Skip to content
AdviserDeck
Menu

Off-channel communications policy builder

Pick your firm type, the channels you approve and how each is captured, then your device rules and how often messages are reviewed and staff attest. The builder writes an off-channel communications policy section you can edit, print and copy into your manual, with the rule behind every clause cited and every other clause left to your firm’s choice.

Off-channel policy builder: the tool

Pre-filled with an example: a three-person adviser whose advisers text clients from their own phones through a firm texting app. Change any answer and the policy below rewrites itself.

The firm

Advisers and broker-dealers keep and review messages under different rules; a dual registrant gets both.

Channels

Approved for business messages, and how each is captured

Other approved channels

Not approved for business messages

  1. 01
  2. 02
  3. 03

Devices, review and attestation

How often captured messages are reviewed. The firm sets this.

How often each person confirms in writing that they kept to the policy.

Firm-specific procedures

  1. 01

Approved for business messages

3 channels

3 channels and apps named as not approved. 9 of 26 clauses restate a rule, each with its citation; the other 17 are the firm’s own choices.

17 CFR 275.204-2(a)(7)

Electronic communications policy

Example Advisers LLC, effective November 2, 2026

Draft policy

Clauses with a citation restate a rule; clauses without one are choices the firm makes.

  1. 01Purpose and scope

    This policy sets out how Example Advisers LLC approves, captures, reviews and keeps electronic communications about its business. It applies to every supervised person and to every business message, on any device.

    The firm keeps the originals of written communications it receives, and copies of those it sends, that relate to any recommendation or advice, any receipt, disbursement or delivery of funds or securities, the placing or execution of any order to buy or sell a security, and the performance or rate of return of managed accounts, portfolios or securities recommendations.

    17 CFR 275.204-2(a)(7)

    This policy is one of the written policies and procedures the firm adopts and implements under the compliance program rule.

    17 CFR 275.206(4)-7(a)

    The Chief Compliance Officer administers this policy.

    17 CFR 275.206(4)-7(c)

  2. 02Approved channels

    Business communications are sent and received only on the channels listed here, each captured as stated. A channel not on this list is not approved for business communications.

    • Email on the firm’s domain: captured by journaling or a connector into the firm’s archive.
    • Text messages (SMS and MMS): sent and received only through a firm-approved app that copies every message to the firm’s archive.
    • Microsoft Teams chat: captured by journaling or a connector into the firm’s archive.

    A channel is added only after the Chief Compliance Officer confirms that its messages, sent and received, reach the firm’s archive in full, and records the date of that check.

  3. 03Channels and settings that are not approved

    These are not approved for business communications, whoever starts the conversation:

    • The phone’s own texting app and iMessage on any device
    • Personal email accounts
    • WhatsApp, Signal, Telegram and WeChat on personal accounts

    No one turns on disappearing or auto-delete settings for business messages, or deletes a business message before the firm has captured it.

  4. 04Business messages that arrive on an unapproved channel

    The record rule covers messages the firm receives as well as messages it sends.

    17 CFR 275.204-2(a)(7)

    When a business message arrives on an unapproved channel, the person who gets it does not answer there. They move the conversation to an approved channel, preserve the message in the firm’s archive with its date, time and sender by the end of the next business day, and tell the Chief Compliance Officer.

    The Chief Compliance Officer keeps a log of these reports and looks for repeats by the same person or the same client.

  5. 05Devices

    Personal devices may carry business messages only through the approved channels in section 2, inside the firm’s app or account; never through the device’s own texting app, iMessage or a personal messaging account.

    A person who uses a personal device for business agrees in writing to produce, at the firm’s request, any business message found on it.

    Before a device is replaced, wiped or returned, and when a person leaves the firm, the Chief Compliance Officer confirms that the business messages on it were captured.

    Electronic records are safeguarded from loss, alteration or destruction, and access to them is limited to properly authorized personnel and the Commission.

    17 CFR 275.204-2(g)

  6. 06Supervision and review

    The Chief Compliance Officer, or a designee, reviews a sample of captured messages each week and records who reviewed which messages, on what date, and what was done.

    Reviews also look for signs of off-channel use: a client mentioning a text the archive does not hold, a gap in someone’s message history, or a conversation that moves off an approved channel.

  7. 07Retention and storage

    Communications records are kept in an easily accessible place for not less than five years from the end of the fiscal year during which the last entry was made, the first two years in an appropriate office of the firm.

    17 CFR 275.204-2(e)(1)

    Electronic records are arranged and indexed so that any record can be found and retrieved easily, and a duplicate copy of each is stored separately for the full retention period.

    17 CFR 275.204-2(g)

  8. 08Producing records on request

    The firm can promptly provide a legible, true and complete copy of a record in the medium and format in which it is stored, and the means to access, view and print it.

    17 CFR 275.204-2(g)

    At least once a year the Chief Compliance Officer retrieves one person’s messages for a set period as a test, and notes how long the retrieval took.

  9. 09Training and attestation

    Every supervised person receives this policy on joining and whenever it changes, and confirms in writing each calendar quarter that they used only approved channels for business communications and preserved any business message that arrived elsewhere.

    A person who cannot give that confirmation tells the Chief Compliance Officer, who records what happened and what was done about it.

  10. 10Review and updates

    The firm reviews, no less frequently than annually, the adequacy of this policy and the effectiveness of its implementation, and keeps the records documenting that review.

    17 CFR 275.206(4)-7(b); 17 CFR 275.204-2(a)(17)(ii)

    A new messaging app, a change of archive provider or a new kind of device is reviewed under this policy before anyone uses it.

  11. 11Firm-specific procedures

    The firm also follows these procedures:

    • Advisers add a line to their email signature naming the firm’s approved texting number.

This policy is a draft built from the rule text. Adopting it does not by itself make the firm compliant; what counts is how the firm carries it out. Have your compliance counsel review it before the firm adopts it.

The record and review rules

  • Adviser messages on advice, funds, orders, performancerecords
    17 CFR 275.204-2(a)(7)
  • Advisers keep them for5 years
    17 CFR 275.204-2(e)(1)
  • Of which in an appropriate office of the adviserfirst 2
    17 CFR 275.204-2(e)(1)
  • Broker-dealer messages relating to the business as suchrecords
    17 CFR 240.17a-4(b)(4)
  • Broker-dealers keep them for3 years
    17 CFR 240.17a-4(b)
  • Of which in an easily accessible placefirst 2
    17 CFR 240.17a-4(b)
  • Broker-dealer review by a registered principalin writing
    FINRA Rule 3110(b)(4)
  • Adviser review of its policiesannually
    17 CFR 275.206(4)-7(b)
Rule text from the eCFR (as of October 20, 2026) and FINRA’s rulebook, read October 22, 2026. None of these rules names a cadence for message review or staff attestations; the firm sets both.
Stipple engraving of a desk telephone sitting on a closed ring binder beside a pen
Card 01
A policy names the channels the firm can capture and keeps every other one off the desk.

What it builds

An electronic communications policy template that writes itself from your answers: which channels the firm approves, how each one is captured, whose phones carry business messages, how often messages are reviewed and how often each person attests. What comes out is a numbered policy section to print, copy into your compliance manual and edit there. Every clause that restates a rule carries its citation; every clause without one is a choice your firm makes and can change.

  • Advisers keep written communications on four subjects: advice, funds and securities, orders, performance
    17 CFR 275.204-2(a)(7)
  • Broker-dealers keep all communications relating to the business as such, internal ones included
    17 CFR 240.17a-4(b)(4)
  • At a broker-dealer a registered principal reviews them, evidenced in writing
    FINRA Rule 3110(b)(4)

The firm type changes the policy more than any other answer. An adviser’s record rule covers written communications on the four subjects it lists, which is narrower than a broker-dealer’s “all communications … relating to its business as such.” The broker-dealer side also brings a review duty with its own evidence rules, which the guide to FINRA Rule 3110 walks through. For a stand-alone adviser the builder writes message review as a firm choice, because none of the adviser rules quoted here names one.

The guide to off-channel communications reads those cases for a small firm. If a channel you want to approve has no capture yet, the comparisons of FINRA-compliant texting, text message archiving software and WhatsApp and iMessage archiving read each vendor against these rules. Approve the channel in the builder only once its messages reach your archive.

Worked example

The builder opens on a three-person adviser, Example Advisers LLC. It approves email on its own domain, texting through a firm app that archives every message, and Microsoft Teams chat. Advisers may use their own phones, but only inside the firm’s app. Messages are reviewed each week and everyone attests each quarter. The policy comes out in eleven sections and 26 clauses, nine of them citing a rule. The firm-specific list holds one example procedure.

Now switch the firm type and nothing else. The table shows what each switch rewrites; the channel, device and cadence clauses stay as the firm chose them.

One firm, three registrations

What the generated policy says for an adviser, a broker-dealer and a dual registrant
Policy partAdviserBroker-dealerDual registrant
Which messages are recordsWritten communications on four subjects, 204-2(a)(7)All communications relating to the business as such, 17a-4(b)(4)Both clauses
Who reviews themThe policy owner or a designee (a firm choice)A registered principal, evidenced in writing, 3110(b)(4)The broker-dealer clauses
How long5 years from fiscal year end, first 2 in an appropriate office, 204-2(e)(1)3 years, first 2 easily accessible, 17a-4(b)Each under its own rule, with 204-2(h)(1)
How they are storedIndexed, a duplicate kept, safeguarded, 204-2(g)Audit trail or non-rewriteable, non-erasable, 17a-4(f)(2)(i); an outside archive files an undertaking, 17a-4(i)Both
Keeping the policy currentReviewed at least annually, 206(4)-7(b)Amended promptly, 3110(b)(7)Both
Clauses citing a rule, of all clauses9 of 2613 of 3022 of 39

17 CFR 275.204-2(a)(7), (e)(1), (g), (h)(1); 17 CFR 275.206(4)-7(b); 17 CFR 240.17a-4(b), (f), (i); FINRA Rule 3110(b)(4), (b)(7)

Ticking LinkedIn adds clauses of its own. For an adviser it adds one: a post that is an advertisement is kept as a copy of an advertisement the firm disseminates (204-2(a)(11)). For a broker-dealer it adds two: a message to 25 or fewer retail investors within 30 calendar days is correspondence (2210(a)(2)), and a post that is a retail communication needs a registered principal’s approval before use unless an exception applies (2210(b)(1)).

The rule text

The policy turns on three sentences: the two record rules that make a message a record, and the review rule that binds broker-dealers.

Neither record rule names a channel. A text, an iMessage or a WhatsApp message on one of these subjects is a record like an email, and a message received counts as much as one sent. How the record is stored differs by firm: Rule 204-2(g) sets an adviser’s conditions (indexing, a duplicate copy, safeguards) and contains no audit-trail or non-rewriteable requirement; that requirement is Rule 17a-4(f), and it binds broker-dealers. The tool is a reading of the rule text, not legal advice: have your compliance counsel review the policy before your firm adopts it.

Where each clause comes from

Every rule the policy cites, with its own words and the sections that use it. Open a row to read it. The full text is on the eCFR for Rule 204-2 and Rule 17a-4, and in FINRA’s rulebook for Rule 3110.

Investment advisers: Rules 204-2 and 206(4)-7

Which adviser messages are records

“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security; …”

Used in sections 1 and 4 of the policy, for advisers and dual registrants.

17 CFR 275.204-2(a)(7)

Adviser advertisements, LinkedIn posts included

“Advertisement (as defined in § 275.206(4)-1(e)(1) of this chapter) that the investment adviser disseminates, directly or indirectly”

Used in section 2 of the policy, for advisers and dual registrants.

17 CFR 275.204-2(a)(11)

Why an adviser writes this policy down

“Adopt and implement written policies and procedures reasonably designed to prevent violation, by you and your supervised persons, of the Act and the rules that the Commission has adopted under the Act”

Used in section 1 of the policy, for advisers and dual registrants.

17 CFR 275.206(4)-7(a)

Who owns the policy at an adviser

“Designate an individual (who is a supervised person) responsible for administering the policies and procedures that you adopt under paragraph (a) of this section.”

Used in section 1 of the policy, for advisers and dual registrants.

17 CFR 275.206(4)-7(c)

The adviser’s annual review

“Review, no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation”

Used in section 10 of the policy, for advisers and dual registrants.

17 CFR 275.206(4)-7(b)

Keeping the annual review on file

“Any records documenting the investment adviser’s annual review of those policies and procedures conducted pursuant to § 275.206(4)-7(b)”

Used in section 10 of the policy, for advisers and dual registrants.

17 CFR 275.204-2(a)(17)(ii)

How long an adviser keeps messages

“shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.”

Used in section 7 of the policy, for advisers and dual registrants.

17 CFR 275.204-2(e)(1)

How an adviser stores and produces electronic records

“Arrange and index the records in a way that permits easy location, access, and retrieval of any particular record”

“Separately store, for the time required for preservation of the original record, a duplicate copy of the record”

“To maintain and preserve the records, so as to reasonably safeguard them from loss, alteration, or destruction”

“To limit access to the records to properly authorized personnel and the Commission”

Used in sections 5, 7 and 8 of the policy, for advisers and dual registrants.

17 CFR 275.204-2(g)

Broker-dealers: Rule 17a-4 and FINRA Rules 3110 and 2210

Which broker-dealer messages are records

“Originals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer (including inter-office memoranda and communications) relating to its business as such, …”

Used in sections 1 and 4 of the policy, for broker-dealers and dual registrants.

17 CFR 240.17a-4(b)(4)

How long a broker-dealer keeps messages

“for a period of not less than three years, the first two years in an easily accessible place”

Used in section 7 of the policy, for broker-dealers and dual registrants.

17 CFR 240.17a-4(b)

How a broker-dealer’s archive must hold records

“Preserve a record for the duration of its applicable retention period in a manner that maintains a complete time-stamped audit trail that includes: (1) All modifications to and deletions of the record or any part thereof; …”

“Preserve the records exclusively in a non-rewriteable, non-erasable format”

Used in section 7 of the policy, for broker-dealers and dual registrants.

17 CFR 240.17a-4(f)(2)(i)

When an outside archive holds the records

“are the property of the member, broker, or dealer”

“will be surrendered promptly on request”

Used in section 7 of the policy, for broker-dealers and dual registrants.

17 CFR 240.17a-4(i)(1)

Producing broker-dealer records on request

“must furnish promptly to a representative of the Commission legible, true, complete, and current copies of those records”

Used in section 8 of the policy, for broker-dealers and dual registrants.

17 CFR 240.17a-4(j)

Why a broker-dealer writes this policy down

“Each member shall establish, maintain, and enforce written procedures to supervise the types of business in which it engages and the activities of its associated persons that are reasonably designed to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules.”

Used in section 1 of the policy, for broker-dealers and dual registrants.

FINRA Rule 3110(b)(1)

Who reviews broker-dealer messages, and how

“The supervisory procedures must be appropriate for the member’s business, size, structure, and customers.”

“Reviews of correspondence and internal communications must be conducted by a registered principal and must be evidenced in writing, either electronically or on paper.”

Used in section 6 of the policy, for broker-dealers and dual registrants.

FINRA Rule 3110(b)(4)

Reviewing a sample instead of every message

“If a member’s procedures do not require that all correspondence be reviewed before use or distribution, the procedures must provide for …”

Used in section 6 of the policy, for broker-dealers and dual registrants.

FINRA Rule 3110.06

What a review record must show

“The evidence of review required in Rule 3110(b)(4) must be chronicled either electronically or on paper and must clearly identify the reviewer, the internal communication or correspondence that was reviewed, the date of review, and the actions taken by the member as a result of any significant regulatory issues identified during the review. Merely opening a communication is not sufficient review.”

Used in section 6 of the policy, for broker-dealers and dual registrants.

FINRA Rule 3110.07

Keeping correspondence with its reviewer’s name

“The names of the persons who prepared outgoing correspondence and who reviewed the correspondence shall be ascertainable from the retained records”

Used in section 7 of the policy, for broker-dealers and dual registrants.

FINRA Rule 3110.09

Keeping the policy current at a broker-dealer

“Each member shall promptly amend its written supervisory procedures to reflect changes in applicable securities laws or regulations, including FINRA rules, and as changes occur in its supervisory system.”

Used in section 10 of the policy, for broker-dealers and dual registrants.

FINRA Rule 3110(b)(7)

When a LinkedIn message is correspondence

“‘Correspondence’ means any written (including electronic) communication that is distributed or made available to 25 or fewer retail investors within any 30 calendar-day period.”

Used in section 2 of the policy, for broker-dealers and dual registrants.

FINRA Rule 2210(a)(2)

Approving a LinkedIn post before use

“An appropriately qualified registered principal of the member must approve each retail communication before the earlier of its use or filing with FINRA’s Advertising Regulation Department”

“any retail communication that is posted on an online interactive electronic forum”

Used in section 2 of the policy, for broker-dealers and dual registrants.

FINRA Rule 2210(b)(1)(A), (D)(ii)

Dual registrants

Dual registrants: one record for both rules

“which is substantially the same as the book or other record required to be made, kept, maintained and preserved under this section, shall be deemed to be made, kept, maintained and preserved in compliance with this section.”

Used in section 7 of the policy, for dual registrants only.

17 CFR 275.204-2(h)(1)

The periods in section 7 are the same ones the books and records retention calculator turns into dates, and the archiving requirements matcher sorts out which of your channels must be captured at all.

Filed nearby