Salesforce · Compliance and security · SEC and FINRA
Salesforce SEC and FINRA recordkeeping controls
For RIAs, broker-dealers and dual registrants that use Salesforce as their client system of record and need retention, audit trails and supervision that hold up in an exam.
Short answer
Vantage Point maps your Salesforce data to the SEC and FINRA records you must keep, then sets up retention, field history, audit trails, archiving connections and supervision workflows to match. You get a written control map your CCO can hand to an examiner. Work starts with a $5,000 org assessment, credited to the build.
What the rules ask of your CRM
Salesforce compliance for financial services firms starts with knowing which records the rules cover. For advisers and broker-dealers, these are the ones that touch the CRM most.
| Rule | Who | What it means in Salesforce |
|---|---|---|
| Advisers Act Rule 204-2 | SEC registered advisers | Keep required books and records for five years, the first two in an easily accessible place. Client communications about advice and performance stored in Salesforce are in scope. |
| Exchange Act Rule 17a-4 | Broker-dealers | Keep records in a non-rewriteable format or with a complete audit trail of changes. Most firms meet this through an archiving vendor rather than Salesforce alone. |
| FINRA Rule 4511 | FINRA members | Preserve books and records in a format that complies with 17a-4, six years where no other period applies. |
| FINRA Rule 3110 | FINRA members | Supervise the business, including review of correspondence and documented approvals. |
| Regulation S-P (2024 amendments) | Advisers and broker-dealers | Written incident response and service provider oversight for customer information, including what sits in your CRM. |
This is a summary for planning, not legal advice. Your compliance team and counsel decide which records are required.
The controls we set up
- A record inventory. Every object and field that holds a required record, tagged with the rule, the retention period and the owner.
- Field history and audit trails. Standard field history keeps changes for 18 months in the interface. Where you need longer, Salesforce Shield Field Audit Trail can keep history for up to ten years, or changes are sent to your archive.
- Archiving connections. Emails, tasks, chatter and text messages logged in Salesforce are captured by your archiving vendor, tested end to end before go-live.
- Deletion and edit controls. Who can delete or change a required record, with validation rules and permission sets that stop accidental loss.
- Supervision workflows. Review queues and approval steps for correspondence, complaints and exceptions, with the reviewer, date and outcome stored on the record.
- Access and monitoring. Least-privilege permission sets, login and export monitoring, and Shield Event Monitoring where your risk profile calls for it.
Audit readiness
Examiners ask for records by client, date range and type, and they expect them quickly. We build saved reports and an export runbook for the common requests: client communications, complaint logs, account opening documents and supervisory reviews. Your team runs a mock request before the build is signed off.
For AI tools that draft or summarize client communications inside Salesforce, see AI compliance and supervision.
Pricing
| Package | Price | Timeline |
|---|---|---|
| Salesforce Org Assessment, including the record inventory | $5,000, credited to follow-on work | Quoted |
| Recordkeeping controls build | Quoted after the assessment | Typically 4 to 8 weeks |
| AI Supervision and Recordkeeping | $25,000 | 4 to 6 weeks |
Proof
Financial services only. Most of our clients are wealth managers, banks, insurers and asset managers. We build Salesforce for firms that get examined, and we write the documentation with that in mind.
Talk to a client. We will introduce you to a client's operations or compliance lead. Ask for a client reference.
Frequently asked questions
Is Salesforce compliant with SEC Rule 17a-4?
Salesforce on its own is not usually how firms meet 17a-4. Most broker-dealers capture Salesforce communications in a dedicated archiving vendor that meets the non-rewriteable or audit-trail requirement, and use Salesforce controls to stop records being lost before capture.
How long does Salesforce keep field history?
Standard field history tracking keeps changes for 18 months in the interface and 24 months through the API. Salesforce Shield Field Audit Trail can keep field history for up to ten years.
Do RIAs need Salesforce Shield?
Not always. Many RIAs meet their obligations with field history, permission controls and an archiving vendor. Shield makes sense for larger firms, longer audit trails or encryption requirements.
What records in Salesforce does an RIA have to keep?
Typically written communications about advice, recommendations and performance, complaint records, and records supporting client agreements. Your CCO and counsel confirm the list, and we map each one to where it lives in Salesforce.
How do you set up supervision in Salesforce?
With review queues, approval steps and fields that record the reviewer, date and outcome on the record, plus reports that show what is still waiting for review.
How long does a recordkeeping controls project take?
Usually 4 to 8 weeks after a $5,000 org assessment. The timeline depends on how many integrations and communication channels need to reach your archive.
Updated November 11, 2026.