# Investment Advisers Act Rule 204-2 | Comma Compliance

Rule 204-2 requires SEC-registered investment advisers to retain all business communications — including WhatsApp and iMessage. What RIAs need to know.

Source: https://commacompliance.com/regulations/investment-advisers-act-rule-204-2
Last updated: 2026-07-06

---
Investment Advisers Act Rule 204-2 (the books and records rule for SEC-registered investment advisers) requires RIAs to retain all written communications relating to investment advice, securities recommendations, and client accounts. SEC enforcement actions since 2023 have made clear that investment advisers are expected to preserve business-related electronic communications regardless of channel — including WhatsApp, iMessage, and Signal when used for client or advisory communications.

## **At a Glance**

| Investment Advisers Act Rule 204-2 | Information |
| ---------------------------------- | ----------- |
| Issued by | U.S. Securities and Exchange Commission |
| Under | Investment Advisers Act of 1940 |
| Who it applies to | SEC-registered investment advisers (RIAs) |
| Storage standard | Indexed for retrieval, duplicate copy at a separate facility, procedures to safeguard against loss, alteration, or destruction — no WORM requirement |
| Retention period | 5 years; first 2 years in an easily accessible location |
| Covers mobile messaging? | Yes — WhatsApp, iMessage, Signal if used for client or advisory communications |
| Enforcement | Ongoing SEC sweeps targeting RIA off-channel messaging; fines issued 2023–present |

## What Regulators Expect

In a Rule 204-2 examination, SEC examiners will ask:

The RIA examination has historically focused on email and investment records. That scope has expanded. Since 2023, the SEC has examined RIAs specifically for mobile messaging, applying the same logic as the broker-dealer sweeps: if employees use WhatsApp to discuss investment decisions or communicate with clients, those messages are business records subject to Rule 204-2, regardless of what device they're sent from.

## Why RIAs Underestimate This Requirement

Most RIAs acknowledge that Rule 204-2 covers electronic communications but treat it as an email compliance issue. Two assumptions drive that misread.

**"Mobile messaging is a broker-dealer problem."** The SEC's 2021–2023 off-channel enforcement actions targeted broker-dealers, and the $2 billion+ in fines were assessed under Rules 17a-4 and 17a-3. Subsequent SEC enforcement actions have shown that investment advisers are expected to preserve business-related electronic communications under Rule 204-2. RIAs that watched the broker-dealer sweeps and concluded they weren't affected missed the trajectory.

**"We have a mobile device policy."** A policy prohibiting WhatsApp does not satisfy Rule 204-2. If employees use a prohibited channel anyway, and examiners find evidence they did, the absence of an archive is itself the violation. Regulators have cited firms specifically because employees used unauthorized channels and the firm had nothing captured.

## What a Compliant Archive Must Include

Although Rule 204-2 differs from Rule 17a-4 in several important respects, advisers still need systems capable of preserving communications promptly, protecting them against loss or alteration, and producing them without undue delay during examinations.

Rule 204-2(g) requires advisers maintaining electronic records to index them for prompt retrieval, maintain duplicate copies at a separate location, and implement procedures designed to protect records from loss, alteration, or destruction. Unlike Rule 17a-4, the SEC explicitly declined to impose a WORM format requirement on investment advisers when it considered the question in 2001. The standard is less prescriptive on storage technology, but the obligation to preserve and produce records promptly is real.