In most RIAs, Salesforce creates records and a separate archive holds them. Email and messages sent from Salesforce (and from marketing tools connected to it) are captured into an approved archive such as Smarsh or Global Relay, delete rights are removed from most users, field changes are tracked with field history or Shield Field Audit Trail, retention is set to at least the five years Rule 204-2 requires, and retrieval is tested before an examiner asks. Dually registered firms and advisers with a broker-dealer affiliate also have to meet FINRA Rule 4511 and SEC Rule 17a-4, which add storage-format requirements that Rule 204-2 doesn't have.
This guide covers the Salesforce configuration. For a plain-language list of which records the rules cover, see our CRM recordkeeping compliance checklist. For moving old records out of Salesforce to manage storage, see data archiving in Salesforce for financial firms.
This is general information, not legal advice. Confirm your firm's obligations with your CCO and counsel.
Rule 204-2 under the Investment Advisers Act is the books and records rule for SEC-registered advisers. A few parts matter most for a CRM:
Retention. Under paragraph (e)(1), most required records must be kept "in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser." Advertisements under (a)(11) run five years from the end of the fiscal year in which the adviser last disseminated them, per paragraph (e)(3).
Electronic storage. Rule 204-2(g) allows electronic storage, and it doesn't require WORM (write once, read many) media. It does require the adviser to:
In Salesforce terms: you need an index (searchable by client, date and person), a duplicate copy outside the live org, proof that records can't be quietly edited or deleted, and access controls you can show an examiner.
If your firm is dually registered or shares Salesforce with an affiliated broker-dealer, the broker-dealer side follows a different standard. FINRA Rule 4511 requires members to preserve FINRA books and records "for a period of at least six years" where no other period is specified, and in "a format and media that complies with SEA Rule 17a-4." Rule 17a-4(b)(4) covers communications sent and received "relating to its business as such," which is broader than the adviser rule's subject-matter list. Customer complaint records under FINRA Rule 4513 must be kept at least four years.
On storage format, the SEC amended Rule 17a-4 in October 2022. Broker-dealers used to need WORM storage. The amended rule lets them choose either WORM or a system that keeps "a complete time-stamped audit trail" of all modifications and deletions, with the date, time and identity of the person, so the original record can be re-created. The audit-trail alternative applies to broker-dealers and security-based swap entities and doesn't change Rule 204-2. A dual registrant usually builds to the stricter 17a-4 standard for any shared data, so it doesn't have to split records by registration.
For a short definition you can share internally, see our glossary entry on SEC Rule 17a-4.
The SEC adopted amendments to Regulation S-P on May 15, 2024. Covered firms, including RIAs, need a written incident response program for unauthorized access to customer information, must notify affected individuals as soon as practicable and no later than 30 days after becoming aware of an incident (subject to a harm determination), and must oversee service providers, who must notify the firm within 72 hours of a breach. Compliance dates were December 3, 2025 for larger entities and June 3, 2026 for smaller ones, so both have passed.
Salesforce holds customer information, so it belongs in your incident response program, and Salesforce, your archive vendor and your consulting partner belong in your service provider oversight.
Since late 2021, the SEC has brought a long run of recordkeeping cases over "off-channel" communications, meaning business messages on texting apps, WhatsApp and similar tools that firms didn't capture. Advisers have been part of these sweeps. Three examples from SEC press releases:
Every channel an advisor can use to talk to a client from inside Salesforce (email, SMS, WhatsApp through a messaging integration, Experience Cloud portal messages, Chatter) is a channel your archive has to cover. A texting app added to Salesforce without an archive connector is an off-channel risk inside the CRM.
The table below maps common record types to their usual Salesforce home and the control that makes them defensible. Object names are for Financial Services Cloud on the standard platform. Your org may use custom objects instead.
| Record type | Rule reference | Where it usually lives in Salesforce | Primary control |
|---|---|---|---|
| Client email sent from Salesforce | 204-2(a)(7); 17a-4(b)(4) | EmailMessage records (Enhanced Email) linked to Contact, Account or Case | Compliance BCC or journaling into an approved archive; remove delete rights on EmailMessage |
| Email sent from Marketing Cloud or Account Engagement | 204-2(a)(7) and (a)(11) if it's an advertisement | Marketing tool send logs, not core CRM | Archive capture of every send plus a copy of each template version |
| Texts and chat sent through a Salesforce messaging integration | 204-2(a)(7) | Messaging Session, Conversation or vendor custom objects | Archive connector for the messaging channel; block any channel without one |
| Advice and meeting notes | 204-2(a)(7) where written to or from the client; firm policy otherwise | Interaction Summary, Task, Event, Notes | Field history or Field Audit Trail on key fields; lock records after a set period |
| Complaints | Firm policy and 204-2(a)(7); FINRA 4513 for broker-dealers | Cases with a Complaint record type | Required fields, restricted delete, Field Audit Trail on status and resolution |
| Marketing Rule advertisements and approvals | 204-2(a)(11), (a)(16), (a)(19) | Files (ContentVersion) on a Campaign or custom approval object | Version history in Files; approval record; copy to archive or document repository |
| Order instructions and trade-related notes | 204-2(a)(3) and (a)(7) | Tasks, Cases, Financial Account Transactions (if synced) | Treat custodian or OMS as system of record; capture any written instruction in the archive |
| Client agreements and account documents | 204-2(a)(8), (a)(9), (a)(10) | Files (ContentVersion and ContentDocument) on Account or Financial Account | Restrict file deletion; backup with file versions; retention policy |
| Reg S-P incident records | 204-2(a)(25) | Usually outside Salesforce (GRC tool) | Keep out of the CRM, or restrict to the compliance team if stored there |
Examiners ask for "all communications with client X between these dates," and your archive search has to answer that, including messages that never touched Salesforce. Salesforce, for its part, shows only the current state of a record, so without history tracking an edited note or a reassigned complaint loses its prior values.
Salesforce has a Compliance BCC Email setting (Setup, under Email administration) that sends a hidden copy of users' outgoing Salesforce email to one address you specify, typically your archive vendor's journaling address. When it's on, users can't edit the BCC field or turn off the copy. System notices such as password resets are excluded. This covers email Salesforce itself sends. It doesn't cover email an advisor sends from Outlook or Gmail, even if that email later gets logged to Salesforce, so your mail server journaling still has to cover those.
Smarsh says it captures email sent through Salesforce Sales Cloud, Marketing Cloud and Pardot (now Account Engagement) by journaling. Global Relay offers a Salesforce Chatter connector that captures posts, comments, files and direct messages, including edits and deletions.
Email-to-Salesforce (the personal address users BCC to log email into the CRM) is useful for context. It isn't a capture control, because it depends on each user remembering to use it.
Rule 204-2(g) asks for procedures that safeguard records from loss, alteration or destruction. In Salesforce the most direct step is to remove the Delete permission on Contacts, Accounts, Cases, Tasks, Events, EmailMessage and any custom record objects for everyone except a small admin group. Review who holds "Modify All Data" and "Modify All" on regulated objects, since those bypass sharing. Deleted records sit in the Recycle Bin for 15 days, which won't satisfy a five-year rule. Use validation rules or record locking (for example, lock an Interaction Summary 48 hours after the meeting) where your policy calls for it.
Standard field history tracking lets you track up to 20 standard and custom fields per object. Salesforce keeps that history for 18 months in the interface and up to 24 months through the API. That's well short of five years.
Field Audit Trail, sold as part of Salesforce Shield or as a separate Field Audit Trail licence, raises the limit to up to 200 fields per object and moves history into the FieldHistoryArchive big object, where Salesforce's current help documentation says it's kept until you delete it. Archived history is accessible through the API, so plan a report or export path your compliance team can use. Pick fields that carry regulatory meaning: complaint status, resolution, advice summary, risk tolerance, discretionary authority flags, account owner.
The weekly or monthly Data Export service gives you CSV files and attachments, but Salesforce deletes the zip files 48 hours after the notification email, and it isn't versioned. Firms usually add a backup product. Salesforce sells Backup & Recover. GRAX captures each record version continuously into the firm's own cloud storage and says it keeps immutable records with full audit trails for SEC 17a-4 and FINRA use cases. Backup gives you the duplicate copy that 204-2(g)(2)(iii) asks for, provided the retention on the backup matches the rule.
Write the retention schedule first, then configure tools to match it. Five years from the end of the fiscal year of the last entry is the baseline for most adviser records, with six years for many broker-dealer records. Make sure your archive, backup and Field Audit Trail retention policies are at least that long. Add a way to suspend deletion for records under a legal hold or regulatory inquiry.
Run a mock exam request twice a year. Ask for every communication with one household over a 13-month window, the history of one complaint case, and the version of an advertisement used on a specific date. Time how long it takes and who had to help. If the answer depends on one admin, that's a finding.
Use these questions with your CCO, Salesforce admin and any consulting partner:
Recordkeeping controls drift when someone adds an integration or a permission set on a Friday. At Vantage Point, every change we make is logged, risk-rated, built and tested outside production, and approved by the client's named approver, with compliance signing off on anything that touches customer data, permissions or client communications. We configure the controls and your compliance team approves them. Our Salesforce FSC compliance implementation timeline shows how long this work typically takes, and our guide to Salesforce admin support for RIAs covers who keeps it running afterwards.
Compliance depends on how the firm configures and supervises the CRM. Salesforce provides the tools (permission controls, field history, Field Audit Trail, backup, email settings), but the adviser has to set retention, restrict deletes, capture communications and prove retrieval. Most RIAs treat a dedicated archive as the record of communications and Salesforce as the client context.
No. Rule 204-2(g) permits electronic storage if the adviser indexes records for easy retrieval, keeps a separate duplicate copy, safeguards records from loss, alteration or destruction, and limits access. WORM or the audit-trail alternative is a Rule 17a-4 requirement for broker-dealers, which applies to dual registrants and affiliated broker-dealers.
Most Rule 204-2 records must be kept for at least five years from the end of the fiscal year of the last entry, with the first two years in an appropriate office. Advertisements run five years from the end of the fiscal year in which they were last disseminated. Broker-dealer records under Rule 17a-4 and FINRA 4511 often require six years.
Not alone. Standard field history covers up to 20 fields per object and keeps data for 18 months in the interface (24 months through the API). Field Audit Trail extends that to up to 200 fields per object with history kept until deleted, which is a better fit for five- and six-year retention.
No. Compliance BCC copies email that Salesforce sends. Email sent from Outlook or Gmail has to be captured by journaling on your mail server into the archive, whether or not it's later logged to Salesforce.
Yes, if the content relates to advice, recommendations, funds or securities movement, orders or performance. Rule 204-2(a)(7) applies by subject matter, whatever the channel. Before turning on any SMS or WhatsApp integration in Salesforce, confirm your archive vendor captures that channel.
Vantage Point is a senior-led Salesforce, HubSpot and AI consulting firm for financial services, founded in 2018 by David Cockrum, a former COO of a wealth management firm. We've completed 700+ engagements for 175+ clients. If you want a second set of eyes on capture, delete rights, Field Audit Trail and retention before your next exam, book a free CRM assessment. For ongoing admin with compliance-approved change control, see our managed services packages. Our glossary entry on communications archiving is a short primer for your team.