Advorra blog

RIA books and records: what to keep, who owns it, how fast you can produce it

By the team at The CollabHub · Co-written with Mohammad Aamish Aaftab
Published 9 Oct 2026 · Updated 17 Oct 2026

Books and records are the documents an RIA is required to keep to show how it runs: client agreements, account and trade records, billing, written communications, discretionary authority, policies and procedures and more. For SEC-registered advisers, Rule 204-2 generally requires keeping them for at least five years, the first two in an appropriate office; state-registered advisers follow their own state's rules, which are often similar. The practical test for each record is whether you can say where it lives, who owns it, how long it is kept and how fast you could produce it.

Most small RIAs have their records. The trouble shows up when someone asks for one. A signed agreement is in an email attachment. The current version of a procedure is one of three files with similar names. The list of discretionary accounts was right in January. None of that means the firm did anything wrong. It means the records were kept, but nobody could say where.

What counts as books and records for an RIA?

For SEC-registered advisers, Rule 204-2 lists the categories. In plain terms they include journals and ledgers, order and trade records, bank and cash records, bills and financial statements, written communications with clients, the list of discretionary accounts and powers of attorney, client agreements, advertisements, code of ethics records, brochures, performance calculation records and the firm's compliance policies and procedures (17 CFR 275.204-2).

State-registered advisers are covered by their own state's rules rather than Rule 204-2, but the categories are usually familiar. Read your state's rule text once, and list what it names.

How long are records typically kept?

For SEC-registered advisers the general period is at least five years. Rule 204-2(e)(1) requires records to be kept "in an easily accessible place" for at least five years from the end of the fiscal year of the last entry, "the first two years in an appropriate office of the investment adviser". Some records have their own periods. State rules can differ, so confirm yours.

What usually goes wrong with small-firm records?

The usual problem isn't missing records. It's records nobody can vouch for:

• The same record lives in three places, and nobody knows which copy is current.
• Nobody owns it, so it is updated when someone remembers.
• Policies say one thing and practice has moved on.
• Producing it means a weekend of searching email and folders.

What four questions should every record answer?

Every record should answer where it lives, who owns it, how long it's kept and how fast it can be produced. A good answer is short and specific:

How do you build a records register?

Make a one-page register with a row per record category and four columns: location, owner, retention and how to produce it. Review it twice a year. It takes an afternoon.

Take a hypothetical solo RIA with about 70 households and one part-time assistant. The owner lists the categories from the rule that applies to the firm, about fifteen rows. Most rows fill in quickly: client agreements live in the document folder, the owner owns them, five years from the last entry, produced by exporting the folder.

Three rows don't fill in cleanly. Client emails live in two inboxes, so "where" has two answers. The discretionary account list exists, but nobody has checked it since two accounts changed status in the spring. Brochure deliveries were sent by email, so the proof is scattered across sent folders. Those three rows are the work list. Fixing them takes a few hours spread over a month, and after that the register is mostly maintenance.

Which records are easiest to let slip?

These four drift out of date most often, because the work that changes them happens somewhere else:

1. The discretionary account list, because accounts change status without anyone updating it.
2. Complaints and incidents, because the log is opened only when something goes wrong, and then written from memory.
3. Suitability reviews, because the date of the last review lives in someone's calendar.
4. Brochure deliveries, because delivery happens by email and the proof stays in the inbox.

When is a formal register overkill?

For a brand-new firm with a handful of clients, a register can wait a few months while the records themselves get set up. It shouldn't wait longer than that. Once you have more than one person touching records, or more than one place records are stored, the register is the cheapest way to keep them findable. It doesn't need software. A spreadsheet does the job.

How does Advorra keep records?

In Advorra, compliance records sit in registers kept as the work happens: procedures with version history, author and review dates; policies; an incidents and complaints log; a discretionary-authority register; personal-securities and brochure-delivery logs; and a suitability-review clock. A records-production pack bundles the categories an examiner typically asks for. It keeps and structures the records; it does not decide whether a firm meets its obligations. If your register shows the same gaps as the firm above, see how those registers work on the product page, or read the custodian-move records checklist.

General information, not legal or compliance advice. Rule quotations from 17 CFR 275.204-2 as published by the Legal Information Institute, October 2026. State-registered advisers should rely on their state's rules.