Best software for financial advisors: the compliant stack
An adviser's software is a stack: a CRM, planning and portfolio tools, an archive, a texting app, a compliance suite and a website. Each layer makes or holds records the SEC and FINRA rules name. We read the leading RIA software pick of each layer on its own pages, against the record jobs that layer takes on, and link each layer to its own full comparison.
Reviewed October 2026
Best overall
Wealthbox
Its own integrations page names the planning, portfolio, compliance, texting and website picks on this page, so it is the layer the rest of a small firm's stack plugs into.
Read the review of WealthboxBest for one platform across layers
Orion
CRM (Redtail), planning, portfolio accounting, trading and compliance from one vendor, with a compliance module that timestamps every alert and calls the exam data it keeps exportable.
Read the review of OrionBest for a small RIA's compliance and archive
Comply
Policies, code of ethics, a 206(4)-7 annual review workflow and a WORM-format archive that also takes MyRepChat and Redtail Speak texts, from one vendor.
Read the review of Comply
The comparison table
| Vendor | Keeps the record its layer creates204-2(a); 17a-4(b) | A review or approval step206(4)-7(b); FINRA 2210(b)(1)(A) | Sends its records to an archive204-2(g)(2)(iii); 17a-4(b)(4) | Export on request204-2(g)(2)(ii); 17a-4(f)(2)(iv) | Names the other layers it connects to | Says it is built for advisers |
|---|---|---|---|---|---|---|
WealthboxCRM layer | Meets Activity logs, client history | Partial Notetaker keyword flags only | Partial Shows MyRepChat's archived texts | Partial Roles gate export; no format | Meets Names five other picks here | Meets Solo advisers to broker-dealers |
OrionPortfolio platform | Meets Timestamps alerts and fixes | Partial Alerts; review evidence not stated | Not stated | Partial Exam data exportable; no format | Meets Redtail, planning, custodians | Meets RIAs and broker-dealers |
ComplyCompliance suite | Meets Policies, ethics, annual review | Meets 206(4)-7 annual review workflow | Meets Its own WORM-format archive | Partial Reports export; archive not said | Meets Takes MyRepChat, Redtail Speak | Meets Purpose-built for RIAs |
eMoney AdvisorPlanning layer | Not stated Portal documents; no retention | Not stated | Not stated | Not stated | Partial APIs; no partner named | Meets Banks, broker-dealers, RIAs |
FMGWebsite and marketing | Partial Approval history; contents unsaid | Meets Edits route to compliance | Not stated No archiving vendor named | Not stated | Partial Lists MyRepChat in its menu | Meets RIAs, independent broker-dealers |
MyRepChatTexting layer | Meets Stores all advisor-client texts | Partial Alerts; review steps not stated | Meets 13 archives named | Not stated Through the connected archive | Meets Wealthbox, Redtail, FMG content | Meets Texting for financial advisors |
SmarshArchive layer | Meets 100+ channels | Partial Review evidence not stated | Meets It is the archive | Meets PST, EML, HTML, XML, EDRM | Partial APIs; no adviser CRM named | Meets RIAs, BDs, a small-firm tier |
The stack, layer by layer
The software a small advisory firm buys sorts into seven layers. Each one creates or holds a record the SEC or FINRA rules name, so each one is a books-and-records system whether its sales page says so or not. The rows below give each layer's record, the pick read for this page, and the comparison that reads that layer in depth.
- 01
CRM
Client notes and the emails on advice, orders and money movement that an examiner asks for first.
204-2(a)(7); 17a-4(b)(4)
Read here: Wealthbox. Compared in depth: CRM for financial advisors, wealth-management CRM, Redtail vs Wealthbox, free CRMs.
- 02
Planning
A written plan or recommendation sent to a client is advice given in writing.
204-2(a)(7)(i)
Read here: eMoney Advisor. Compared in depth: Rule 204-2 explained.
- 03
Portfolio and trading
The accounts and working papers behind any performance figure you advertise.
204-2(a)(16)
Read here: Orion. Compared in depth: trade surveillance software, personal trading compliance.
- 04
Archive
The separately stored duplicate copy, indexed so any one record can be found and produced promptly.
204-2(g)(2); 17a-4(f)
Read here: Smarsh. Compared in depth: email archiving, social media archiving, 17a-4 storage, Smarsh alternatives, Global Relay alternatives.
- 05
Texting
Texts with clients are written communications like email, on the same rules and periods.
204-2(a)(7); 17a-4(b)(4)
Read here: MyRepChat. Compared in depth: FINRA-compliant texting, text message archiving, WhatsApp and iMessage archiving.
- 06
Compliance suite
The written policies, the annual review of them, and the code of ethics with its reports.
206(4)-7(a)-(b); 204-2(a)(12), (a)(17)
Read here: Comply. Compared in depth: RIA compliance software, broker-dealer compliance software, RIA compliance consultants.
- 07
Website and marketing
A copy of each advertisement; at a broker-dealer, a principal's approval of each retail communication before use.
204-2(a)(11); FINRA 2210(b)(1)(A)
Read here: FMG. Compared in depth: advertising review software, the SEC Marketing Rule.
Where each record ends up
A record is usually made in one layer and kept in another. The table follows six common records from the tool that makes them to the place the rule expects to find them. For an adviser, most of them are kept for not less than five years from the end of the fiscal year of the last entry, the first two in an appropriate office; advertisements and performance backup run five years from the end of the fiscal year the ad was last disseminated. A broker-dealer keeps its communications for not less than three years, the first two in an easily accessible place.
Six records, from the layer that makes them to where they are kept
| Record | Made in | Kept in | Rule |
|---|---|---|---|
| An email giving advice | CRM or mail system | Archive (the duplicate copy) | 204-2(a)(7), (e)(1) |
| A text about a client's order | Texting app | Archive, through the app's connector | 204-2(a)(7); 17a-4(b)(4) |
| A written financial plan | Planning software | Client file in the CRM, copy in the archive | 204-2(a)(7)(i) |
| A website page or marketing email | Website platform | A copy of each advertisement | 204-2(a)(11), (e)(3)(i) |
| A performance figure in an ad | Portfolio accounting | The working papers behind it | 204-2(a)(16), (e)(3)(i) |
| Policies and the annual review | Compliance suite | The suite, with a copy outside it | 204-2(a)(17); 206(4)-7(b) |
17 CFR 275.204-2(e)(1), (e)(3)(i); 17 CFR 240.17a-4(b)(4)
The adviser rule does not ask for WORM storage: it asks that electronic records be indexed, produced promptly in the format they are stored in, safeguarded from loss, alteration or destruction, and kept with a separately stored duplicate. The retention calculator turns those periods into dates for your fiscal year, and the archiving requirements matcher lists which channels your archive must capture.
Which layers your firm needs
Not every firm needs all seven layers. A one-adviser RIA that never texts and has a one-page website needs fewer than a broker-dealer whose reps post on LinkedIn. Pick your firm type and what the firm does; the list shows the layers the record rules reach and where to read each one.
5 layers the record rules reach
- 01
CRM
Holds the client file and the written communications an examiner asks for.
204-2(a)(7)
Read here: Wealthbox. Then the CRM comparison.
- 02
Archive
Keeps the duplicate copy of email and every other captured channel, ready to produce.
204-2(g)(2)
Read here: Smarsh. Then the email archiving comparison.
- 03
Compliance program
Written policies, reviewed at least annually, and a code of ethics.
206(4)-7(a)-(b); 204A-1
Read here: Comply. Then the RIA compliance software.
- 04
Texting
Client texts are written communications; the app must capture them and pass them to the archive.
204-2(a)(7)
Read here: MyRepChat. Then the texting comparison.
- 05
Website and marketing
A copy of each advertisement must be kept, and the Marketing Rule decides what it may say.
204-2(a)(11)
Read here: FMG. Then the advertising review comparison.
Where the layers join
A stack keeps records well when each record reaches the archive without a person forwarding it. The table lists the connections each vendor names on its own pages. A link one vendor names may not appear on the other side's page; that is why the table says whose page it is.
Who names whom, on their own pages
| Vendor | Names | Where |
|---|---|---|
| Wealthbox | eMoney, Orion, Comply, MyRepChat, FMG, Lead Pilot | Integrations page |
| Orion | Redtail (its own CRM), Orion Planning, custodians incl. Pershing | Home page |
| Comply | MyRepChat, CellTrust and Redtail Speak texts, captured into its archive | Comply for RIA page |
| MyRepChat | 13 archives incl. Smarsh and Global Relay; CRMs incl. Wealthbox and Redtail; FMG content | Integrations page |
| FMG | MyRepChat, in its own product menu; Twenty Over Ten, whose features are now part of the new FMG | Home pages |
| Smarsh | API integrations; no adviser CRM named | Archive page |
| eMoney Advisor | APIs and aggregation tools; no partner named | Home page |
Read together, the pages trace one full path for a client text: an adviser texts through MyRepChat, MyRepChat hands the message to an archive such as Smarsh, and Wealthbox shows the archived text on the client's record. The gap is email. Wealthbox's integrations page names no email archiver, and the Smarsh pages we read name no adviser CRM, so ask each vendor how client email reaches the archive and whether anyone has to press send.
One platform or one vendor per layer
Orion is the one vendor here that sells most layers itself: its page lists CRM through Redtail, planning, portfolio accounting, trading and compliance, and says a firm can buy one product, the full stack or any mix. Comply covers the compliance and archive layers together. Everyone else on this page sells one layer.
Fewer vendors means fewer contracts to oversee. Under the amended Regulation S-P, a firm's policies must be reasonably designed to make sure each service provider tells it of a breach of customer information as soon as possible, but no later than 72 hours after becoming aware of it, and the duty to notify the clients stays with the firm. A layer that holds client information is likely one of those providers, so count them before you add another. Our Regulation S-P guide covers the rest.
More vendors means each layer can be the strongest of its kind, and leaving one does not mean leaving all. Records outlive contracts: an adviser's five-year period runs from the end of the fiscal year of the last entry, not from the end of a software subscription, so every layer needs an export you have tested, whichever way you buy.
Five questions before you add a layer
- 01Which records will this layer hold, and under which rule: client communications, advertisements, plans, performance backup, program records?
- 02How do its records reach the archive: a named connector that runs on its own, or a person forwarding them?
- 03A sample export of one client's records, opened on your own machine, in the format it is stored in.
- 04The breach-notice clause, measured against the 72-hour notice your Regulation S-P vendor policies must secure.
- 05For a broker-dealer: whether the vendor keeps records on servers it owns and operates, and if so, its written undertaking to the SEC.
Starting a firm from nothing? The guide to starting an RIA puts the software in order with registration, and the RIA compliance checklist lists the records each layer will end up holding.
Each vendor, read against the rule
Wealthbox
CRM layer- What it is
- A CRM made for financial advisers. Its security page says communication history, activity logs and client records stay organized for reviews and audits, that roles decide who may export data, and that changes are tracked in an activity history. Its integrations page lists eMoney, Orion, Comply, MyRepChat (archived texts shown inside the CRM), FMG and Lead Pilot.
- Who it fits
- A solo adviser up to a firm with hundreds of users, by its own account, with audience pages for broker-dealers and RIA aggregators. The firm that wants every other layer to report back into one client record.
- What the rule requires, and whether it meets it
- Keeps the record its layer createsMeetsActivity logs, client history
- A review or approval stepPartialNotetaker keyword flags only
- Sends its records to an archivePartialShows MyRepChat's archived texts
- Export on requestPartialRoles gate export; no format
- Names the other layers it connects toMeetsNames five other picks here
- Says it is built for advisersMeetsSolo advisers to broker-dealers
- Not verified by us
- A sample full-account export and its file format; whether the activity history records deletions; which email archiver it feeds, since none is named on its integrations page.
Orion
Portfolio platform- What it is
- A wealth-tech platform that sells CRM (Redtail, an Orion company since 2022 by its own page), planning, portfolio accounting, trading and compliance as one system. Orion Compliance says every monitored event, alert and remediation is timestamped, and that exam data is kept organized and exportable.
- Who it fits
- Firms from solo advisers to large wealth practices, RIAs and broker-dealers by its own audience list. Its page says a firm can buy one product, the full stack or any mix, so it suits a firm that wants fewer vendors to oversee.
- What the rule requires, and whether it meets it
- Keeps the record its layer createsMeetsTimestamps alerts and fixes
- A review or approval stepPartialAlerts; review evidence not stated
- Sends its records to an archiveNot stated
- Export on requestPartialExam data exportable; no format
- Names the other layers it connects toMeetsRedtail, planning, custodians
- Says it is built for advisersMeetsRIAs and broker-dealers
- Not verified by us
- Which archive receives client email and texts (none is named on the pages read); the export format for compliance and portfolio records; what a review entry records in Orion Compliance.
Comply
Compliance suite- What it is
- Compliance software and services from Comply Technologies. Its RIA product, Comply for RIA (formerly RIA in a Box), drafts the code of ethics and policies, runs an annual review workflow aligned with Rule 206(4)-7, files Form ADV, and archives email, websites, iMessage and WhatsApp texts, LinkedIn and X posts in a WORM-compliant format by its page. Its second line, Comply Platform (formerly ComplySci), serves RIAs, broker-dealers, private funds and others.
- Who it fits
- A small SEC- or state-registered RIA that wants the program records and the message archive from one vendor. Its archive also captures texts sent through MyRepChat, CellTrust and Redtail Speak, so a firm already on one of those keeps its texting app.
- What the rule requires, and whether it meets it
- Keeps the record its layer createsMeetsPolicies, ethics, annual review
- A review or approval stepMeets206(4)-7 annual review workflow
- Sends its records to an archiveMeetsIts own WORM-format archive
- Export on requestPartialReports export; archive not said
- Names the other layers it connects toMeetsTakes MyRepChat, Redtail Speak
- Says it is built for advisersMeetsPurpose-built for RIAs
- Not verified by us
- A sample export from the archive (not only the annual-review report) and its format; the retention settings per channel; for a broker-dealer, who signs the 17a-4 undertaking.
eMoney Advisor
Planning layer- What it is
- Financial planning software with a client portal that gives clients round-the-clock access to updates and documents. Its home page offers a free trial and, for enterprise firms, APIs and aggregation tools.
- Who it fits
- Banks, broker-dealers and RIAs of all sizes, by its own page. A plan you send a client is written advice, so the firm decides where the copy is kept; the home page does not address it.
- What the rule requires, and whether it meets it
- Keeps the record its layer createsNot statedPortal documents; no retention
- A review or approval stepNot stated
- Sends its records to an archiveNot stated
- Export on requestNot stated
- Names the other layers it connects toPartialAPIs; no partner named
- Says it is built for advisersMeetsBanks, broker-dealers, RIAs
- Not verified by us
- How long plans and portal documents are kept after a client leaves; a sample export of a client file and its format; whether plans can be sent to the firm's archive or CRM automatically.
FMG
Website and marketing- What it is
- Websites, email and social marketing for advisers. Its One-Click Compliance feature sends every website update or new email to the compliance department's inbox, and the content goes live when compliance approves it; a dashboard shows status and lets you pull history. Its content library is described as FINRA-reviewed.
- Who it fits
- Financial professionals and RIAs, independent broker-dealers, large RIAs and banks, by its own audience menu. A firm whose marketing must be approved before it goes out. FMG acquired Twenty Over Ten in 2020, by Twenty Over Ten's own page.
- What the rule requires, and whether it meets it
- Keeps the record its layer createsPartialApproval history; contents unsaid
- A review or approval stepMeetsEdits route to compliance
- Sends its records to an archiveNot statedNo archiving vendor named
- Export on requestNot stated
- Names the other layers it connects toPartialLists MyRepChat in its menu
- Says it is built for advisersMeetsRIAs, independent broker-dealers
- Not verified by us
- Whether the approval history records the approver's name and date (the FINRA retail-communication record asks for both); how a copy of each page and email is kept for five years; which archive, if any, receives it.
MyRepChat
Texting layer- What it is
- A texting app for advisers that captures and stores all adviser-client texts, raises customizable alerts, and sends messages on to the firm's archive. Its integrations page names 13 archives, Smarsh and Global Relay among them, and CRMs including Wealthbox and Redtail. FMG lists it in its own product menu.
- Who it fits
- An adviser who texts clients and wants those texts in the archive and the CRM without a second phone. Its own storage mode is not stated, so the archive it connects to carries the retention.
- What the rule requires, and whether it meets it
- Keeps the record its layer createsMeetsStores all advisor-client texts
- A review or approval stepPartialAlerts; review steps not stated
- Sends its records to an archiveMeets13 archives named
- Export on requestNot statedThrough the connected archive
- Names the other layers it connects toMeetsWealthbox, Redtail, FMG content
- Says it is built for advisersMeetsTexting for financial advisors
- Not verified by us
- Its channel list (SMS only, or also iMessage and WhatsApp); the export format if the archive link breaks; how its alerts are reviewed and evidenced.
Smarsh
Archive layer- What it is
- A capture, archive and supervision platform covering 100+ channels. Its archive page states immutable WORM storage for SEC 17a-4 and export in PST, EML, HTML, XML and optional EDRM; its 17a-4 page supports both WORM and audit-trail retention and says it provides letters of undertaking.
- Who it fits
- RIAs and broker-dealers, with a tier for small firms setting up communications compliance. The archive layer most others on this page connect to by name: MyRepChat lists it.
- What the rule requires, and whether it meets it
- Keeps the record its layer createsMeets100+ channels
- A review or approval stepPartialReview evidence not stated
- Sends its records to an archiveMeetsIt is the archive
- Export on requestMeetsPST, EML, HTML, XML, EDRM
- Names the other layers it connects toPartialAPIs; no adviser CRM named
- Says it is built for advisersMeetsRIAs, BDs, a small-firm tier
- Not verified by us
- Which CRMs it connects to directly (none named on the pages read); what its review records hold (reviewer, date, action); the undertaking letter itself for a broker-dealer.
How we read these vendors
Questions firms ask
What software does a new RIA need first?
Three layers carry most of the record rules from day one: a CRM for the client file, an archive for the written communications on advice, orders and money movement, and a place for the written compliance policies the firm must adopt and implement. Texting, planning, portfolio and website tools join as the firm starts doing those things.
17 CFR 275.204-2(a)(7); 17 CFR 275.206(4)-7(a)
Does every layer need WORM storage?
Not for an adviser: 204-2(g) asks for indexing, prompt production, safeguards against loss, alteration and destruction, and a separately stored duplicate, with no WORM requirement. A broker-dealer's electronic records must be kept either with a complete time-stamped audit trail or in a non-rewriteable, non-erasable format.
17 CFR 275.204-2(g); 17 CFR 240.17a-4(f)(2)(i)(A)-(B)
Is our website a record?
An adviser keeps a copy of each advertisement it disseminates, for not less than five years from the end of the fiscal year it was last disseminated, the first two in an appropriate office. At a broker-dealer, a registered principal approves each retail communication before the earlier of its use or its filing with FINRA.
17 CFR 275.204-2(a)(11), (e)(3)(i); FINRA Rule 2210(b)(1)(A)
Is any adviser software SEC-approved or FINRA-approved?
Not under any rule we read: the record rules bind the firm, not its vendors. FINRA retired its Compliance Vendor Directory effective March 19, 2024, so a vendor listing there is no longer a test either. Read what each vendor states on its own pages, and ask for the documents named on its card.
FINRA Compliance Vendor Directory, retired 2024-03-19
How long do we keep records after we leave a vendor?
The period belongs to the record, not the contract. An adviser keeps most records for not less than five years from the end of the fiscal year of the last entry, the first two in an appropriate office; a broker-dealer keeps its communications for not less than three years, the first two in an easily accessible place. Export before you cancel.
17 CFR 275.204-2(e)(1); 17 CFR 240.17a-4(b)(4)