If your firm is a broker-dealer, the comment thread on a deal task is probably a business record. SEC Rule 17a-4(b)(4) requires the originals of all communications received and copies of all communications sent relating to the business to be kept for three years, the first two in an easily accessible place, and FINRA Rule 4511 sets six years for records with no other specified period and requires the 17a-4 format. Nothing in either rule says 'email only'. The off-channel enforcement wave is usually told as a story about personal phones, but the lesson is broader: any channel your people use for business has to reach the record.
1. What the Enforcement Wave Actually Charged
In August 2024 the SEC announced settlements with 26 broker-dealers and advisers, about $392.75 million in combined civil penalties, for business messages sent through unapproved methods that the firms did not maintain or preserve, and for failing to reasonably supervise the people who sent them. The SEC noted the conduct ran through multiple levels, including supervisors and senior managers. In January 2025 it settled with twelve more firms, among them Blackstone, KKR, Apollo, Carlyle and TPG entities, for $63.1 million combined. Two charges travel together in every one of these cases: the record was not kept, and nobody was supervising the channel.
2. Why a Project Tool Is a Channel
A deal team that discusses an investor's objections in a task comment, or asks a client for a document in a project chat, is communicating about the business. So is an AI agent that drafts and sends a follow-up from the same tool. FINRA's 2026 oversight report lists, among its books-and-records findings, firms not retaining, archiving and reviewing non-email electronic communications conducted through firm-approved channels, and firms not checking whether third-party vendors could meet recordkeeping requirements. Approving a tool does not finish the job; its messages still have to reach the archive.
3. Edits and Deletes Are the Quiet Gap
Rule 17a-4(f) gives an electronic recordkeeping system two options: keep a complete time-stamped audit trail that captures modifications and deletions and can re-create the original, or store records in a non-rewriteable, non-erasable format. Most collaboration tools let a person edit a comment in place or delete it outright. If the archive only receives the final version, or nothing at all, the original is gone. Ask any vendor what happens to the first wording of an edited message.
4. What Kavanah Does About It
Kavanah is not a system of record, and it does not try to replace the archiver your firm already uses. Its job is to get everything there. With compliance mode on, every email sent from Kavanah carries an archive BCC, and a send that cannot carry it is refused. Chat, discussions, task comments, client-portal messages, meeting chat, call transcripts, approvals, attachments and AI-agent conversations are captured by database triggers into an append-only journal, with the previous wording kept on every edit. A daily digest delivers the entries, files attached, to your archive address, each digest hash-chained to the one before it. Only the workspace owner can change the setting, and turning it off is recorded as a critical audit event.
The full buyer's checklist for regulated firms, with a dated comparison of how monday.com, Smartsheet, Asana and Wrike describe their own controls, is on our project management software for financial services page. Your firm remains responsible for its own recordkeeping; the point of the tool is to make the record complete.
