For issuers conducting private placements under Rule 506(c), maintaining thorough documentation is not optional — it is a regulatory obligation. The SEC’s reasonable steps verification standard requires issuers to actively confirm accredited investor status before accepting capital, and the records generated in that process must be preserved with care.
What the SEC Expects
While the Securities Exchange Act of 1934 and SEC rules establish general recordkeeping frameworks, Rule 506(c) issuers must demonstrate that they took reasonable steps verification measures at the time of each offering. This means retaining proof that the verification process occurred, what methods were used, and what documentation was reviewed.
Recommended Retention Timelines
The SEC’s general books and records rules suggest a baseline retention period of five years for most issuer records. However, many compliance professionals recommend extending this to seven years or longer for 506(c) documentation, particularly given the statute of limitations considerations for securities fraud claims, which can extend up to five years from discovery of a violation.
Issuers should retain the following for each verified investor: the verification method used, supporting documents reviewed (redacted appropriately), dates of verification, and any third-party verification letters or confirmations received.
Audit Readiness as an Ongoing Practice
Retaining records is not simply a matter of saving files. Records must be organized, retrievable, and tied to specific investors and offering rounds. Disorganized or incomplete documentation can be as problematic as no documentation at all during an SEC inquiry or enforcement review.
Cloud-based document management systems with access controls and audit trails are increasingly considered best practice. Physical storage remains acceptable but introduces risks around retrieval speed and document integrity.
When Records Should Be Extended
Certain circumstances warrant extended retention: ongoing litigation involving the offering, regulatory investigations, or if the issuer anticipates future fundraising rounds where prior investor status documentation may be referenced. In these cases, a conservative approach — retaining records indefinitely until legal counsel clears them — is advisable.
Practical Takeaway
Issuers should treat reasonable steps verification records the same way they treat other core compliance assets: with a defined retention schedule, a responsible custodian, and a documented destruction policy. Building this infrastructure from the first offering protects the issuer if scrutiny arises years down the line.
