On May 4, 2026, the North American Securities Administrators Association (NASAA) adopted amendments to its Recordkeeping Requirements for Investment Advisers model rule — Model Rule 203(a)-2. The amendment history printed at the top of the rule now reads: "Adopted September 3, 1987; Amended May 3, 1998, April 18, 2004, September 11, 2005, September 11, 2011, May 15, 2013, May 19, 2019, May 4, 2026." The headline change is that the books-and-records template has been wired to NASAA's modernized advertising rule, so a state-registered adviser's record obligations now track the categories an SEC-registered adviser would recognize from the Marketing Rule: advertisements, testimonials, endorsements, third-party ratings, and performance.
Before you change anything in your firm, read the next paragraph carefully, because it determines whether any of this is binding on you yet.
A Model Rule Is Not a Law
NASAA does not regulate investment advisers. It is an association of state, provincial, and territorial securities regulators, and it has no rulemaking authority of its own. A NASAA model rule is a template — language that each state can adopt as written, adopt with modifications, or decline entirely. The rule text makes this obvious: it carries an explanatory note that italicized passages are "intended for adjustment by a jurisdiction," and it leaves bracketed placeholders such as [Administrator] and [INSERT RULE CITATION] for each state to fill in. In other words, May 4, 2026 is the date NASAA's membership approved the model — not a compliance date for your firm.
What actually binds your firm is your own state's recordkeeping rule. Until your state securities administrator adopts these amendments through its own rulemaking process, your existing obligations are unchanged. The practical takeaway is that the marketing compliance and recordkeeping landscape for state-registered advisers will stay fragmented during the adoption period, with some states moving quickly and others not at all. Advisers in more than one state should track each jurisdiction's progress separately rather than assume the model is in force.
With that caveat established, here is what the amended model rule actually says — because the firms that prepare before their state adopts will have far less to scramble for if and when it does.
The Recordkeeping Rule Now Speaks the Marketing Rule's Language
The most consequential change is structural. The amended model rule repeatedly cross-references definitions in NASAA's model advertising rule, Rule 102(a)(4)-1(m) — the state-level analogue to the SEC Marketing Rule (Rule 206(4)-1). That advertising rule defines "advertisement," "testimonial," "endorsement," and "third-party rating" in terms that mirror the federal framework. By pointing the recordkeeping rule at those same definitions, NASAA has effectively said that the records you keep should map to the way you actually market today: digital, one-to-one, testimonial- and endorsement-driven, and performance-oriented.
That means the records are no longer organized solely around the old categories of correspondence and trade blotters. They now include a dedicated set of advertising records that look a great deal like the ones federally registered advisers have maintained since the SEC Marketing Rule took effect.
The "Intended Audience" Record
The clearest new requirement is subsection (a)(24), which directs an adviser to keep "a record of who the 'intended audience' is for an advertisement under Rule 102(a)(4)-1(m)(4)(vi)." This mirrors the federal concept that an adviser presenting certain performance must be able to show who an advertisement was meant for. If your firm runs performance advertising — or expects to once a marketing rule is in place in your state — this is the kind of record that is easy to create at the moment you publish and nearly impossible to reconstruct after the fact. Consider building the habit of documenting the intended audience for every performance advertisement now, regardless of where your state stands on adoption.
Testimonials, Endorsements, and Promoters
Subsection (a)(15) addresses clients obtained through a promoter who received cash or non-cash compensation. For those relationships, the rule contemplates keeping a record of the disclosures provided to clients or investors, plus documentation substantiating the adviser's "reasonable basis for believing" that a testimonial or endorsement (as defined in Rule 102(a)(4)-1(m)(5)(xix) and (vi)) complies with the advertising rule, and that any third-party rating (defined in Rule 102(a)(4)-1(m)(5)(xx)) complies as well. It also calls for a record of the names of the firm's partners, officers, directors, employees, and controlled persons in connection with these arrangements.
Subsection (a)(11) covers copies of the advertisements themselves. It includes practical carve-outs: for oral advertisements, the adviser may instead retain a copy of any written or recorded materials used; and for compensated oral testimonials and endorsements, the adviser may instead keep a record of the disclosures provided. These are the same kinds of accommodations that make the federal regime workable for firms that market by phone or in person, and they signal that NASAA is trying to align state practice with how advisers actually operate.
Performance Substantiation
Subsection (a)(16) requires the records necessary to "form the basis for or demonstrate the calculation of" the performance or rate of return shown in any advertisement or communication, including by electronic media, distributed to two or more persons. This is the substantiation file: the worksheets, account statements, and supporting data behind any performance number you put in front of a prospect. The rule provides that retaining account statements reflecting all debits, credits, and transactions for the relevant period, together with the worksheets demonstrating the calculation, is deemed to satisfy the requirement for managed-account performance.
If there is a single lesson from years of SEC Marketing Rule examinations, it is that performance claims without contemporaneous substantiation are an examiner magnet. State-registered advisers should evaluate whether they can currently reproduce the math behind every performance figure in their materials.
The Cybersecurity and Privacy Records
The model rule also requires, in subsection (a)(23), that an adviser keep a copy of its Physical Security and Cybersecurity Policies and Procedures and its Privacy Policy. Notably, the rule directs that a current copy be maintained either in hard copy in a separate location or on electronic storage media that is "separate from and not dependent upon access to the investment adviser's computers or a network" — a sensible hedge against the very ransomware and intrusion scenarios these policies are meant to address. It also calls for records documenting compliance, including evidence of the annual review of those policies, and a record of any violation and the action taken in response. The rule leaves the specific cybersecurity rule citation as a bracketed placeholder for each state to complete.
How Long, and in What Form
The retention periods in the model rule will be familiar. Under subsection (e), most required books and records must be preserved in an easily accessible place for not less than five years from the end of the fiscal year in which the last entry was made, with the first two years in the adviser's principal office. Advertising and performance records under subsections (a)(11) and (a)(16) carry their own five-year clock that runs from the end of the fiscal year in which the communication was last published or disseminated.
On format, subsection (g) permits records to be kept on paper, micrographic media, or electronic storage media, provided the adviser indexes them for easy retrieval, can promptly produce legible copies to examiners, separately stores a duplicate, and maintains procedures to protect the records from loss, alteration, or destruction and to limit access to authorized personnel. And subsection (i) preserves a useful efficiency: a record kept in compliance with SEC Rules 17a-3 and 17a-4 that is substantially the same as a record required here is deemed to satisfy this rule — relevant for dual registrants and firms with a broker-dealer affiliate.
Two Versions of the Rule
One detail worth flagging for multi-state firms: the model is published in two alternatives. Alternative 1 sets out the full books-and-records text for jurisdictions that have adopted the Uniform Securities Act of 1956. Alternative 2 is written for states that incorporate the federal recordkeeping rule, Rule 204-2 under the Investment Advisers Act of 1940, by reference — it largely points to the federal rule and then layers on the same advertising and cybersecurity records. Which version your state adopts will affect exactly how the obligations are framed, even if the substance converges. There is also an exemption in subsection (j) for advisers whose principal place of business is in another state, provided they are licensed in and compliant with that home state's recordkeeping rules.
What to Do Now
Because this is a model rule, the right posture is preparation, not panic. First, confirm where your state actually stands — the amendment binds no one until your administrator adopts it, and adoption timelines will vary. Second, regardless of adoption status, firms should evaluate their advertising recordkeeping against the categories the model now emphasizes: a record of the intended audience for performance advertisements, substantiation files behind every performance figure, disclosure and reasonable-basis documentation for testimonials, endorsements, and third-party ratings, and copies of the advertisements themselves. Third, advisers should consider confirming that their cybersecurity and privacy policies are not only current but stored where they remain accessible if the firm's own systems are compromised. None of these steps is wasted effort, because they track the direction state advertising regulation has been heading for several years and align with what the SEC already expects of federally registered advisers.
The firms that treat the May 2026 model as an early-warning signal — rather than waiting for their state to act — will be the ones with clean records when the rule does arrive.
Compliance Approved Support
Compliance Approved helps state-registered advisers keep advertising and recordkeeping aligned without building a back office to do it. The platform pairs marketing-material review with a searchable audit trail of approvals and supporting documentation, policy management for cybersecurity and privacy policies and their annual reviews, and a regulatory calendar to track filing and renewal deadlines across the states where your firm operates. As model rules like this one work their way into individual state regulations, having those records organized and retrievable turns a future compliance date into a non-event.