What a CRM System Must Do in Financial Services

Key Takeaways

A CRM is the system of record for the relationship, not for balances, policies or positions, which belong to the core and portfolio systems (our working model).
For broker-dealers and SEC-registered advisers, CRM messages and some notes can be required books and records, kept for set periods in a form the rules accept.
Data on consumers (individuals using financial services for personal, family or household purposes) is largely protected by the Gramm-Leach-Bliley Act, and for SEC-registered firms the CRM vendor is a Regulation S-P service provider (our reading).
Storing email opt-outs and call and text consent by channel and category lets a firm honor them precisely (our reading); from November 25, 2026 the FCC lets callers designate an exclusive way to revoke consent.
The CRM must not contradict due diligence and suitability data, and notes that call ownership into question need a route to the due diligence team.

Current as of November 8, 2026. Quotations come from the statutes, rules, orders, Federal Register documents, SEC compliance guide and NAIC model regulation listed at the end. The working definitions and everything marked (interpretation) are ours. It is not legal advice.

A CRM system is where a firm keeps track of who its customers are, how they are related to one another, and the conversations it has had with them. In a bank, a wealth firm or an insurer it is also where regulated records are made, protected customer information sits, and regulated outreach starts.

The short version

A CRM is the system of record for the relationship (who, how they are connected, what was said and agreed), not for balances, policies or positions (our working model).
For broker-dealers and SEC-registered advisers, CRM messages and some notes can be required books and records, with retention and format rules the CRM alone may not meet.
What it holds about consumers (individuals using financial services for personal, family or household purposes) is largely nonpublic personal information under the Gramm-Leach-Bliley Act, and for SEC-registered firms the CRM vendor is a service provider under the amended Regulation S-P, whose compliance dates have passed (our reading).
It must not contradict due diligence or suitability data, and it must record email opt-outs and call and text consent in a form the firm can prove.

What is a CRM system?

Our working definition: a customer relationship management (CRM) system is the application a firm uses to record who its customers and prospects are, how they relate to one another and to the firm, and what has passed between them, from meetings and messages to tasks and service requests.

In a regulated firm it should not hold the authoritative balance, policy terms or position; it shows a copy (interpretation).

How is a CRM different from ERP software and from a core system?

A CRM is the system of record for the customer relationship, ERP software for the firm's own finances and operations, and a core system for the customer's contracts and money. The table is our working model, not a regulator's taxonomy; institutions draw these lines differently.

System	System of record for	Should not master
CRM	Parties, households, relationship roles, interactions, consent, opportunities	Balances, policy terms, positions, ledger entries
ERP	The firm's own books: general ledger, payables, receivables, procurement, fixed assets	Customer accounts and customer money
Core banking or policy administration	Customer contracts: deposit and loan accounts, or policies, coverages and premiums	Relationship notes, campaigns, prospects
Portfolio accounting	Positions, transactions, cost basis and performance for managed accounts	Contact history, consent, household groupings

A CRM that lets a user overwrite an owner's name the core also holds creates two versions of the truth, and the one an examiner sees may not be the one the adviser sees (interpretation).

Why is a CRM in financial services different?

Because three sets of rules that reach only financial firms (books and records, privacy and safeguarding, and due diligence and suitability) sit alongside two that reach any business's email and automated calls, CAN-SPAM and the TCPA. None names CRM software, so applying each, within its own scope, is our reading (interpretation).

When is a CRM note or message a regulatory record?

For a broker-dealer, the starting point is SEC Rule 17a-4, which requires each member, broker or dealer subject to Rule 17a-3 to preserve "for a period of not less than three years, the first two years in an easily accessible place" the "Originals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer (including inter-office memoranda and communications) relating to its business as such". Whether an internal CRM note is an inter-office memorandum is a judgment for the firm (interpretation). For FINRA members, Rule 4511 adds that "All books and records required to be made pursuant to the FINRA rules shall be preserved in a format and media that complies with SEA Rule 17a-4."

Profile data is covered too. Rule 17a-3 requires, for each account with a natural person as customer or owner for which the firm has had to make a suitability determination, an account record that includes, among other fields, "the account's investment objectives". Rule 17a-4 keeps that information "until at least six years after the earlier of the date the account was closed or the date on which the information was collected, provided, replaced, or updated." A CRM that overwrites the old objectives when a client updates them has lost a record the rule still requires, unless the history is kept somewhere (interpretation).

For an investment adviser registered or required to be registered with the SEC, Rule 204-2 requires "Originals of all written communications received and copies of all written communications sent by such investment adviser relating to" matters including any recommendation or advice, preserved "for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record", and, where they are kept on electronic storage media, under procedures "to maintain and preserve the records, so as to reasonably safeguard them from loss, alteration, or destruction".

Format matters as much as retention. Rule 17a-4 lets a broker-dealer's electronic recordkeeping system either "Preserve a record for the duration of its applicable retention period in a manner that maintains a complete time-stamped audit trail", or "Preserve the records exclusively in a non-rewriteable, non-erasable format". A CRM where a note can be edited or deleted without a trace meets neither on its own, which is why firms pair it with an archive (interpretation). Banks and insurers without a broker-dealer or advisory business are outside these rules.

What do Regulation S-P and the GLBA require of a CRM?

The Gramm-Leach-Bliley Act (GLBA) states the policy that "each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information." The Act protects consumers, defined as individuals who obtain financial products or services "to be used primarily for personal, family, or household purposes", so a commercial bank's data on business clients falls outside these provisions. Before sharing a consumer's information with a nonaffiliated third party, a financial institution must, with exceptions, give the consumer the chance "to direct that such information not be disclosed to such third party". Enforcement is split by type of firm: the SEC for brokers and dealers, for example, and the state insurance authority for insurers. The exceptions include, subject to conditions, a third party engaged "to perform services for or functions on behalf of the financial institution", and disclosures "as necessary to effect, administer, or enforce a transaction". In a CRM, the opt-out is a field to check before any export or list share to a nonaffiliated third party that no exception covers (interpretation).

For SEC-registered firms the binding rule is Regulation S-P, as amended in 2024. Its safeguarding section, 17 CFR 248.30, applies to each covered institution, which it defines as "any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency". The amendments added oversight of vendors: each firm's incident response program must include written policies and procedures "reasonably designed to require oversight, including through due diligence and monitoring, of service providers", including that providers notify the firm of a breach of their systems within a deadline the rule sets.

A service provider is "any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution." A hosted CRM fits that on its face, and so may each connected app that reads client records (interpretation). The SEC's compliance guide says "Larger entities must comply with the amendments by December 3, 2025" and smaller entities "by June 3, 2026"; both dates have passed.

What do CAN-SPAM and the TCPA mean for CRM campaigns?

The CAN-SPAM Act applies to commercial electronic mail messages. After a recipient opts out, the Act makes sending commercial email within the scope of the request "more than 10 business days after the receipt of such request" unlawful. The FTC's rule separates commercial content from "Transactional or relationship content", which includes certain information about an existing "subscription, membership, account, loan, or comparable ongoing commercial relationship", and decides mixed messages by their primary purpose. Tagging each template by primary purpose keeps service notices flowing past a marketing opt-out (interpretation).

The FCC's rules under the Telephone Consumer Protection Act reach calls made "using an automatic telephone dialing system or an artificial or prerecorded voice" to wireless numbers and certain other lines, which need "the prior express consent of the called party"; telemarketing calls of that kind need "prior express written consent". As the rule stands, consent may be revoked "by using any reasonable method to clearly express a desire not to receive further calls or text messages", and a revocation made "in any reasonable manner must be honored within a reasonable time not to exceed ten business days from receipt of such request". A CRM that drives a dialer or texting platform can bring those provisions into play, depending on how the calls are placed (interpretation).

A final FCC rule, FR Doc. 2026-21821, published October 26, 2026, rewrites those provisions from November 25, 2026. "Callers may designate any of the following methods as the exclusive means to revoke consent": an automated opt-out on a call, a standard reply word to a text, or a designated website or telephone number. Under the new text, callers that do not designate one "must process revocation requests made by any reasonable means", and either way revocations must be honored within ten business days. A revocation of an informational call or text may be read "as applying only to the specific category of informational robocalls and text messages to which the revocation was directed", while revocation requests "made in response to calls or text messages that contain an advertisement or constitute telemarketing revoke consent to all future calls or text messages containing an advertisement or constitute telemarketing from that caller". A CRM that stores consent as one yes-or-no flag, or does not record which method the firm designated, cannot show it honored either rule (interpretation).

The same rule changes the exemption for financial institutions' calls and texts about possible fraud or identity theft, data-security breaches and pending money transfers: they may go to wireless numbers the customer provided "or obtained from a reliable source", such as a number "supplied by a spouse or other family member who is authorized to be on the account". Recording where each number came from is what lets a firm show that a number qualifies (interpretation).

Which due diligence data must the CRM not contradict?

The data the firm collected to know its customer. For banks, FinCEN's rule 31 CFR 1020.210 requires "Appropriate risk-based procedures for conducting ongoing customer due diligence", including, "on a risk basis", to "maintain and update customer information", which includes information on the beneficial owners of legal entity customers.

For legal entity customers, 31 CFR 1010.230 requires covered financial institutions, as it defines them, to identify and verify beneficial owners. A FinCEN order of February 13, 2026 (FIN-2026-R001) lets them, instead of doing so at each new account, limit it to the customer's first account, to risk-based ongoing due diligence, and to "any time thereafter when the covered financial institution has knowledge of facts that would reasonably call into question the reliability of beneficial ownership information previously obtained". A relationship manager's note that a client company has new owners may be such knowledge, so the CRM needs a route from that note to the due diligence team (interpretation). FinCEN's April 10, 2026 reform of AML/CFT program rules is a proposal; the rules quoted here are in force.

Suitability data is the same problem. Regulation Best Interest, which governs broker-dealers' recommendations to retail customers, lists the factors in a retail customer's investment profile, among them age, financial situation, investment objectives and risk tolerance; FINRA Rule 2111 uses the same factors where it does not apply. For annuities, the NAIC's Suitability in Annuity Transactions Model Regulation, binding only where a state adopts it, defines consumer profile information as "information that is reasonably appropriate to determine whether a recommendation addresses the consumer's financial situation, insurance needs and financial objectives". If the CRM shows one risk tolerance and the account record another, the firm holds a recommendation it will struggle to defend (interpretation).

What data does a financial-services CRM hold?

Five kinds, each with an owner (our working model):

Parties: people and legal entities, with identifiers matching the core.
Households and relationships: spouses, trustees, beneficiaries, authorized signers, beneficial owners and guarantors, and the accounts or policies each role attaches to. How to Implement a Household Rollup covers the grouping side.
Consent and preferences: privacy and email opt-outs, call and text consent by category, with when and how each was given or withdrawn.
Profile inputs: suitability fields, mastered with history or read from the system that masters them.
Interactions: notes, meetings, calls, messages, tasks and service cases.

How should the CRM connect to the core, the archive and the data platform?

By a written agreement on who owns each field (interpretation). Three connections matter most:

Core and portfolio systems: the CRM reads balances, policies and holdings and does not write them; a data contract between CRM and ledger is one way to set that out.
The archive: messages and the notes the firm treats as records go to a store that meets Rule 17a-4's audit-trail or non-rewriteable requirement. How to Automate Compliance Archiving of CRM Emails and Messages covers the mechanics.
The data platform: data flows out with its opt-out and consent flags attached.

Questions to ask before choosing or rebuilding a CRM

Which fields does the CRM master, and which does it only display?
Can a user edit or delete a note or a sent message, and where is the version the rules require kept?
Does it keep the history of profile fields such as investment objectives, or only the current value?
Are the vendor and every connected app under the firm's Regulation S-P service-provider oversight?
Can consent be stored by channel and category, with the date and the wording shown to the customer?

For evaluation criteria, see CRM for Financial Services and Insurance CRM Solutions for Agents and Brokers. For advisory firms, the Store's CRM For Financial Advisors Software Features List covers areas such as household modeling and compliance archiving.

How we sourced this article: every quotation in it comes from the published documents listed below, and we keep saved copies of them. The working definition of a CRM, the comparison of systems and everything marked (interpretation) are our own. If you want to question a point, get in touch through our contact page.

Sources

Frequently Asked Questions

What is a CRM system in financial services?

In our working definition, it is the system a bank, wealth firm or insurer uses to record who its customers are, how they relate to one another and to the firm, and what has passed between them. Unlike a retail CRM, it also holds records and data that financial-services recordkeeping, privacy and due diligence rules reach, so it is run as a regulated system (interpretation).

What is the difference between CRM and ERP software?

A CRM is the system of record for customer relationships and interactions. ERP software is the system of record for the firm's own finances and operations, such as the general ledger, payables and procurement. In a bank, customer balances belong to neither: they live in the core banking system (our working model).

Are CRM notes regulatory records?

They can be. For broker-dealers, SEC Rule 17a-4 covers communications sent and received relating to the business, including inter-office memoranda. For SEC-registered advisers, Rule 204-2 covers written communications about advice and recommendations, among other matters. Whether a particular internal note is a required record is a judgment for the firm and its counsel.

Is a CRM vendor a service provider under Regulation S-P?

For SEC-registered broker-dealers, advisers, investment companies and transfer agents, a vendor that receives, maintains, processes or is permitted access to customer information through services provided directly to the firm fits the amended rule's definition, in our reading. The firm's policies must then provide for oversight of it, and the compliance dates have passed.