in effect at any time in the past five years, and the records documenting the required annual review. Proxy voting policies and records, custody-related records and, where applicable, the accountant's reports round out the list.

The clock and the location

The general rule is that all required books and records must be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made, the first two years in an appropriate office of the investment adviser. The clock runs from the last entry rather than from the creation of the record, so an account file that continues to receive entries continues to reset.

The two-year location requirement is a physical concept applied to an electronic world. Regulators have read it as satisfied where the records are accessible from the adviser's office and can be produced there promptly, rather than requiring a server on the premises. What is not satisfied is an arrangement in which retrieval requires days of vendor coordination, because the rule's underlying purpose is immediate availability to an examiner sitting in the office.

Some categories run longer. Organizational documents, including articles of incorporation, charters, minute books and stock certificate books, are maintained in the principal office and preserved until at least three years after the termination of the enterprise. Records supporting performance claims must permit the calculation to be reconstructed, which in practice means retaining the underlying account data for as long as the claim is in circulation.

Electronic storage and its conditions

Records may be maintained on electronic media, subject to conditions. The adviser must arrange and index the records so that they can be located, and must provide promptly a legible, true and complete copy of any record in the medium in which it is stored, together with a printout on request. The storage must be reasonably safeguarded from loss, alteration or destruction, and access must be limited to properly authorized personnel and the regulator.

Separate copies are required. The adviser must maintain a duplicate of the records stored electronically, held separately from the original for the required period. That condition is what a business continuity plan is generally built around, and it is also the condition most often satisfied in form and defeated in substance, when the duplicate sits in the same environment as the original.

Where recordkeeping actually fails

Three failure patterns account for most findings. The first is channel gaps: business communications conducted on personal devices, messaging applications or unmonitored email accounts that the firm's archive does not capture. The obligation attaches to the content, not the channel, and a firm that permits an uncaptured channel has created a gap it cannot fill retrospectively.

The second is derived data. A performance figure produced by a system that has since been replaced, or a fee calculation whose inputs are no longer retrievable, satisfies nobody. The rule requires records permitting reconstruction, so migrating systems without migrating the underlying data is a recordkeeping decision even when it is made for operational reasons.

The third is the annual review. The compliance rule requires a review no less frequently than annually of the adequacy of the policies and the effectiveness of their implementation. Firms conduct the review and frequently do not document it, and an undocumented review is treated as a review that did not occur. That evidentiary point is the one most likely to surface in the examination and what is requested.

Each of these failures is cheaper to prevent than to explain. A firm that maintains a current inventory of its record categories, the system each sits in, the retention applied and the person accountable for it can answer a request list quickly and can demonstrate that the retention decisions were made rather than inherited. Firms without such an inventory generally discover its absence at the least convenient moment.

The findings that follow appear in the deficiency letter and the response expected. Delivery records for the documents described in the disclosure brochure and its annual update fail in the same way, and the underlying obligations attach from the moment described in registering as an investment adviser.