Rule 204-2 Applies to WhatsApp and iMessage. Many RIAs Overlook This.

Investment Advisers Act Rule 204-2 (the books and records rule for SEC-registered investment advisers) requires RIAs to retain all written communications relating to investment advice, securities recommendations, and client accounts. SEC enforcement actions since 2023 have made clear that investment advisers are expected to preserve business-related electronic communications regardless of channel — including WhatsApp, iMessage, and Signal when used for client or advisory communications.

At a Glance

What Regulators Expect

In a Rule 204-2 examination, SEC examiners will ask:

The RIA examination has historically focused on email and investment records. That scope has expanded. Since 2023, the SEC has examined RIAs specifically for mobile messaging, applying the same logic as the broker-dealer sweeps: if employees use WhatsApp to discuss investment decisions or communicate with clients, those messages are business records subject to Rule 204-2, regardless of what device they’re sent from.

Why RIAs Underestimate This Requirement

Most RIAs acknowledge that Rule 204-2 covers electronic communications but treat it as an email compliance issue. Two assumptions drive that misread.

“Mobile messaging is a broker-dealer problem.” The SEC’s 2021–2023 off-channel enforcement actions targeted broker-dealers, and the $2 billion+ in fines were assessed under Rules 17a-4 and 17a-3. Subsequent SEC enforcement actions have shown that investment advisers are expected to preserve business-related electronic communications under Rule 204-2. RIAs that watched the broker-dealer sweeps and concluded they weren’t affected missed the trajectory.

“We have a mobile device policy.” A policy prohibiting WhatsApp does not satisfy Rule 204-2. If employees use a prohibited channel anyway, and examiners find evidence they did, the absence of an archive is itself the violation. Regulators have cited firms specifically because employees used unauthorized channels and the firm had nothing captured.

What a Compliant Archive Must Include

Although Rule 204-2 differs from Rule 17a-4 in several important respects, advisers still need systems capable of preserving communications promptly, protecting them against loss or alteration, and producing them without undue delay during examinations.

Rule 204-2(g) requires advisers maintaining electronic records to index them for prompt retrieval, maintain duplicate copies at a separate location, and implement procedures designed to protect records from loss, alteration, or destruction. Unlike Rule 17a-4, the SEC explicitly declined to impose a WORM format requirement on investment advisers when it considered the question in 2001. The standard is less prescriptive on storage technology, but the obligation to preserve and produce records promptly is real.

Safeguards against loss, alteration, or destruction. Rule 204-2(g) requires indexed records, a duplicate copy at a separate facility, and documented procedures protecting against loss or alteration. There is no WORM mandate for investment advisers. The obligation is to have records that are protected, findable, and producible.

Prompt retrieval. Rule 204-2 requires records in an easily accessible location for the first two years. Examiners expect production without undue delay. An archive that requires a support ticket or vendor assistance does not meet that standard in practice.

Coverage of advisory communications specifically. Rule 204-2 is broader than recordkeeping for securities transactions. It covers written communications relating to investment advice, research, client accounts, and performance. If an investment professional discusses a portfolio decision over WhatsApp, that conversation is covered.

Written policies and procedures. Examiners ask to see your electronic communications policy alongside your archive. The policy should cover which channels are permitted, how they are captured, and what happens if an employee uses an unauthorized channel.

How Comma Compliance Addresses Rule 204-2

Rule 204-2 requires that records be preserved promptly, protected against loss or alteration, and produced without undue delay. Comma is built to satisfy those obligations from the ground up.

iMessage: Archived as messages are delivered, independent of iCloud backup timing, device settings, or employee behavior. Runs on the employee’s existing iPhone, with no separate compliance device required.

WhatsApp: Captured via open-source connector code, published under Apache 2.0 so security teams can independently review the capture logic. The architecture is fully auditable by your CISO or outside counsel.

Signal: Archived without compromising Signal’s encryption model. Comma works with Signal’s architecture, not around it.

Indexed, retrievable, protected: Comma stores all captured messages in indexed, tamper-resistant storage with a separate backup copy, meeting the 204-2(g) standard without requiring a WORM format. Default retention is seven years, exceeding the five-year requirement. Records are retrievable directly from the Comma platform without submitting a support request.

Single platform for dual registrants: If your firm operates as both a broker-dealer and a registered investment adviser, Comma covers both obligations from a single archive. The same capture, the same retention, the same production workflow, regardless of which rulebook applies to a given conversation.