Advisor Perspectives

How Do You Get Client Statements Before the Review? Stop Chasing PDFs by Email

Most review prep begins with an email, a reminder, and a PDF that lives in two inboxes forever. Here is a calmer way to collect statements, and why the amended Regulation S-P put a brighter light on the old way.

AdvisorPilot

Ask an advisor when a client review starts and most will name the meeting date. In our ongoing conversations with advisors, a more honest answer keeps coming up: the review starts the day someone on the team asks for statements. For most firms that ask is an email. Then a reminder. Then a PDF arrives as an attachment, covering two of the household's five accounts, and it sits in two inboxes, the client's sent folder and yours, long after the meeting is over.

A small LinkedIn poll we ran in October points the same way. Asked what eats most of their week outside client meetings, 33% of the 6 voters picked aggregating client data and another 33% picked paperwork and admin.

That pattern has two costs. The obvious one is attention: the week before a review gets spent chasing paper instead of thinking about the client. The less obvious one is privacy. Every statement that arrives by email is another copy of a client's financial life in a place nobody manages, and the SEC's amended Regulation S-P put a brighter light on exactly that kind of copy. The fix is not a bigger effort. It is a better request: one complete ask sent early, one client-specific place to send documents, and a receipt check against the list.

How far ahead should you request client statements?

Far enough ahead that a missing statement becomes a follow-up, not a scramble. We will not give you a magic number of days, because the right lead time depends on how many custodians a household uses and how quickly that client tends to respond. What matters more than the number is that the request is timed from the review date, not from whenever someone remembers to send it.

Counting back from the meeting forces the useful question early: which of this client's statements are hard to get? A former employer's 401(k) behind a forgotten login, a spouse's separate brokerage account, or an annuity statement that arrives by mail all take longer than a statement the client can download in a minute. Those are the items that decide your lead time. If your reviews already live on your calendar, start there. AdvisorPilot syncs with Google and Outlook calendars, so the review date you count back from is the one that is actually booked, not a copy in a spreadsheet.

What should your statement request include?

Everything you need, in one message. In what we hear from advisors, statement collection drags less because clients are reluctant and more because the request arrives in installments. A single, complete list gives the client a finite task with a clear finish line, while a trickle of follow-up asks feels open-ended and is easy to put off.

A complete statement request usually covers:

• Each account you expect, named the way the client knows it, with the custodian.
• The statement period you need, such as the most recent quarter end.
• A direct question about anything held away. SmartAsset's client review checklist includes it in plain words: "Do you have any assets held away that you'd like to discuss, or are you considering moving any of those assets to our firm?"
• The date you need everything by, tied to the meeting.
• Exactly where to send the documents, and a clear note not to send them as attachments.

That last line does more work than it looks like. If the request does not say where statements should go, the client will choose for you, and the default choice is reply all with a PDF.

Is it safe for your clients to email statements?

Email is the least controlled way a statement can reach you, and the amended Regulation S-P made that matter more. Whether your firm permits it, and under what conditions, is a policy decision for your CCO and counsel. What we can do is explain why the question got sharper.

According to the SEC's small entity compliance guide, the Commission adopted the amendments on May 16, 2024, and they became effective on August 2, 2024. Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026. FINRA's reminder to member firms gives the same dates: Dec. 3, 2025 for "larger" entities and June 3, 2026 for "smaller" entities. For registered investment advisers, the SEC's adopting release sets the "larger entity" line at $1.5 billion or more in assets under management, and Baker Donelson's summary notes that registered investment advisers with less than $1.5 billion in assets under management faced the June 3, 2026 date. For SEC-registered advisers, both compliance dates have now passed. Regulation S-P applies to SEC-registered firms, so if you are a state-registered adviser, check your state's rules for the requirements that apply to you.

Three parts of the amended rule bear directly on a statement sitting in an inbox. First, scope. The compliance guide says the safeguarding and disposal requirements apply to all customer information, meaning any record containing nonpublic personal information about a customer that is in the firm's possession or handled on its behalf. In the guide's words: "This scope of coverage is broader than the pre-existing requirements of Regulation S-P." The guide also describes a narrower category, sensitive customer information, with examples that include information identifying an individual or the individual's account, "such as a user name or account number, in combination with other information that could be used to gain access to a customer's account." Whether a particular statement meets that definition is a judgment your compliance team makes, but a document built around account numbers is clearly one worth asking about.

Second, response. Firms must maintain written policies and procedures for an incident response program "reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information," and the guide says notice to affected individuals must come "as soon as practicable, but not later than 30 days" after the firm becomes aware that unauthorized access or use has occurred or is reasonably likely to have occurred. Third, vendors. The program must include oversight of service providers, including that they notify the firm "as soon as possible, but no later than 72 hours after becoming aware" of a breach that results in unauthorized access to a customer information system they maintain.

Now picture the inbox. An emailed statement exists in the client's sent items, in your inbox, in anyone's mailbox it was forwarded to, and in backups of all of them. Your firm controls, at most, one of those copies. If a mailbox is compromised, someone at your firm has to work out which clients' statements were in it. The SEC's adopting release even recounts a commenter's scenario in which "a threat actor was able to compromise an employee's email account through a phishing email." And the SEC's Fiscal Year 2026 Examination Priorities say that after the applicable compliance dates, the Division of Examinations will examine whether firms have policies and procedures in line with the rule's provisions "that address administrative, technical, and physical safeguards for the protection of customer information."

None of this says a client can never email you a statement. It says that every emailed statement is a copy of customer information your firm may later need to account for, and that the cheapest copy to account for is the one that never landed in an inbox.

Where should your clients send documents instead?

One place, specific to that client, that is easier to use than email. Ease is the part firms underestimate. If the alternative to email feels like more work than attaching a PDF, clients will attach the PDF, and a secure option nobody uses just produces the insecure path with extra steps.

This is the problem the client statement upload link in AdvisorPilot was built for. AdvisorPilot can email a client an upload link stamped with your firm and bound to that client, so statements land with the right household instead of in an inbox. Put the link in the complete request described above and the request finally answers its own hardest question: where the file goes. And because these are the most sensitive documents your clients share, it is worth saying plainly that client data is never used to train AI models.

How do you know you have everything before the meeting?

You check what arrived against the list you sent, item by item, before the review, not during it. A receipt check is what turns collection from a hope into a closed loop. It also changes the follow-up. Instead of "just checking on those documents," you can tell the client exactly what is still outstanding: the Q3 statement for the rollover IRA and the old 401(k). Specific asks get specific answers.

The check works best when it happens on a set day, early enough that a second request still has time to land. If something will not arrive in time, you know which part of the conversation needs a different plan, and you know it while there is still time to make one.

What happens to the file after it arrives?

It should move to its proper home, and any stray email copy should be handled under a rule your whole team applies the same way. Clients will still attach a PDF sometimes. The practical answer is consistent: file the document where it belongs, handle the email copy the way your written policy says, and reply with the upload link so next time is easier. The compliance guide notes that the amendments expand the disposal requirements to cover customer information, and that firms must "maintain written records documenting compliance with the amended rules." How long you keep a document and when you dispose of it are both books and records questions, so your CCO and counsel decide what your policy requires.

After the meeting, the record matters as much as the receipt. Your written policy decides what has to be kept and for how long, and AdvisorPilot includes WORM compliance archiving.

That brings the review back to where it really starts. A complete request, sent early, with one place to send documents and a check against the list, does not just shorten the chase. It means you walk into the meeting knowing what you have, and your client's statements are not scattered across inboxes nobody manages.

This article is for educational purposes only and is not legal, compliance, tax, or investment advice. It summarizes public sources in simplified form and does not describe every requirement of Regulation S-P. Your CCO and counsel decide what your policy requires.

Sources

• U.S. Securities and Exchange Commission, Enhancements to Regulation S-P: A Small Entity Compliance Guide.
• U.S. Securities and Exchange Commission, Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Final Rule, Release No. 34-100155.
• U.S. Securities and Exchange Commission, Division of Examinations, Fiscal Year 2026 Examination Priorities.
• FINRA, Cybersecurity Advisory: Reminder: SEC Regulation S-P Compliance Date Approaching for Some Member Firms.
• Baker Donelson, Regulation S-P: June 3, 2026 Compliance Deadline for Smaller Investment Advisers (February 24, 2026).
• SmartAsset, Client Review Checklist for Financial Advisors.