Salesforce Recordkeeping Compliance for RIAs

In most RIAs, Salesforce creates records and a separate archive holds them. Email and messages sent from Salesforce (and from marketing tools connected to it) are captured into an approved archive such as Smarsh or Global Relay, delete rights are removed from most users, field changes are tracked with field history or Shield Field Audit Trail, retention is set to at least the five years Rule 204-2 requires, and retrieval is tested before an examiner asks. Dually registered firms and advisers with a broker-dealer affiliate also have to meet FINRA Rule 4511 and SEC Rule 17a-4, which add storage-format requirements that Rule 204-2 doesn't have.

This guide covers the Salesforce configuration. For a plain-language list of which records the rules cover, see our CRM recordkeeping compliance checklist. For moving old records out of Salesforce to manage storage, see data archiving in Salesforce for financial firms.

This is general information, not legal advice. Confirm your firm's obligations with your CCO and counsel.

What do the SEC and FINRA rules actually require?

SEC Rule 204-2 (investment advisers)

Rule 204-2 under the Investment Advisers Act is the books and records rule for SEC-registered advisers. A few parts matter most for a CRM:

• Written communications, paragraph (a)(7). Advisers must keep originals of written communications received and copies of those sent relating to any recommendation or advice given or proposed, any receipt, disbursement or delivery of funds or securities, the placing or execution of any order, and performance or rate of return. The test is subject matter, so an email from Salesforce, a text or a Teams chat can all be in scope.
• Advertisements, paragraph (a)(11). Advisers must keep a copy of each advertisement (as defined in the Marketing Rule, 206(4)-1) they disseminate, directly or indirectly.
• Agreements and accounts. Paragraph (a)(10) covers all written agreements with clients, and (a)(8) covers the list of discretionary accounts.
• Regulation S-P records, paragraph (a)(25). Since the 2024 amendments, advisers must keep written incident response policies and documentation of any detected unauthorized access to customer information and the firm's response.

Retention. Under paragraph (e)(1), most required records must be kept "in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser." Advertisements under (a)(11) run five years from the end of the fiscal year in which the adviser last disseminated them, per paragraph (e)(3).

Electronic storage. Rule 204-2(g) allows electronic storage, and it doesn't require WORM (write once, read many) media. It does require the adviser to:

• arrange and index records "in a way that permits easy location, access, and retrieval of any particular record"
• provide promptly a legible, true and complete copy, printout and means to access, view and print records when the SEC asks
• separately store a duplicate copy for the full retention period
• maintain procedures to "reasonably safeguard them from loss, alteration, or destruction" and to "limit access to the records to properly authorized personnel and the Commission"

In Salesforce terms: you need an index (searchable by client, date and person), a duplicate copy outside the live org, proof that records can't be quietly edited or deleted, and access controls you can show an examiner.

FINRA Rule 4511 and SEC Rule 17a-4 (dual registrants and broker-dealer affiliates)

If your firm is dually registered or shares Salesforce with an affiliated broker-dealer, the broker-dealer side follows a different standard. FINRA Rule 4511 requires members to preserve FINRA books and records "for a period of at least six years" where no other period is specified, and in "a format and media that complies with SEA Rule 17a-4." Rule 17a-4(b)(4) covers communications sent and received "relating to its business as such," which is broader than the adviser rule's subject-matter list. Customer complaint records under FINRA Rule 4513 must be kept at least four years.

On storage format, the SEC amended Rule 17a-4 in October 2022. Broker-dealers used to need WORM storage. The amended rule lets them choose either WORM or a system that keeps "a complete time-stamped audit trail" of all modifications and deletions, with the date, time and identity of the person, so the original record can be re-created. The audit-trail alternative applies to broker-dealers and security-based swap entities and doesn't change Rule 204-2. A dual registrant usually builds to the stricter 17a-4 standard for any shared data, so it doesn't have to split records by registration.

For a short definition you can share internally, see our glossary entry on SEC Rule 17a-4.

Regulation S-P (amended 2024)

The SEC adopted amendments to Regulation S-P on May 15, 2024. Covered firms, including RIAs, need a written incident response program for unauthorized access to customer information, must notify affected individuals as soon as practicable and no later than 30 days after becoming aware of an incident (subject to a harm determination), and must oversee service providers, who must notify the firm within 72 hours of a breach. Compliance dates were December 3, 2025 for larger entities and June 3, 2026 for smaller ones, so both have passed.

Salesforce holds customer information, so it belongs in your incident response program, and Salesforce, your archive vendor and your consulting partner belong in your service provider oversight.

Why does off-channel enforcement matter for a Salesforce team?

Since late 2021, the SEC has brought a long run of recordkeeping cases over "off-channel" communications, meaning business messages on texting apps, WhatsApp and similar tools that firms didn't capture. Advisers have been part of these sweeps. Three examples from SEC press releases:

• February 9, 2024: 16 firms, including dual registrants and four affiliated investment advisers, agreed to pay about $81 million in combined penalties (press release 2024-18).
• September 24, 2024: 12 firms, including investment advisers, with combined penalties of $88,225,000. One firm paid no penalty after self-reporting (2024-144).
• January 13, 2025: 12 firms, nine of them investment advisers, with combined penalties of $63.1 million (2025-6).

Every channel an advisor can use to talk to a client from inside Salesforce (email, SMS, WhatsApp through a messaging integration, Experience Cloud portal messages, Chatter) is a channel your archive has to cover. A texting app added to Salesforce without an archive connector is an off-channel risk inside the CRM.

Where do RIA records live in Salesforce, and what control fits each?

The table below maps common record types to their usual Salesforce home and the control that makes them defensible. Object names are for Financial Services Cloud on the standard platform. Your org may use custom objects instead.

Examiners ask for "all communications with client X between these dates," and your archive search has to answer that, including messages that never touched Salesforce. Salesforce, for its part, shows only the current state of a record, so without history tracking an edited note or a reassigned complaint loses its prior values.

Which Salesforce controls should an RIA configure?

Capture outbound email into the archive

Salesforce has a Compliance BCC Email setting (Setup, under Email administration) that sends a hidden copy of users' outgoing Salesforce email to one address you specify, typically your archive vendor's journaling address. When it's on, users can't edit the BCC field or turn off the copy. System notices such as password resets are excluded. This covers email Salesforce itself sends. It doesn't cover email an advisor sends from Outlook or Gmail, even if that email later gets logged to Salesforce, so your mail server journaling still has to cover those.

Smarsh says it captures email sent through Salesforce Sales Cloud, Marketing Cloud and Pardot (now Account Engagement) by journaling. Global Relay offers a Salesforce Chatter connector that captures posts, comments, files and direct messages, including edits and deletions.

Email-to-Salesforce (the personal address users BCC to log email into the CRM) is useful for context. It isn't a capture control, because it depends on each user remembering to use it.

Remove delete rights

Rule 204-2(g) asks for procedures that safeguard records from loss, alteration or destruction. In Salesforce the most direct step is to remove the Delete permission on Contacts, Accounts, Cases, Tasks, Events, EmailMessage and any custom record objects for everyone except a small admin group. Review who holds "Modify All Data" and "Modify All" on regulated objects, since those bypass sharing. Deleted records sit in the Recycle Bin for 15 days, which won't satisfy a five-year rule. Use validation rules or record locking (for example, lock an Interaction Summary 48 hours after the meeting) where your policy calls for it.

Track field changes

Standard field history tracking lets you track up to 20 standard and custom fields per object. Salesforce keeps that history for 18 months in the interface and up to 24 months through the API. That's well short of five years.

Field Audit Trail, sold as part of Salesforce Shield or as a separate Field Audit Trail licence, raises the limit to up to 200 fields per object and moves history into the FieldHistoryArchive big object, where Salesforce's current help documentation says it's kept until you delete it. Archived history is accessible through the API, so plan a report or export path your compliance team can use. Pick fields that carry regulatory meaning: complaint status, resolution, advice summary, risk tolerance, discretionary authority flags, account owner.

Back up data and files

The weekly or monthly Data Export service gives you CSV files and attachments, but Salesforce deletes the zip files 48 hours after the notification email, and it isn't versioned. Firms usually add a backup product. Salesforce sells Backup & Recover. GRAX captures each record version continuously into the firm's own cloud storage and says it keeps immutable records with full audit trails for SEC 17a-4 and FINRA use cases. Backup gives you the duplicate copy that 204-2(g)(2)(iii) asks for, provided the retention on the backup matches the rule.

Set retention and legal holds

Write the retention schedule first, then configure tools to match it. Five years from the end of the fiscal year of the last entry is the baseline for most adviser records, with six years for many broker-dealer records. Make sure your archive, backup and Field Audit Trail retention policies are at least that long. Add a way to suspend deletion for records under a legal hold or regulatory inquiry.

Test retrieval

Run a mock exam request twice a year. Ask for every communication with one household over a 13-month window, the history of one complaint case, and the version of an advertisement used on a specific date. Time how long it takes and who had to help. If the answer depends on one admin, that's a finding.

Implementation checklist for RIAs

Use these questions with your CCO, Salesforce admin and any consulting partner:

1. Do we have a written records map listing each record type, its rule, its system of record and its retention period?
2. Which Salesforce channels can send a client communication (email, SMS, WhatsApp, portal, Chatter), and does each one have an archive connector?
3. Is Compliance BCC turned on, and does it point to our archive's journaling address?
4. Are Marketing Cloud or Account Engagement sends captured, and do we keep each advertisement version with its approval?
5. Who can delete records on regulated objects, and who holds Modify All Data?
6. Which fields are history-tracked, and do we need Field Audit Trail to reach five or six years?
7. Does our backup keep versions and files for the full retention period, and is it stored outside the production org?
8. If we share Salesforce with a broker-dealer affiliate, have we designed to the 17a-4 standard for shared data?
9. Is Salesforce in our Reg S-P incident response program, and do vendor contracts include the 72-hour notification?
10. When did we last run a retrieval test, and how long did it take?
11. Who approves changes to permissions, email settings and integrations, and is that approval logged?

Recordkeeping controls drift when someone adds an integration or a permission set on a Friday. At Vantage Point, every change we make is logged, risk-rated, built and tested outside production, and approved by the client's named approver, with compliance signing off on anything that touches customer data, permissions or client communications. We configure the controls and your compliance team approves them. Our Salesforce FSC compliance implementation timeline shows how long this work typically takes, and our guide to Salesforce admin support for RIAs covers who keeps it running afterwards.

Frequently asked questions

Is Salesforce compliant with SEC Rule 204-2 out of the box?

Compliance depends on how the firm configures and supervises the CRM. Salesforce provides the tools (permission controls, field history, Field Audit Trail, backup, email settings), but the adviser has to set retention, restrict deletes, capture communications and prove retrieval. Most RIAs treat a dedicated archive as the record of communications and Salesforce as the client context.

Does Rule 204-2 require WORM storage?

No. Rule 204-2(g) permits electronic storage if the adviser indexes records for easy retrieval, keeps a separate duplicate copy, safeguards records from loss, alteration or destruction, and limits access. WORM or the audit-trail alternative is a Rule 17a-4 requirement for broker-dealers, which applies to dual registrants and affiliated broker-dealers.

How long do RIAs have to keep Salesforce records?

Most Rule 204-2 records must be kept for at least five years from the end of the fiscal year of the last entry, with the first two years in an appropriate office. Advertisements run five years from the end of the fiscal year in which they were last disseminated. Broker-dealer records under Rule 17a-4 and FINRA 4511 often require six years.

Does field history tracking satisfy recordkeeping rules?

Not alone. Standard field history covers up to 20 fields per object and keeps data for 18 months in the interface (24 months through the API). Field Audit Trail extends that to up to 200 fields per object with history kept until deleted, which is a better fit for five- and six-year retention.

Are emails logged to Salesforce from Outlook or Gmail captured by Compliance BCC?

No. Compliance BCC copies email that Salesforce sends. Email sent from Outlook or Gmail has to be captured by journaling on your mail server into the archive, whether or not it's later logged to Salesforce.

Do texts sent through a Salesforce messaging app count as records?

Yes, if the content relates to advice, recommendations, funds or securities movement, orders or performance. Rule 204-2(a)(7) applies by subject matter, whatever the channel. Before turning on any SMS or WhatsApp integration in Salesforce, confirm your archive vendor captures that channel.

Get a recordkeeping review of your Salesforce org

Vantage Point is a senior-led Salesforce, HubSpot and AI consulting firm for financial services, founded in 2018 by David Cockrum, a former COO of a wealth management firm. We've completed 700+ engagements for 175+ clients. If you want a second set of eyes on capture, delete rights, Field Audit Trail and retention before your next exam, book a free CRM assessment. For ongoing admin with compliance-approved change control, see our managed services packages. Our glossary entry on communications archiving is a short primer for your team.