Which statement about storing client communications for regulatory review is accurate?

• A. Deleting after one year is acceptable.
• B. Storing only on personal devices is acceptable.
• C. Keeping all communications in a secure, retrievable repository for regulatory review and compliance checks.
• D. Sharing with marketing staff without controls.

Answer: (C)