Electronic Recordkeeping by Investment Companies and Investment Advisers

September 24, 2003

The Investment Company Act of 1940 (the “Investment Company Act”) and the Investment Advisers Act of 1940 (the “Advisers Act”) require mutual funds and other registered investment companies (“investment companies”), registered investment advisers (“RIAs”), and others to make and keep certain books and records. The Electronic Signatures in Global and National Commerce Act (the “Electronic Signatures Act”) encourages federal agencies to accommodate electronic recordkeeping. The Securities and Exchange Commission (“SEC”) permits both investment companies and RIAs to maintain and preserve required records using electronic storage media such as magnetic disks, tape, and other digital storage media (“electronic storage media”).

Background

Congress passed the Electronic Signatures Act in 2000 to facilitate the use of electronic records and signatures in interstate and foreign commerce. Under the Electronic Signatures Act, an agency’s recordkeeping requirements may be met by retaining electronic records that accurately reflect the information set forth in the record, and remain accessible to all persons who are entitled to access, in a format that can be accurately reproduced.  Consistent with the purposes and goals of the Electronic Signatures Act, in 2001 the SEC adopted amendments to Rule 31a-2 under the Investment Company Act and Rule 204-2 under the Advisers Act that expand the circumstances under which investment companies and RIAs may keep records on electronic storage media, and that clarify recordkeeping rules. 

The amended Rules did not impose requirements in addition to those imposed by the Electronic Signatures Act and did not require a new collection of information.  They affected only the manner in which registrants can store information that must be collected under Rules 31a-2 and 204-2.  The Electronic Signatures Act requires electronic records to be stored in a manner that ensures that they are accurate, accessible and capable of being accurately reproduced for later reference. This includes any records, maintained in an electronic format, that are required by any rule under the Investment Company Act or Advisers Act.

Since amended Rules 31a-2 and 204-2 became effective on May 31, 2001, compliance with the amended Rules has been the exclusive means by which investment companies and RIAs can comply with the recordkeeping provisions of the Electronic Signatures Act.

Electronic Recordkeeping Requirements

Prior to the amendments to Rules 31a-2 and 204-2, they provided that investment companies and RIAs could keep records on electronic storage media only if the records were originally created or received in an electronic format. The amendments for the first time allowed investment companies and RIAs to store all of their required records electronically, regardless of how the documents originated or were received. 

Rules 31a-2 and 204-2 and the other recordkeeping requirements under the Investment Company or Advisers Acts subject electronic records to conditions that are substantially equivalent to conditions under which investment companies and RIAs keep paper and micrographic records.  However, investment companies and RIAs that maintain records in an electronic format must also comply with several requirements that have no micrographic or paper equivalent.  Under the current version of the Rules, if investment companies and RIAs opt to maintain records electronically, they may do so only if they establish and maintain procedures:

1.  to preserve and safeguard the electronic records from loss, alteration, or destruction,

2.  to limit access to the records to authorized personnel, the SEC, and (in the case of investment companies) the board of directors,

3.  to ensure that electronic copies of non-electronic originals are complete, true, and legible,

4.  to arrange and index the records in a way that permits easy location, access, and retrieval of any particular record, and

5.  to separately store, for the time required for preservation of the original record, a duplicate copy of the record on micrographic media (including microfilm, microfiche or any similar medium) or electronic storage media.

The Rules apply to all records that are required to be maintained and preserved by any rule under the Investment Company or Advisers Acts.  As a result, if investment companies and RIAs keep records electronically, they must comply with the amended Rules.  These additional requirements are necessary because of the unique vulnerability of unprotected electronic records to undetectable alteration and falsification.

The Rules 31a-2 and 204-2 have been deliberately crafted to be technologically neutral, leaving investment companies and RIAs free to adopt any combination of technological and manual protocols that meet the requirements of the Rules.  Investment companies and RIAs that establish procedures to assure record soundness have the option of maintaining their electronic records in the format most suited to their business needs. The Rules’ standards are flexible, and permit investment companies and RIAs to modify their electronic record retention practices to take advantage of advances in electronic storage technology.

However, the electronic storage media that investment companies and RIAs use should meet certain minimum standards to be considered an acceptable method of storage under the Rules.  The Rules would not be violated if an electronic storage system was employed that prevents the overwriting, erasing or otherwise altering of a record during its required retention period through the use, for example, of WORM (write once, read many) technology or integrated hardware and software control codes. 

Conversely, electronic storage systems that only mitigate the risk of records being overwritten or erased will not suffice to meet the requirements of the Rules.  For example, systems that utilize software applications to protect electronic records through the use of authentication and approval policies, fingerprints that simply indicate whether a record was changed but do not preserve the original record, passwords or other extrinsic security controls, do not maintain records in a manner that is non-rewriteable and non-erasable.  The ability to change or delete records stored on these types of systems makes the systems non-compliant with the Rules.

Another necessary minimum requirement for electronic storage media under the Rules is an audit system which provides for accountability concerning the inputting of records into the storage system.  The audit procedures for a storage system using integrated software and hardware codes to preserve records against erasure, overwriting or alteration should provide for accountability regarding the length of time records are stored in a non-rewriteable and non-erasable manner.  This should include senior management level approval of how the storage system is configured to store records for their required retention periods in a non-rewriteable and non-erasable manner.  The storage system should be configured so that records input without an expiration date or a retention period, by default, would be assigned a permanent retention period.  Furthermore, the system must ensure that records are not deleted during periods when the regulatory retention period has lapsed but other legal requirements, such as the receipt of a subpoena for the records, mandate that the records continue to be maintained beyond the statutory retention periods.

Email Retention Policy

Email communications are among the books and records that mutual funds and other investment companies and RIAs are required to keep under Rules 31a-2 and 204-2 of the Investment Company Act and the Investment Advisers Act.  The types of emails required to be maintained by SEC Rules 31a-2 and 204-2 are, for example, the following:

1.  originals of correspondence received from and copies of correspondence sent to clients relating to advice given, disbursement of investment companies or securities, or placements or execution of orders;

2.  copies of all written agreements with clients or otherwise relating to your business;

3.  copies of publications distributed to ten or more persons, and memoranda indicating the reasons for any recommendations made in the publication if not already stated;

Rule 204-2 also mandates that RIAs must have in place procedures to ensure compliance with recordkeeping requirements.  RIAs are required to maintain and preserve each of the above communications and documents in an easily accessible place for a period of five (5) years. During the first two (2) years of that period the records are required to be available in an appropriate office of the RIA. In the case of the information described in sub-paragraphs 1 and 2, above, the two and five year periods begin to run from the end of the fiscal year “during which the last entry was made on such record” (i.e., from the end of the fiscal year during which such communication was delivered or such agreement was entered into). In the case of the information described in sub-paragraph 3 the periods begin to run from the end of the fiscal year when such communication or document was last was used, published or circulated. 

The same principles apply to information required to be maintained by investment companies under the Investment Company Act and SEC Rule 31a-2 except that the retention period is generally six (6) years rather than five. Accordingly, for RIAs that are not a majority-owned subsidiary of an investment company, the retention period is extended to six (6) years for records pertaining to the RIA’s transactions with such an investment company.

To the extent that any of the records required to be maintained by Rule 204-2 or Rule 31a-2 are contained in emails, investment companies and RIAs have the choice of preserving them in paper form or in electronic form.  With respect to any records RIAs and investment companies decide to preserve in electronic form, the RIAs and investment companies are responsible for establishing, maintaining, and enforcing a supervisory system and procedures to assure compliance with the applicable Rules.  These systems and procedures should include all of the requirements and procedures for maintaining records electronically as detailed prior in the “Electronic Recordkeeping Requirements” section of this Advisory.

In addition, an investment company’s and RIA’s email retention policy should include a system to maintain emails and to preserve backup copies of the original emails on tape or other storage media in an organized fashion.  A critical element is assurance that original email communications and the backup copies not be overwritten, discarded, or recycled within the retention period and that they not be kept in an unorganized or haphazard manner.

Relying on employees to preserve copies of their email communications on their own individual personal computer hard drives is an example of an inadequate measure, unless there are systems and procedures in place to ensure that employees do so.  Furthermore, email communications preserved in this manner should not be erased during the retention period, even when employees leave the company.

Requirements For Providing Copies to the SEC Upon Request

The amendments make clear that, with regard to the obligation of investment companies and RIAs to provide copies of their records to SEC examiners, investment companies and RIAs may be requested to promptly provide:

1.  legible, true, and complete copies of records in the medium and format in which they are stored,

2.  legible, true, and complete printouts of such records, and

3.  means to access, view, and print the records.

Although the “promptly” standard imposes no specific time limit, an investment company or RIA is expected to perform its obligations in good faith and is required to furnish records immediately or within a few hours of request.  An investment company or RIA would be permitted to delay furnishing electronically stored records for more than 24 hours only in unusual circumstances.

For additional information on this topic, you may contact Howard A. Neuman or Carol Spawn Desmond.