SEC & FINRA SMS Archiving Compliance: A Guide for Financial Services (and GoHighLevel Users)

What the SEC & FINRA require for SMS

Text messages sent or received in the course of business by a registered firm are "business communications" under federal securities law. Three rules drive the requirements:

• SEC Rule 17a-4(b)(4) — broker-dealers must preserve originals of all communications relating to their business for at least 3 years (first 2 years in an easily accessible place).
• SEC Rule 17a-4(f) — electronic records (including SMS) must be stored in a non-rewriteable, non-erasable (WORM) format, time-stamped, indexed, and producible on demand.
• FINRA Rule 4511 — extends the same recordkeeping standard to FINRA members, with a default 6-year retention for many record types.
• FINRA Rule 2210 — content standards for retail communications, including SMS marketing.
• Investment Advisers Act Rule 204-2 — RIAs must retain client communications for at least 5 years.

In 2022–2024 the SEC fined more than 60 firms a combined $2.6 billion+ for off-channel communications failures, the bulk tied to unarchived text messages. Enforcement is active and trending up.

Who is covered

These requirements apply to:

• SEC-registered broker-dealers and their representatives
• FINRA member firms (associated persons included)
• Registered investment advisers (RIAs) under the Advisers Act
• Insurance and annuity representatives selling securities products
• Bank-affiliated wealth and trust units handling securities business

If a representative texts a client about an account, a trade, a product recommendation, or anything that "relates to the business of such member," the message is in scope — regardless of which phone or app sent it.

Audit trail requirements

An SEC/FINRA-grade SMS audit trail must capture, at minimum:

• Full message content (inbound and outbound), including media
• Sender and recipient identifiers — phone number, associated person, client account
• Trusted, immutable timestamps synced to a reliable time source
• Delivery/read status where available from the carrier
• Tamper-evident storage — typically a cryptographic hash chain or WORM media, with an independent audit log of access events
• Indexed, searchable retrieval so the firm can produce specific messages within the SEC's "promptly producible" window

The record must survive a representative leaving the firm, switching devices, or deleting messages locally. That is why personal-device SMS without an enterprise archive is the failure mode regulators keep fining.

Proof-of-consent obligations

Archiving solves SEC/FINRA recordkeeping. Sending the SMS legally is a separate stack:

• TCPA + 10DLC require prior express written consent for marketing SMS, with the consent record retained for at least 4 years (TCPA statute of limitations).
• CTIA messaging principles require a CTIA-compliant disclosure ("Msg & data rates may apply. Reply STOP to opt out…") at the point of opt-in.
• State mini-TCPA laws (FL, WA, OK, MD) add stricter consent or quiet-hours rules.

For a financial firm, that means you must retain two coupled records per recipient:

1. The opt-in evidence — form snapshot, IP, user agent, timestamp, the exact disclosure shown, and ideally a session replay or hashed certificate.
2. The message archive — every business SMS sent to that number afterwards, in WORM format.

If a client later disputes a message, you need both: proof they consented, and the verbatim content of what you sent.

Archiving GoHighLevel SMS for SEC/FINRA compliance

GoHighLevel is the most common SMS platform among financial-services agencies and independent advisers, but GHL's native conversation history is not an SEC-grade archive. It is editable, deletable by sub-account users, and not stored in WORM format.

To make GHL workflows defensible:

1. Export SMS to a WORM archive in real time. Use GHL's outbound webhooks on `InboundMessage` and `OutboundMessage` events to stream every SMS to a compliant archive (Smarsh, Global Relay, Proofpoint, MirrorWeb, or a self-hosted S3 bucket with Object Lock).
2. Capture proof-of-consent at opt-in. Replace GHL's default opt-in form with a court-admissible consent capture (OptInFix or equivalent) that records IP, user agent, the exact CTIA disclosure shown, and a SHA-256 hash of the submission. Store the hash and a downloadable certificate.
3. Hash-chain the archive. Each archived message should reference the hash of the prior message, so any deletion or reordering is detectable.
4. Restrict deletion permissions at the sub-account level — only a compliance role can purge records, and purges are logged.
5. Document the workflow in your written supervisory procedures (WSPs) so an examiner can see how SMS flows from GHL to the archive.

This pattern — GHL for sending, an external WORM archive for retention, and a dedicated consent platform for opt-in evidence — is what passes an SEC sweep.

Implementation checklist

Use this as a starting checklist for SEC/FINRA-grade SMS on GoHighLevel:

• 10DLC brand + campaign registered to the correct legal entity
• Opt-in form captures IP, user agent, timestamp, disclosure version, and a tamper-evident hash
• CTIA-compliant SMS disclosure shown at opt-in and on the first message
• GHL webhooks streaming every inbound/outbound SMS to a WORM archive
• Retention configured for at least 6 years (broker-dealer) or 5 years (RIA)
• Hash-chain or WORM Object Lock protecting the archive
• Suppression list synced when a recipient texts STOP
• Quarterly compliance review documented in WSPs
• Designated principal able to retrieve any message within the SEC's prompt-production window

Frequently asked questions