Record Retention for Deceased Client Files — FINRA and SEC Requirements Financial Advisors Must Meet

A firm wraps up an estate transition, distributes the assets, closes the account, and moves on. Three years later, a beneficiary files a FINRA arbitration claim alleging unauthorized transactions during the estate settlement period. The examiner requests the complete file. If the firm can't produce it, the inference is not "records were lost." The inference is "records were destroyed for a reason."

The Regulatory Retention Framework

Two overlapping retention regimes govern how long you keep deceased client records.

SEC Rule 17a-4 sets the baseline for broker-dealers. Account cards, customer agreements, and all records relating to the terms and conditions of an account must be retained for a minimum of six years after that account is closed. The date of death is not a substitute for the account's close date. Written and electronic business communications (emails, internal memos, instant messages) must be preserved for at least three years, with the two most recent years kept in an easily accessible location.

FINRA Rule 3241 adds requirements for situations where a registered representative is named a beneficiary or holds a position of trust for a customer (executor, trustee, or power of attorney holder). The rule specifically requires preserving the written notice and approval for at least three years after the status or position ends or the bequest is received, or for at least three years, whichever is earlier, after the representative's association with the firm ends. Keep related risk assessments under the firm's applicable recordkeeping procedures.

For registered investment advisers, the SEC's books and records rule (Rule 204-2 under the Advisers Act) imposes additional, record-specific retention periods. Its general period is five years, with the first two years in an appropriate office of the adviser.

What the Deceased Client File Should Contain

The retention requirement isn't just about duration — it's about completeness. A defensible deceased client file includes:

• Certified death certificate (the copy your firm received)
• Letters testamentary or letters of administration with court seal
• KYC/CIP verification records for the executor and each beneficiary
• All distribution authorization forms signed by the executor
• Date-of-death valuation reports for every account
• Account freeze/unfreeze documentation with timestamps
• Complete CRM communication log (calls, meetings, emails with the family and estate professionals)
• Copies of any written notices regarding beneficiary designations or positions of trust (Rule 3241)
• Internal compliance memos and decision documentation
• The original investment advisory agreement and any estate advisory agreement

WORM Storage and Audit Trail Requirements

SEC Rule 17a-4 requires that electronic records be stored in a format that prevents alteration or deletion. The standard is Write Once, Read Many (WORM) storage — or a validated audit-trail system that logs modifications and deletions. This means your CRM entries about the deceased client should be locked once created, with any amendments logged as separate entries rather than overwrites.

If your firm uses a cloud-based CRM, verify with your technology vendor that the platform's audit trail meets the SEC's immutability standard. A system that allows advisors to edit or delete prior CRM entries without a visible audit trail creates a regulatory gap that examiners specifically look for.

Conducting a Post-Closure File Audit

Before archiving a deceased client's file, your compliance team should conduct a completeness review. Walk through the timeline from death notification to final distribution and confirm that every material event has a corresponding documentation entry.

Common gaps found during post-closure audits include missing freeze-confirmation timestamps, phone calls documented days after they occurred (weakening their evidentiary value), executor verification records that are incomplete (identity confirmed but no record of the verification method), and distribution requests processed without a written CRM entry explaining the authorization.

The Financial Advisor's Deceased Client Protocol includes a file-closure audit checklist mapped to SEC and FINRA retention requirements, so your compliance team can verify completeness before the file goes to archive.