Nobody chooses a CRM for its recordkeeping. But the CRM is where client communications, meeting notes, and instructions end up, which makes it a books-and-records system whether the vendor calls it one or not.
This isn't legal advice. It's the set of questions we'd want answered before trusting any system with the records an examiner might ask for.
Which records are we talking about?
For an RIA, Advisers Act Rule 204-2 covers written communications received and sent relating to advice, orders, and receipt or delivery of funds. For broker-dealers, SEC 17a-4 goes further on format and retention. In practice, that means emails, texts, meeting notes, and the task history that shows what you did about them.
How long?
Five years is the common floor, with the first two in an easily accessible place. Some states and some firm policies go longer. The point isn't the exact number; it's that the system needs to let you set it and then honor it.
The questions to ask a vendor
Can records be altered after the fact? Edits are fine. Silent edits are not. You want an original, an edited version, and a log of who changed what and when.
What happens when a user deletes something? "It's gone" is the wrong answer during a retention period. Look for soft deletion with an audit entry.
Can we export everything? In a format someone else can open, without a professional services engagement. Ask for a sample export before you sign.
Where do meeting notes live? If the notetaker is a separate product with separate retention, you now have two records systems and one exam. Notes belong on the client record.
Who at the vendor can see our data? The answer should be short, specific, and logged.
How OmegaFP approaches this
Every record in OmegaFP carries an audit trail, deletions are recoverable during the retention window, and exports are self-service. Meeting notes are stored on the household alongside everything else. The full list of controls, including the ones we're still getting independently audited, is on the Security and Compliance page.
Bring your compliance officer to the demo. They'll have better questions than we've listed here, and we'd rather answer them now.
