Short answer
For broker-dealers and investment advisers, the CRM and the AI tools around it create business records and communications that SEC and FINRA rules may require you to keep, supervise and produce. Map each data source to a rule, capture communications in an approved archive, control who can change records, and test that you can produce them on request.
Use this checklist to start the conversation with your compliance team and counsel, who decide what your firm's obligations are. It is general guidance, and Vantage Point is not a law firm.
Map what the CRM holds
- Client and prospect profiles, suitability or best interest data, and account opening information.
- Communications: emails sent from the CRM, sequence and workflow email, SMS, portal messages, call recordings and notes.
- AI output: meeting summaries, drafted emails, generated notes.
- For each item, record which rule may apply and where the official copy lives.
Rules that usually come up
| Rule | What it touches in the CRM |
|---|---|
| SEC Rule 17a-4 (broker-dealers) | How and how long required records and communications are preserved, including electronic storage requirements |
| SEC Rule 204-2 (advisers) | Books and records an investment adviser must keep, including certain written communications |
| FINRA Rule 4511 | General requirement to make and preserve books and records |
| FINRA Rule 3110 | Supervision, including review of correspondence |
| FINRA Rule 2210 | Content and approval of communications with the public |
| Regulation S-P | Safeguarding customer information and incident response |
Controls to build
- Capture CRM-sent email and rep mailboxes in your archiving vendor. Test that sequence and workflow emails arrive there.
- Turn on field history tracking for key fields, and restrict delete permissions.
- Route marketing templates and AI-drafted client communications through review before sending.
- Decide whether AI chat conversations are records and, if so, how they are retained.
- Limit who can export client data, and log exports.
Test it
- Pick five clients and produce every communication with them from the last quarter, from the archive.
- Reconstruct one record's change history from the CRM audit trail.
- Repeat after every major release or new integration.
Official documentation
Frequently asked questions
Do emails sent from Salesforce or HubSpot need to be archived?
For broker-dealers and investment advisers, business communications sent from a CRM are generally subject to the same preservation and supervision rules as other email. Capture them in your approved archive and confirm the approach with compliance.
Are AI-generated meeting notes a business record?
They can be, depending on what they contain and how your firm uses them. Decide with compliance whether AI notes and drafts are records, where the official copy lives and how long it is kept.
Salesforce, HubSpot, Anthropic and OpenAI change their products often. Check the official documentation before you rely on a specific setting, limit or price.