Which records must I keep, and for how many years?

Five years, minimum. Records may be kept on paper or electronically.

The list is wider than most people keep. It covers the research report itself; the rationale and documentary basis for the recommendation; the record of any public appearance; your KYC records; and the terms and conditions with the client's consent.

It also includes a register of clients, holding each client's PAN, the date and nature of the service, the securities involved, and the fee charged.

Copies of advertisements are separately required to be kept for five years.

You must produce records to SEBI's inspecting authority. Inspection normally comes with seven days' notice, but SEBI may inspect without notice where it considers this in investors' interest.

SEBI has not said when the five years starts running — from the report date, from the end of the client relationship, or otherwise. It is not specified anywhere, so the cautious reading is to keep records five years from the later of the two.

There is no requirement that records be held in India. The only India-location wording is advice about critical data in the cloud-software chapter, not a rule about client records.