Is Claude Compliant for SEC and FINRA?

1. The Short Answer

No AI tool is compliant on its own, Claude included. No SEC or FINRA rule names Claude or generative AI; both apply their existing rules to what your firm does with it.

Only Claude Enterprise has the Compliance API, a feed that lets your archive (the system that keeps your firm's email for examiners) copy each chat as it happens. Team and the personal plans (Free, Pro, Max) have no such feed, so a firm that must keep its Claude chats as business records needs Enterprise.

This guide is operational guidance, not legal advice; your counsel and chief compliance officer (CCO) own the interpretation. For Anthropic's advisor add-on, see this FAQ answer.

2. Which Claude Plan Can Meet Recordkeeping Rules

For records, the test is whether your firm can capture every chat.

The Enterprise audit log shows that a chat happened, without its words: Anthropic's help page says "title and content of chats and projects are not available to be exported in audit logs." The words travel through the Compliance API, which only the account's Primary Owner can turn on. It covers chats, files, projects and Cowork (Claude's desktop mode for tasks).

The feed starts when you switch it on and does not reach back. Anthropic's compliance FAQ also warns, "The content of a chat that a user deletes in claude.ai is not recoverable either," so the archive has to capture conversations as they happen, before anyone can delete them.

No archive vendor captures Team. On Enterprise, Smarsh Capture for Claude Enterprise (May 21, 2026) covers chats, files, projects, edits, deletions, and archived and incognito conversations, and Smarsh lists Cowork capture as planned. Global Relay's connector page says it "captures and archives all Claude interactions," and its button reads "Request connector," so general availability is not confirmed.

Hearsay, Comply (formerly RIA in a Box) and ComplySci listed no Claude archiving in November 2026.

Buy the plan your archive can read.

3. What the SEC Expects From an RIA

The SEC's fiscal 2027 exam priorities (October 23, 2026) check compliance with "existing, technology-neutral obligations" (see the 2027 priorities guide).

Rule 204-2, the SEC's books-and-records rule, requires an adviser to keep "copies of all written communications sent" about its recommendations and advice, and each advertisement, for "not less than five years." A Claude draft your firm sends to a client is a record, and so is any advertisement Claude helped write.

No SEC or FINRA guidance says whether an unsent Claude chat, or an AI meeting summary, is itself a required record. The SEC's 2026 regulatory agenda lists an amendment to Rule 204-2 "related to electronic communications," targeted for October 2026 and not proposed as of November 5, 2026.

Until the rules say more, a careful firm decides in writing which Claude uses create records and, on Enterprise, captures chats into the archive, so it can apply its retention schedule with counsel.

Rule 206(4)-7, the compliance program rule, requires written policies and procedures "reasonably designed to prevent violation," reviewed "no less frequently than annually," so Claude belongs in your policies and review. The Marketing Rule, Rule 206(4)-1, bars advertising claims an adviser cannot substantiate on demand; on March 18, 2024 the SEC settled with Delphia ($225,000) and Global Predictions ($175,000) over false claims about their use of AI.

Regulation S-P, the SEC's rule on protecting customer information, requires oversight of service providers "through due diligence and monitoring" and breach notice from them "no later than 72 hours after becoming aware." Anthropic and each connector vendor that touches client data (a connector lets Claude read a system such as your CRM) are service providers, and every SEC-registered adviser had to comply by June 3, 2026.

4. What FINRA Expects From a Broker-Dealer or Dual Registrant

FINRA's advertising FAQ (May 10, 2024) says, "Firms are responsible for their communications, regardless of whether they are generated by a human or AI technology."

• Rule 3110, FINRA's supervision rule, says "Final responsibility for proper supervision shall rest with the member," and written procedures must cover correspondence review.
• Rule 17a-4, the SEC's broker-dealer records rule, requires keeping business communications "not less than three years, the first two years in an easily accessible place," with "a complete time-stamped audit trail" or in "a non-rewriteable, non-erasable format."
• Rule 4511, FINRA's books-and-records rule, sets six years where no other period applies.
• Rule 2210, FINRA's rule on communications with the public, treats anything sent to more than 25 retail investors within 30 days as a retail communication, which a registered principal must approve before its use or filing.

Regulatory Notice 26-14 (July 9, 2026) is a pending proposal: it "would replace the prescriptive principal pre-use approval requirement with more modernized, risk-based standards for supervising retail communications." Comments closed September 11, 2026, and pre-use approval still applies today.

For dual registrants, the activity decides which rules apply: advice falls under the Advisers Act rules, brokerage under Rule 17a-4, Reg BI (the SEC's best-interest rule for broker-dealers) and FINRA's rules. One Claude-drafted email can be both an adviser record and broker-dealer correspondence, so tag uses by role, apply the stricter review and ask counsel how the three- and five-year periods fit.

5. The Setup Checklist

1. Decide in writing which Claude uses create records, and capture them: client emails and advertisements sent (Rule 204-2), broker-dealer business communications (Rule 17a-4) and, on Enterprise, chats through the Compliance API.
2. Keep the archive to the standard: indexed, duplicated, protected from alteration and access-limited (Rule 204-2), with an audit trail or write-once format for broker-dealers (Rule 17a-4).
3. Put Claude in your written policies and supervisory procedures: permitted uses, what never goes in and approved connectors, reviewed every year (Rule 206(4)-7; Rule 3110).
4. Review before use: substantiate advertisements and AI claims (Marketing Rule), get principal approval of retail communications (Rule 2210) and review correspondence (Rule 3110).
5. Treat Anthropic and each connector vendor as a service provider: due diligence, 72-hour breach notice in the contract and an incident plan (Regulation S-P). For broker-dealers, outsourcing "does not relieve members of their ultimate responsibility for compliance" (FINRA's outsourcing notice, 21-29).
6. Test before rollout and monitor after: review prompts and outputs and log which model was used and when (FINRA's AI notice, 24-09, and its 2026 oversight report).
7. Train staff (Rule 3110), and switch AI note-takers off on calls with FINRA staff, which Notice 24-10 bars firms from recording.

Do the Compliance API step first, because the feed does not reach back.

6. Where to Start

1. List the Claude plans your people use, personal accounts included.
2. Choose the plan in writing. If chats must reach the archive, that means Enterprise, where the 20-seat minimum at $20 a seat a month comes to $4,800 a year before usage.
3. Ask your archive vendor in writing whether it captures Claude Enterprise today, Cowork included: chat and Cowork merge on Enterprise by default on November 16, 2026.
4. Switch on the Compliance API and find a test chat in the archive before anyone uses client data.
5. Write the policy addendum and vendor files, then have counsel review them.

If you have not chosen a tool, start with What Is the Best AI for Financial Advisors? and Where Should an RIA Start With AI?