RIA Operations: Full Reference (all details)

Prepared October 18, 2026. This is the complete text behind the maps in this folder: every domain, rule citation, cadence item, record, calendar row, process step, source, and open question. Use the mind map and flowcharts to navigate; use this doc when you need the exact rule, day count, or dollar threshold.

Live interactive tool: https://ria-ops.pages.dev (checklist, calendar with .ics export, process runs, firm-profile filters; progress saved in your browser).

Scope: public regulation and industry practice for a U.S. SEC-registered investment adviser. Standard fee-based RIA first; research-publisher / model-provider / TAMP-strategist differences flagged in each domain. No non-public firm information. Operations research, not legal advice.

Prepared: October 18, 2026. Scope: public regulation and industry practice only. No non-public firm information is included. Every date and threshold marked "verified" was checked against a primary or reputable secondary source in October 2026; items marked "not verified" could not be confirmed and should be checked before relying on them.

Verification summary of 2024-2026 changes (read this first)

Not verified in this pass: whether the joint SEC/FinCEN Customer Identification Program rule for RIAs (proposed May 2024) has been finalized (I found no final rule; treat as still proposed); the exact list of 25 IAR CE jurisdictions; any 2026 Reg S-P staff FAQ beyond the Sept 25, 2025 compliance outreach event.

A. DOMAINS

Domain: Registration & Regulatory Filings

• Why it matters: Registration status determines which regulator examines you and which rulebook applies. Late or inaccurate filings are the easiest deficiency for an examiner to find and are a stated FY2026 focus for activist-type filings.
• Governing rules:
  • Advisers Act Section 203 and Rule 203A-1, 203A-2 (17 CFR 275.203A-1) - SEC registration generally required at $100M RAUM; mid-sized advisers ($25M to $100M) stay with the state unless not subject to state exam; $90M/$110M buffer; withdraw within 180 days of FYE if under $90M at annual amendment - https://www.sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/division-investment-management-frequently-asked-questions-regarding-mid-sized-advisers
  • Rule 203A-2 exemptions - pension consultants ($200M plan assets), multi-state advisers (15+ states), internet advisers (amended 2024; compliance March 31, 2025, must operate an interactive website and may no longer rely on a de minimis non-internet client count) - https://www.sec.gov/rules-regulations/2024/03/exemption-certain-investment-advisers-operating-through-internet
  • Rule 204-1 - Form ADV annual updating amendment within 90 days of FYE; other-than-annual amendments "promptly" when Part 1 items become inaccurate or Part 2 becomes materially inaccurate - https://www.sec.gov/files/formadv-instructions.pdf
  • Form ADV Part 3 (Form CRS) General Instructions - amend within 30 days of material inaccuracy; deliver to retail investors - https://www.sec.gov/files/formadv-instructions.pdf
  • Section 203(h) and Form ADV-W - withdrawal from registration - https://www.sec.gov/about/forms/formadv-w.pdf
  • Exchange Act Section 13(f), Rule 13f-1 - Form 13F within 45 days of quarter-end if $100M+ in Section 13(f) securities under investment discretion - https://www.sec.gov/divisions/investment/13ffaq.htm
  • Exchange Act Rule 14Ad-1 - Form N-PX by Aug 31 for 13F filers (say-on-pay votes, period ending June 30) - https://www.sec.gov/rules-regulations/2022/11/enhanced-reporting-proxy-votes-registered-management-investment-companies-reporting-executive
  • Exchange Act Rules 13d-1, 13d-2 - Schedule 13G/13D for 5%+ beneficial ownership; 13G amendments 45 days after quarter-end of a material change (since Sept 30, 2024) - https://www.sec.gov/rules-regulations/2023/10/modernization-beneficial-ownership-reporting
  • Rule 13h-1 - Form 13H large trader if 2M shares or $20M in a day, or 20M shares or $200M in a month - https://www.sec.gov/rules-regulations/2011/07/large-trader-reporting
  • Rule 204(b)-1 - Form PF if advising private funds with $150M+ - https://www.sec.gov/rules-regulations/2011/10/reporting-investment-advisers-private-funds-and-certain-commodity-pool-operators-commodity-trading
  • Securities Act Rule 503 - Form D within 15 days of first sale in a private offering - https://www.sec.gov/about/forms/formd.pdf
  • State notice filing statutes (e.g., Florida Chapter 517) - SEC-registered advisers notice-file in states where they have a place of business or exceed the de minimis client count (typically 5 non-institutional clients in 12 months under NSMIA Section 222(d)) - https://www.nasaa.org/industry-resources/investment-advisers/state-investment-adviser-registration-information/
• Required records/deliverables:
  • Filed Form ADV Parts 1A, 1B (if state), 2A, 2B, 3 with IARD filing confirmations
  • Annual amendment work papers (RAUM calculation, client counts, custody answers, Item 5 and 7 data)
  • State notice-filing matrix (state, trigger, fee, renewal date) and IAR registration matrix
  • 13F/N-PX/13G/13H determinations memo each quarter (even if "not required")
  • IARD Flex-Funding account statements and renewal statements
• Cadence items:
  • Quarterly | Form 13F determination and filing if applicable | 45 days after quarter-end
  • Quarterly | Schedule 13G amendment check | 45 days after quarter-end of any material change
  • Quarterly | Form 13H determination (large trader thresholds) | promptly after crossing; annual amendment within 45 days of year-end
  • Annual | Form ADV annual updating amendment (Parts 1A, 2A; Part 3 if changed) | 90 days after FYE (March 31 for Dec FYE)
  • Annual | Brochure delivery or summary of material changes with offer | 120 days after FYE (Rule 204-3(b))
  • Annual | Form N-PX if 13F filer | Aug 31
  • Annual | IARD renewal: preliminary statement review and payment | preliminary statement ~Nov 10; payment ~Dec 8; filings cutoff ~Dec 26
  • Annual | State notice filing and IAR renewal confirmation | with IARD renewal (Dec)
  • Event | Other-than-annual ADV amendment | promptly (industry practice: within 30 days) when Items 1, 3, 9, 11 or disciplinary info change, or Part 2A materially inaccurate
  • Event | Form CRS amendment and redelivery of changes to existing retail clients | 30 days to file; 60 days to communicate changes to existing retail investors
  • Event | Form D | 15 days after first sale
  • Event | Form ADV-W | within 180 days of FYE if ineligible for SEC registration
• Owner role: Chief Compliance Officer (CCO) owns the filing calendar; Head of Operations owns data inputs (RAUM, client counts, custodial data); outside compliance consultant or counsel reviews before submission.
• Best practices:
  • Keep a single regulatory calendar with owner, deadline, data source, and "evidence of completion" column; review it monthly in the ops/compliance meeting.
  • Build the RAUM workbook so it ties to custodian and TAMP data as of the last day of the fiscal year, and keep the tie-out.
  • Run a quarterly "filing triggers" checklist (13F, 13G, 13H, Form D, state de minimis counts) and record the determination even when nothing is due.
  • Register for IARD email alerts by confirming the CCO email in Form ADV Item 1.J or 1.K.
  • Pre-fund the IARD Flex-Funding account in October so renewal payment is not a December fire drill.
  • Keep a redline of every ADV amendment and a one-page "what changed and why" memo for the exam file.
• Common exam deficiencies / pitfalls:
  • Form ADV Part 1 inconsistent with Part 2A (custody answers, client types, fee schedule, discretionary vs non-discretionary assets).
  • Annual amendment filed as "other-than-annual" (SEC cannot fix the filing type; you must refile).
  • Missed state notice filings when the fifth non-institutional client in a state is onboarded.
  • 13F omissions or late filings; 13G amendments missed under the new quarterly cadence.
• Model-provider/TAMP-strategist differences:
  • Model portfolios delivered to a TAMP sponsor are generally NOT counted as RAUM unless the strategist provides continuous and regular supervisory or management services (Form ADV instructions, Item 5.F). A firm whose business is mostly model delivery and research can have low RAUM and may need to confirm SEC eligibility each year (Rule 203A-2 exemptions, or state registration). This is a firm-specific open question.
  • Research subscribers who are financial professionals are not "retail investors," so Form CRS may not be required for that line of business. Form CRS is required only if the firm has retail investor clients.
  • Form 13F is driven by investment discretion over 13(f) securities; a pure model provider with no discretion typically does not file, but a firm that also manages SMAs must aggregate.

Domain: Compliance Program & CCO

• Why it matters: Rule 206(4)-7 is the backbone rule the SEC uses in nearly every adviser enforcement case. "Effectiveness of compliance programs" is a named FY2026 exam priority.
• Governing rules:
  • Rule 206(4)-7 (17 CFR 275.206(4)-7) - adopt and implement written policies and procedures reasonably designed to prevent violations; review adequacy and effectiveness at least annually; designate a CCO who is competent, knowledgeable and empowered - https://www.sec.gov/rules-regulations/2003/12/compliance-programs-investment-companies-investment-advisers
  • Rule 204-2(a)(17) - keep the compliance manual, all versions in effect in the last 5 years, and records documenting the annual review - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Section 203(e)(6) - failure reasonably to supervise is a basis for sanctions; a firm with procedures reasonably designed to detect and prevent violations has a defense - https://www.law.cornell.edu/uscode/text/15/80b-3
  • Section 204A - written policies to prevent misuse of material nonpublic information - https://www.law.cornell.edu/uscode/text/15/80b-4a
  • Exchange Act Rule 21F-17 - no agreement or action may impede whistleblowing to the SEC - https://www.sec.gov/whistleblower
  • SEC FY2026 Examination Priorities - compliance program effectiveness, conflicts from compensation structures, business model changes - https://www.sec.gov/files/2026-exam-priorities.pdf
• Required records/deliverables:
  • Written compliance manual tailored to the firm's actual business (not a template)
  • Annual compliance review report with findings, remediation, owners and due dates (SEC has charged firms for backdated annual reviews)
  • Risk assessment / risk matrix updated at least annually
  • Compliance calendar and testing log (forensic tests, dates, results)
  • Training records (attendance, materials, attestations)
  • CCO designation and reporting line documentation; board or management review minutes
• Cadence items:
  • Monthly | Compliance committee or ops/compliance meeting with minutes | monthly
  • Quarterly | Forensic testing (fee billing sample, personal trading, marketing review log, best execution, e-comms sampling) | quarter-end plus 30 days
  • Annual | Rule 206(4)-7 annual review and written report | within 12 months of prior review; many firms align to Q1 after ADV
  • Annual | Compliance training (code of ethics, cybersecurity, marketing rule, insider trading) with attestations | annually, typically Q1 or at onboarding
  • Annual | Risk assessment refresh | before annual review
  • Event | Manual update when rules, business lines, vendors or systems change | within 30 to 60 days of the change
• Owner role: CCO (often also COO or Head of Operations at a 10-15 person firm; dual-hatting is allowed but the conflicts should be documented). Outside compliance consultant for mock exams.
• Best practices:
  • Map every policy to a rule, a risk, a control, a test and an owner. If a policy cannot be tested, rewrite it.
  • Keep the annual review as a dated, signed document with evidence appendices; never revise after the fact.
  • Run a mock SEC exam every 2 to 3 years using the current exam priorities as the scope.
  • Build a "compliance evidence folder" structure that mirrors the typical SEC document request list so exam responses are a retrieval exercise.
  • Give the CCO a direct reporting line to the CEO and documented authority to compel remediation.
  • Use a GRC or compliance platform (ComplySci/ COMPLY, SmartRIA, MyRIACompliance, Orion Compliance/BasisCode) for attestations, preclearance and the calendar; a spreadsheet is acceptable at 12 people if the evidence trail is kept.
• Common exam deficiencies / pitfalls:
  • Off-the-shelf manual that describes activities the firm does not do, or omits ones it does (TAMP delivery, research publishing).
  • No annual review, or an annual review that is a checklist with no findings and no evidence of testing.
  • Policies not followed (e.g., manual says quarterly best-execution review; none documented).
  • CCO lacks time, authority or knowledge; no backup CCO.
• Model-provider/TAMP-strategist differences:
  • The manual must cover model-change governance (who approves a model change, when it is communicated to the sponsor, blackout for personal trading around model changes) and research publication controls (review before release, trading ahead of publication prohibited).
  • Add a "scalping" control: SEC v. Capital Gains Research Bureau (1963) established that trading ahead of your own recommendations without disclosure is fraud under Section 206.

Domain: Fiduciary Duty & Code of Ethics

• Why it matters: The adviser's duty of care and duty of loyalty under Section 206 apply to every client relationship, including advice delivered impersonally. "Adherence to fiduciary standards of conduct" is the first item in the FY2026 priorities.
• Governing rules:
  • Advisers Act Section 206(1), (2), (3), (4) - anti-fraud provisions; 206(3) requires written disclosure and consent before each principal trade or agency cross - https://www.law.cornell.edu/uscode/text/15/80b-6
  • SEC Interpretation Regarding Standard of Conduct for Investment Advisers, Rel. IA-5248 (June 5, 2019) - duty of care (best interest advice, best execution, monitoring) and duty of loyalty (full and fair disclosure, eliminate or disclose conflicts) - https://www.sec.gov/rules/interp/2019/ia-5248.pdf
  • Rule 204A-1 Code of Ethics - standards of conduct; access persons report holdings (initial within 10 days, annual) and transactions (quarterly within 30 days); preclearance for IPOs and limited offerings; written acknowledgment; report violations to CCO - https://www.sec.gov/rules-regulations/2004/07/investment-adviser-codes-ethics
  • Section 204A - insider trading policies - https://www.law.cornell.edu/uscode/text/15/80b-4a
  • Rule 206(4)-5 Pay-to-Play - two-year compensation ban after contributions above $350 (can vote) / $150 (cannot vote) to officials who can influence government client selection - https://www.sec.gov/rules-regulations/2010/07/political-contributions-certain-investment-advisers
  • Rule 206(4)-6 Proxy Voting - written policies, disclose how clients get voting records, keep records (Rule 204-2(c)(2)) - https://www.sec.gov/rules-regulations/2003/01/proxy-voting-investment-advisers
  • Rule 206(3)-2 - agency cross transactions with blanket consent and annual statement - https://www.law.cornell.edu/cfr/text/17/275.206(3)-2
  • Section 205(a)(1) and Rule 205-3 - performance fees only for qualified clients: $1.4M AUM or $2.7M net worth effective June 29, 2026 - https://www.sec.gov/files/rules/ia/2026/ia-6961.pdf
• Required records/deliverables:
  • Code of Ethics (current and all versions in last 5 years), list of access persons, acknowledgments
  • Initial and annual holdings reports (information no older than 45 days), quarterly transaction reports or duplicate statements/feeds
  • Preclearance requests and approvals; restricted list; violation log and sanctions
  • Conflicts inventory tied to Form ADV disclosures
  • Political contribution preclearance log and attestations
  • Proxy voting policy, vote records, and conflicts handling
• Cadence items:
  • Daily | Review personal trading feed exceptions vs restricted list and client trades | T+1
  • Quarterly | Collect quarterly transaction reports / attestations | 30 days after quarter-end
  • Quarterly | Political contribution attestation | with transaction reports
  • Annual | Annual holdings reports and code acknowledgment | within 45 days of the chosen as-of date (many firms use Jan 31 for Dec 31 holdings)
  • Annual | Conflicts inventory refresh tied to ADV update | Q1
  • Annual | Code of ethics training | Q1 and at onboarding
  • Event | New hire initial holdings report | within 10 days of becoming an access person
  • Event | IPO or private placement preclearance | before trade
• Owner role: CCO; Operations maintains broker feeds and the access-person roster; CEO signs off on sanctions.
• Best practices:
  • Use electronic broker feeds (ComplySci, Orion Compliance, StarCompliance, MyComplianceOffice) rather than paper statements; require employees to hold accounts at feed-enabled brokers.
  • Treat pending model changes and unpublished research as material nonpublic information with a blackout window (for example, no personal trades in affected names from model decision until 2 trading days after client/sponsor delivery).
  • Maintain one conflicts inventory that feeds Form ADV Item 10/11, the compliance manual and the annual review.
  • Pre-clear all political contributions, including by spouses, and document the $350/$150 de minimis analysis.
  • Document the "best interest" basis for strategy recommendations (IPS, risk questionnaire, suitability notes), especially for retirement and older investors.
• Common exam deficiencies / pitfalls:
  • Access persons not identified (interns, contractors, shared-service staff with access to recommendations).
  • Holdings reports missing required data (account numbers, broker) or older than 45 days.
  • Code violations noted but no documented sanction or follow-up.
  • Conflicts disclosed in ADV but no procedure to mitigate them (for example, revenue sharing from a platform).
• Model-provider/TAMP-strategist differences:
  • Everyone who sees model changes or draft research before release is an access person. The blackout should run from decision to post-delivery, because sponsors may take days to implement.
  • Trade rotation and fairness: if the firm manages any accounts directly while also delivering models to a TAMP, adopt and disclose a rotation/sequencing policy so neither channel is systematically disadvantaged.
  • Performance fees on research subscriptions are unusual; if any fee is tied to performance, the qualified client test applies to each payer.

Domain: Client Onboarding & KYC

• Why it matters: Onboarding is where suitability, disclosures, agreements, custody and identity verification are established; errors here propagate into billing, reporting and exams.
• Governing rules:
  • Section 206 and the 2019 Fiduciary Interpretation - reasonable inquiry into the client's financial situation, investment experience and objectives before advising; update periodically - https://www.sec.gov/rules/interp/2019/ia-5248.pdf
  • Rule 204-3 - deliver Part 2A brochure and Part 2B supplements before or at the time of entering the advisory contract - https://www.law.cornell.edu/cfr/text/17/275.204-3
  • Rule 17 CFR 275.204-5 and Form CRS instructions - deliver Form CRS to retail investors before or at the time of entering the agreement - https://www.sec.gov/rules-regulations/2019/06/form-crs-relationship-summary-amendments-form-adv
  • Reg S-P (17 CFR 248.4, 248.5) - initial privacy notice at account opening; annual notice unless the exception applies - https://www.law.cornell.edu/cfr/text/17/part-248/subpart-A
  • Reg S-ID (17 CFR 248.201) - identity theft red flags program for covered accounts - https://www.sec.gov/rules-regulations/2013/04/identity-theft-red-flags-rules
  • USA PATRIOT Act Section 326 CIP - performed by the custodian (bank or broker-dealer) today; a joint SEC/FinCEN CIP rule for RIAs was proposed May 13, 2024 and, as far as I could verify, has not been finalized; the broader IA AML rule is effective Jan 1, 2028 - https://www.fincen.gov/news/news-releases/fincen-issues-final-rule-postpone-effective-date-investment-adviser-rule-2028
  • OFAC sanctions regulations (31 CFR Chapter V) - apply to all U.S. persons regardless of the FinCEN delay; screen clients and payers - https://ofac.treasury.gov/
  • Section 205(a)(2), (3) - advisory contract may not be assigned without client consent; partnership membership changes must be disclosed - https://www.law.cornell.edu/uscode/text/15/80b-5
• Required records/deliverables:
  • Signed investment advisory agreement (fee schedule, discretion, termination, assignment clause, no hedge clause that waives fiduciary duty)
  • Client profile / risk tolerance questionnaire / Investment Policy Statement (IPS)
  • Delivery evidence for ADV 2A, 2B, Form CRS, privacy notice (date, method)
  • Custodian account application, LPOA for trading and fee deduction, standing letters of authorization if any
  • Identity documents or custodian CIP confirmation; OFAC screening record
  • Trusted contact person designation (best practice; FINRA Rule 4512 for BDs, Senior Safe Act for RIAs)
• Cadence items:
  • Event | Full onboarding packet complete before first trade | before trading authority is used
  • Annual | Client profile/IPS refresh (at annual review meeting) | annually, documented
  • Annual | Privacy notice (if not exempt) and ADV 2A summary of changes | 120 days after FYE
  • Event | Re-paper on fee change, strategy change, or agreement assignment (ownership change) | before effective date
• Owner role: Operations/Client Service Associate executes; advisor (IAR) owns suitability and IPS; CCO spot-checks a sample monthly.
• Best practices:
  • One onboarding checklist in the CRM (Wealthbox, Redtail, Salesforce FSC) with required fields that block "account open" status until disclosures are logged.
  • Use custodian digital account opening (Schwab Advisor Center digital onboarding, Fidelity Wealthscape) with e-signature; retain the audit trail PDF.
  • Store IPS and risk questionnaire as PDFs in the document system, not just as CRM fields.
  • Record the exact date and method for every disclosure delivery; examiners ask for it.
  • Collect a trusted contact and document capacity/senior-investor procedures (FY2026 emphasizes older investors).
• Common exam deficiencies / pitfalls:
  • No evidence of brochure or Form CRS delivery at inception.
  • Agreements with hedge clauses, auto-assignment, or fee terms inconsistent with Part 2A Item 5.
  • Stale client profiles (no update in 3+ years) while the account is still traded discretionarily.
  • Accounts traded before the agreement was countersigned.
• Model-provider/TAMP-strategist differences:
  • The strategist's "client" is usually the TAMP sponsor, not the end investor. Onboarding is a sub-advisory or model-license agreement with the sponsor (fees, data rights, performance reporting, IP license, termination, indemnities), plus the sponsor's due diligence questionnaire.
  • Research subscribers: onboarding is terms of service, payment, entitlement provisioning, and a representation that the subscriber is a financial professional (if the product is marketed as impersonal advice to professionals). Keep the subscriber agreement, the professional-status representation and the delivery log.
  • Form CRS and IPS are typically not applicable to institutional/professional subscribers.

Domain: Advisory Agreements & Disclosures (ADV Part 2, Form CRS)

• Why it matters: Disclosure is how conflicts are cured under the duty of loyalty; inaccurate or stale disclosure is the most common basis for Section 206(2) negligence charges.
• Governing rules:
  • Rule 204-3 Brochure Rule - deliver Part 2A and 2B at or before contract; annually within 120 days of FYE deliver updated brochure or summary of material changes with an offer; exception for impersonal advice under $500 per year and for registered investment company clients - https://www.law.cornell.edu/cfr/text/17/275.204-3
  • Form ADV Part 2A Items 1-18 - plain English narrative; Item 2 summary of material changes; Item 5 fees; Item 10/11 conflicts; Item 12 brokerage; Item 15 custody; Item 18 financial information (audited balance sheet if prepayment of more than $1,200 per client, 6+ months in advance) - https://www.sec.gov/files/formadv-instructions.pdf
  • Form ADV Part 3 (Form CRS) - 2 pages (4 for dual registrants), prescribed headings, conversation starters; deliver to retail investors at the earliest of recommendation, account opening or order; redeliver on new account/rollover recommendation; amend within 30 days and communicate within 60 days - https://www.sec.gov/rules-regulations/2019/06/form-crs-relationship-summary-amendments-form-adv
  • Section 205 - contract terms: no performance fees except qualified clients; no assignment without consent - https://www.law.cornell.edu/uscode/text/15/80b-5
  • SEC Staff FAQs on Form CRS - https://www.sec.gov/rules-regulations/staff-guidance/trading-markets-frequently-asked-questions/frequently-asked-questions-form-crs
• Required records/deliverables:
  • Current and historical ADV 2A/2B/CRS with filing receipts
  • Delivery logs (initial, annual, event-driven)
  • Advisory agreement templates (versioned) and executed agreements
  • Fee schedule master and any negotiated exceptions, approved by a principal
• Cadence items:
  • Annual | Part 2A update and delivery (or summary plus offer) | file within 90 days of FYE, deliver within 120 days
  • Annual | Part 2B supplement review for every supervised person who gives advice | with annual amendment
  • Event | Form CRS amendment | 30 days; communicate to existing retail clients within 60 days
  • Event | Interim Part 2A amendment for material inaccuracy | promptly
  • Event | Agreement re-execution on assignment (change of control) | before closing
• Owner role: CCO drafts with counsel; CEO approves; Operations handles delivery logs and agreement versions.
• Best practices:
  • Maintain a "disclosure-to-practice" crosswalk: each ADV sentence about fees, trading, custody and conflicts is tied to the procedure that makes it true.
  • Use a mail-merge or portal delivery with timestamp evidence; for email delivery, retain the sent item and the recipient consent to electronic delivery.
  • Keep a single approved fee schedule; any deviation requires documented approval and matching agreement language.
  • Re-read Item 5 and Item 12 of Part 2A every quarter against actual billing and trading practice.
• Common exam deficiencies / pitfalls:
  • Fee practices (minimums, tiering, billing on cash, billing in advance vs arrears) that do not match Part 2A.
  • Form CRS missing required wording, or not delivered to rollover prospects.
  • Part 2B supplements missing for people who actually give advice.
  • Disclosures that say "may" for conflicts that actually exist (SEC has criticized hypothetical framing).
• Model-provider/TAMP-strategist differences:
  • Disclose the model-delivery relationship in Part 2A Item 4 (services), Item 5 (strategist fee paid by sponsor or deducted by sponsor), Item 8 (strategy risks, model implementation differences), Item 10 (platform affiliations).
  • Describe the research subscription as impersonal investment advice if that is how it is sold, state who the intended audience is, and cross-reference the publisher's exclusion analysis in Open Questions.
  • Consider whether the brochure delivery exception for impersonal advice under $500/year applies to subscriptions; above that, deliver the brochure to subscribers (practice varies; confirm with counsel).

Domain: Custody & Custodian Relationships

• Why it matters: The custody rule is a perennial exam and enforcement focus and is named again in FY2026. Most small RIAs have custody solely by fee deduction, which has light requirements; standing letters of authorization and check handling create traps.
• Governing rules:
  • Rule 206(4)-2 Custody Rule - client funds/securities at a qualified custodian; notify clients of custodian; reasonable belief after due inquiry that custodian sends quarterly statements; surprise exam by independent accountant within 120 days of chosen date and Form ADV-E filing, unless exempt; fee deduction authority alone is exempt from surprise exam - https://www.sec.gov/rules-regulations/2009/12/custody-funds-or-securities-clients-investment-advisers
  • SEC Staff IM Guidance Update 2017-01 and the Feb 21, 2017 Investment Adviser Association no-action letter - standing letters of authorization (SLOAs) to third parties constitute custody but no surprise exam is required if the 7 conditions are met - https://www.sec.gov/investment/im-guidance-2017-01.pdf
  • Custody Rule Staff FAQs - inadvertent receipt of client funds: return to sender within 3 business days (checks payable to third parties may be forwarded within 3 business days) - https://www.sec.gov/divisions/investment/custody_faq_030510.htm
  • Form ADV Part 1A Item 9 - report custody, amounts and reasons - https://www.sec.gov/files/formadv-instructions.pdf
  • Note: the 2023 proposed Safeguarding Rule (expansion of custody to all assets) was withdrawn June 12, 2025 - https://www.stinson.com/newsroom-publications-sec-withdraws-proposed-rules-affecting-investment-advisers-funds-and-broker-dealers
• Required records/deliverables:
  • Custodial agreements, advisor service agreements, LPOA scope documentation
  • SLOA inventory with the 7-condition checklist for each
  • Quarterly statement delivery confirmation (custodian attestation or sample testing)
  • Password/credential policy (no client login credentials held by staff; holding them is custody)
  • Check log for inadvertent receipts and forwarding dates
  • ADV-E and surprise exam report if applicable
• Cadence items:
  • Daily | Custodian alerts review (address changes, money movement, new SLOAs) | daily
  • Quarterly | Confirm custodian sent statements; compare adviser-produced reports with custodian data | quarter-end plus 30 days
  • Quarterly | Reconcile SLOA list to custodian records | quarterly
  • Annual | Custody determination memo for ADV Item 9 | with ADV amendment
  • Annual | Surprise exam and ADV-E (only if custody beyond fee deduction/SLOA) | exam within 120 days of chosen date; ADV-E filed by accountant within 120 days of exam date
  • Event | Inadvertent receipt of client check or securities | return/forward within 3 business days; log
• Owner role: Head of Operations owns custodian relationships and money-movement controls; CCO owns the custody determination.
• Best practices:
  • Dual-approval for all third-party money movement; verbal callback to the client at a known number for any new wire or SLOA.
  • Prohibit staff from holding client custodian login credentials; use advisor-view-only access.
  • Run the 7-condition SLOA checklist in the CRM as a required form before accepting any SLOA.
  • Keep a custodial statement reconciliation (holdings and cash) at least monthly via the portfolio accounting system.
  • Include a line in client reports urging comparison with custodian statements (Rule 206(4)-2(a)(2) notice requirement).
• Common exam deficiencies / pitfalls:
  • Undisclosed custody via SLOAs, bill-pay authority, trustee roles, or possession of client passwords.
  • ADV Item 9 answers inconsistent with reality (e.g., "no custody" while deducting fees).
  • No documented reasonable belief that the custodian sends statements.
  • Surprise exam late or ADV-E not filed.
• Model-provider/TAMP-strategist differences:
  • A pure model provider with no account access, no fee deduction from end-investor accounts and no LPOA generally has no custody; the TAMP or the end-client's adviser does. Document this determination each year.
  • If the strategist receives fees from the sponsor (not deducted from client accounts by the strategist), the fee-deduction form of custody does not arise.
  • Research subscription payments are commercial receipts, not client assets.

Domain: Trading, Best Execution & Rebalancing

• Why it matters: Best execution is part of the duty of care, named in the FY2026 priorities ("best execution designed to maximize investor value"), and trade allocation fairness is a long-running enforcement theme.
• Governing rules:
  • Section 206 and the 2019 Fiduciary Interpretation - seek best execution: evaluate execution quality and full range of broker services, not just lowest commission - https://www.sec.gov/rules/interp/2019/ia-5248.pdf
  • Division of Examinations Risk Alert, "Compliance Issues Related to Best Execution by Investment Advisers" (July 11, 2018) - periodic and systematic evaluation, documented - https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Best%20Execution.pdf
  • Exchange Act Section 28(e) safe harbor - soft dollars for eligible brokerage and research; disclose in ADV Item 12 - https://www.sec.gov/rules/interp/2006/34-54165.pdf
  • Rule 204-2(a)(3) and (a)(7)(iii) - order memoranda (terms, person who recommended, person who placed, date, broker, discretion); T+1 companion: retain confirmations, allocations and affirmations with time stamps - https://www.mcdermottlaw.com/insights/reminder-t1-settlement-cycle-and-corresponding-ria-books-and-records-rules-go-into-effect-may-28/
  • Section 206(3) and Rule 206(3)-2 - principal and agency cross transactions require disclosure and consent - https://www.law.cornell.edu/cfr/text/17/275.206(3)-2
  • Exchange Act Rule 15c6-1 - T+1 settlement effective May 28, 2024 - https://www.sec.gov/newsroom/press-releases/2024-62
  • Form ADV Part 2A Item 12 - brokerage practices, directed brokerage, aggregation - https://www.sec.gov/files/formadv-instructions.pdf
• Required records/deliverables:
  • Trade blotter / order memoranda for every order
  • Allocation policy and pre-trade allocation records for block trades; average-price confirmation
  • Best execution committee minutes and broker scorecards (at least annually; quarterly preferred)
  • Trade error log and resolution evidence
  • Rebalancing policy (drift bands, cash management, tax-loss harvesting rules) and rebalancer audit logs
  • Soft dollar budget and eligibility analysis if used
• Cadence items:
  • Daily | Trade reconciliation to custodian (executions, settlements, breaks) | T+1 morning
  • Daily | Review rebalancer proposed trades for restrictions, cash needs, wash sales before release | pre-trade
  • Weekly | Drift report review across all households | weekly
  • Quarterly | Best execution review (execution quality, commission/fee comparison, custodian service levels) | quarterly or at least annually
  • Quarterly | Trade error log review with CCO | quarterly
  • Annual | Allocation and aggregation policy review | with annual review
• Owner role: Head of Trading/Operations (often the same person at 12 people) with CCO review; portfolio manager approves model changes.
• Best practices:
  • Use a rebalancer with pre-trade compliance checks (Orion Eclipse, Black Diamond Rebalancer, iRebal, Tamarac, Altruist) and retain system logs as order memoranda.
  • Block trade across accounts with pre-trade allocation on file; allocate at average price; document any deviation and reason.
  • Score custodians/brokers on at least five factors (price improvement, fill speed, settlement issues, service, cost) and keep the scorecard.
  • Define trade error as any deviation from intended order; the firm absorbs losses, clients keep gains unless the error account policy and disclosures say otherwise; never net errors across clients.
  • Build T+1 readiness: same-day allocation and affirmation, and retention of time-stamped records.
• Common exam deficiencies / pitfalls:
  • No documented best execution review, or review that only compares commissions.
  • Allocations favoring proprietary or performance-fee accounts; late or missing pre-trade allocation.
  • Trade errors corrected in client accounts without documentation or with clients bearing losses.
  • Directed brokerage conflicts undisclosed.
• Model-provider/TAMP-strategist differences:
  • A model provider does not execute for end clients; the sponsor or overlay manager does. The strategist still owes care in model construction (liquidity, implementability across sponsors, tax awareness if marketed) and should document the delivery time stamp for each model update.
  • Sequencing policy: deliver model updates to all sponsors simultaneously (or by a disclosed rotation) and trade any directly managed accounts under a disclosed sequence relative to sponsor delivery.
  • Best execution review is replaced by a sponsor implementation review: track dispersion between model and sponsor-implemented returns and ask sponsors about trade rotation.

Domain: Fee Billing & Revenue

• Why it matters: Overbilling is the most frequent retail-adviser enforcement theme (fees on excluded assets, wrong tiers, billing after termination). Fee deduction creates custody and must match the agreement and ADV.
• Governing rules:
  • Section 206 - fees must match the agreement and disclosure; errors must be refunded with interest where appropriate - https://www.law.cornell.edu/uscode/text/15/80b-6
  • Form ADV Part 2A Item 5 - describe fee schedule, billing in advance/arrears, refund on termination, other costs; Item 18 if prepaying more than $1,200 six or more months in advance - https://www.sec.gov/files/formadv-instructions.pdf
  • Rule 206(4)-2 - fee deduction is custody; custodian must send statements; client receives notice - https://www.sec.gov/rules-regulations/2009/12/custody-funds-or-securities-clients-investment-advisers
  • Rule 204-2(a)(1), (2), (6) - journals, ledgers, bills and statements supporting fee calculations - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Rule 205-3 - performance fees only for qualified clients ($1.4M/$2.7M from June 29, 2026) - https://www.sec.gov/files/rules/ia/2026/ia-6961.pdf
  • Division of Examinations Risk Alert, "Investment Advisers' Fee Calculations" (Nov 10, 2021) - common errors: valuation date, tiering, household breakpoints, excluded assets, prorations - https://www.sec.gov/files/exams-risk-alert-fee-calculations.pdf
  • ERISA Section 408(b)(2) regulation (29 CFR 2550.408b-2) - covered service providers to ERISA plans must disclose services, fiduciary status and compensation in advance - https://www.dol.gov/agencies/ebsa/laws-and-regulations/rules-and-regulations/completed-rulemaking/1210-AB08
• Required records/deliverables:
  • Fee schedule master; executed agreement fee terms; billing system configuration export
  • Quarterly billing file with per-account calculation (value date, rate, proration, exclusions)
  • Custodian fee debit confirmation and reconciliation to invoices and GL
  • Fee invoices/statements to clients (where required by agreement or state rule)
  • Refund log for terminations and errors
  • 408(b)(2) disclosures for ERISA plan clients
• Cadence items:
  • Quarterly | Calculate fees, CCO sample test (minimum 10% of accounts or 25 accounts), release to custodian | within 10 business days after quarter-end
  • Quarterly | Reconcile custodian fee debits to billing file and to bank deposits/GL | within 15 business days after quarter-end
  • Quarterly | Revenue recognition and deferred revenue entries (advance billing) | month-end close
  • Annual | Full billing audit against agreements and Part 2A Item 5 | Q1 with ADV
  • Event | Termination proration and refund | within 30 days of termination (or as agreement states)
  • Event | Fee schedule change | amend agreements and Part 2A before effective date
• Owner role: Head of Operations runs billing; CCO tests; outsourced bookkeeper/CFO posts and reconciles.
• Best practices:
  • Bill from the portfolio accounting system (Orion, Black Diamond, Tamarac, Addepar) using custodian-reconciled values, not from spreadsheets.
  • Lock the fee schedule in the system; require a second approver for any account-level override.
  • Test every quarter: recompute a sample by hand, confirm excluded assets and householding, confirm termination prorations.
  • Send a fee statement showing formula, value, period and amount even when the custodian deducts; some states require it.
  • Keep a written "billing methodology" document that matches Part 2A word for word.
• Common exam deficiencies / pitfalls:
  • Billing on assets the agreement excludes (cash, held-away, alternatives, legacy positions).
  • Not applying breakpoints or household aggregation promised in Part 2A.
  • Billing in advance without a refund mechanism on termination.
  • Fee debits with no client-facing statement and no reconciliation.
• Model-provider/TAMP-strategist differences:
  • Strategist fee is usually paid by the sponsor, calculated on platform assets following the model, from the sponsor's data. The strategist should reconcile sponsor-reported assets and fee remittances to its own records each period and keep the sponsor's fee statements.
  • Research subscriptions: recurring billing (Stripe, Chargebee, QuickBooks) with sales-tax determination by state for digital information services (several states tax SaaS/information services; firm-specific nexus analysis required). Refund and cancellation terms live in the terms of service.
  • Revenue recognition: subscriptions billed annually in advance are deferred and recognized ratably; strategist fees typically in arrears.

Domain: Portfolio Reporting & Performance (GIPS optional)

• Why it matters: Client reports and performance figures are advertisements when used with prospects, and are the primary evidence of care for existing clients. Performance presentation errors are the top Marketing Rule deficiency.
• Governing rules:
  • Rule 206(4)-1(d) - performance in advertisements: net and gross with equal prominence; 1-, 5-, 10-year periods (or since inception) as of the most recent calendar year-end; hypothetical performance conditions; related and extracted performance conditions - https://www.sec.gov/rules-regulations/2020/12/investment-adviser-marketing
  • Marketing Rule Staff FAQs (updated March 19, 2025; Jan 15, 2026) - gross-only extracted performance and characteristics permitted if total portfolio gross and net are shown with equal prominence; model fee use - https://www.sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/marketing-compliance-frequently-asked-questions
  • Rule 204-2(a)(16) - keep all records necessary to form the basis for performance shown in any advertisement, for 5 years from last use - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Rule 206(4)-2(a)(2) - statement in adviser reports urging comparison to custodian statements - https://www.sec.gov/rules-regulations/2009/12/custody-funds-or-securities-clients-investment-advisers
  • GIPS Standards (CFA Institute, 2020 edition) - voluntary; if claiming compliance, firm-wide composites, verification optional - https://www.gipsstandards.org/
• Required records/deliverables:
  • Reconciled portfolio accounting data (positions, cash, transactions) tied to custodian
  • Performance calculation methodology document (TWR, cash flow treatment, fee model used for net)
  • Composite definitions and membership lists if composites are advertised
  • Quarterly client reports and delivery log
  • Benchmark selection rationale and disclosures
• Cadence items:
  • Daily | Position and transaction reconciliation to custodian | T+1
  • Monthly | Performance calculation lock and exception review (outliers, large flows) | 5 business days after month-end
  • Quarterly | Client performance reports produced, CCO review of a sample, delivered | within 30 days after quarter-end
  • Annual | Calendar year-end performance refresh for all marketing (1/5/10 year) | by Jan 31 (staff FAQ: within one month is reasonable)
  • Annual | Composite policy review; GIPS verification if claimed | annually
• Owner role: Head of Operations (performance analyst role); CCO reviews marketing use; outsourced performance verifier if GIPS.
• Best practices:
  • Compute net performance using the highest fee actually charged to the intended audience, or the model fee per the Jan 15, 2026 FAQ, and document the choice.
  • Keep a "performance book" per strategy: inception date, methodology, composite rules, benchmark, data source, every version of the fact sheet.
  • Freeze and archive each quarter's data so advertised numbers can be reproduced years later.
  • Label hypothetical, model, back-tested and extracted performance clearly and keep the audience-relevance policy required by Rule 206(4)-1(d)(6).
• Common exam deficiencies / pitfalls:
  • Gross-only performance; net performance lacking equal prominence.
  • Hypothetical performance shown to a general audience without the required policies and procedures.
  • Inability to produce the records behind a track record.
  • Cherry-picked time periods or benchmarks without disclosure.
• Model-provider/TAMP-strategist differences:
  • Model performance is hypothetical performance under 206(4)-1(d)(6) unless it is actual composite performance of accounts the firm manages. Sponsors often present strategist performance; the strategist should supply compliant materials and keep evidence of what it supplied.
  • Dispersion reporting: track model vs sponsor-implemented returns and disclose that end-client results differ due to sponsor trading, fees and timing.
  • GIPS is a differentiator in TAMP due diligence; many strategist platforms ask for GIPS-compliant composites or an explanation of why not.

Domain: Marketing & Advertising (Marketing Rule)

• Why it matters: The Marketing Rule has produced the largest wave of RIA enforcement since 2023 (hypothetical performance, testimonials, untrue claims). A Dec 16, 2025 risk alert signals continuing exam focus on testimonials, endorsements and third-party ratings.
• Governing rules:
  • Rule 206(4)-1 Marketing Rule (compliance date Nov 4, 2022) - seven general prohibitions; testimonial/endorsement conditions (disclosure, oversight, written agreement unless de minimis $1,000 or less in 12 months or affiliated, disqualification); third-party ratings conditions; performance conditions - https://www.sec.gov/rules-regulations/2020/12/investment-adviser-marketing
  • Marketing Rule Staff FAQs - https://www.sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/marketing-compliance-frequently-asked-questions
  • Risk Alert Dec 16, 2025 on testimonials, endorsements and third-party ratings - https://www.sec.gov/files/exams-riskalert-mrkt-rule-2512-508.pdf
  • Risk Alert April 17, 2024 on general prohibitions and Form ADV marketing items - https://www.sec.gov/files/exams-risk-alert-marketing-rule-041724.pdf
  • Rule 204-2(a)(11) - keep a copy of every advertisement (and any communication sent to 10 or more persons) and the records supporting it - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Form ADV Part 1A Item 5.L - check-the-box disclosure of performance, hypothetical, testimonials, third-party ratings use - https://www.sec.gov/files/formadv-instructions.pdf
  • Rule 206(4)-7 - written marketing review procedures (pre-use review is not mandated by the rule itself but is the expected control)
• Required records/deliverables:
  • Marketing review log (item, version, reviewer, date, approval, substantiation references)
  • Approved advertisement archive (website snapshots, decks, fact sheets, social posts, emails to 10+)
  • Testimonial/endorsement register with written agreements, compensation, disclosure placement, disqualification checks (bad-actor review)
  • Third-party rating due diligence files (questionnaire, methodology, no pay-for-placement)
  • Substantiation files for every material statement of fact
  • Hypothetical performance policies and intended-audience documentation
• Cadence items:
  • Event | Pre-use review and approval of every advertisement | before first use
  • Monthly | Website and social media sweep against approved versions | monthly
  • Quarterly | Review testimonial/endorsement arrangements and promoter disqualification | quarterly
  • Quarterly | Refresh performance data in all live materials | within one month after quarter-end or calendar year-end
  • Annual | Marketing Rule training and ADV Item 5.L accuracy check | with annual amendment
• Owner role: CCO approves; Marketing lead (or outsourced agency) drafts; portfolio team substantiates performance.
• Best practices:
  • Define "advertisement" broadly in policy; treat LinkedIn posts, podcast descriptions and webinars that offer services as advertisements.
  • Use a review tool with versioning and audit trail (Smarsh, Global Relay, Red Oak, Hearsay for social, or a disciplined shared-drive workflow with a log).
  • Standard disclosure blocks for performance, hypothetical performance, testimonials ("paid, client, conflicts"), and third-party ratings (date, period, rater, compensation).
  • Keep a claims substantiation table: every superlative or statistic maps to a source document.
  • Pre-clear promoters: written agreement, bad-actor questionnaire, annual re-certification.
• Common exam deficiencies / pitfalls:
  • Hypothetical performance on public websites without audience policies.
  • Testimonials lacking "clear and prominent" disclosures of client status and compensation.
  • Third-party ratings without due diligence or with missing date/period disclosures.
  • Books and records: inability to produce prior versions of the website.
• Model-provider/TAMP-strategist differences:
  • Marketing to financial professionals is still advertising under the rule; the rule covers communications to prospective clients, which includes sponsors and advisors who would subscribe.
  • Research "track records" (hit rates, signal performance) are performance or hypothetical performance and need the (d)(6) policies; the firm can rely on the fact that the audience is professional for audience relevance, but must document it.
  • Testimonials from advisors who use the research or model are endorsements; if they are compensated (including free subscriptions), the written agreement and disclosure conditions apply above $1,000 in 12 months.

Domain: Books & Records

• Why it matters: Rule 204-2 is the second rule in nearly every adviser enforcement action because missing records make every other violation unprovable or undefendable. Exam document requests test retrieval speed.
• Governing rules:
  • Rule 204-2 (17 CFR 275.204-2) - enumerated records: journals, ledgers, order memoranda, bank records, bills, written communications, written agreements, advertisements and support, personal trading, compliance manual and annual review, proxy voting, custody records, Form CRS delivery; retain 5 years from end of fiscal year in which the last entry was made, first 2 years in an appropriate office; corporate documents until 3 years after termination; performance records 5 years from last use - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Rule 204-2(g) - electronic storage: arrange and index, promptly produce, maintain duplicate copy, safeguard from loss/alteration - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Rule 204-2(a)(7)(iii) as amended for T+1 - confirmations, allocations, affirmations with time stamps - https://www.mcdermottlaw.com/insights/reminder-t1-settlement-cycle-and-corresponding-ria-books-and-records-rules-go-into-effect-may-28/
  • Section 204 - records subject to SEC examination at any time - https://www.law.cornell.edu/uscode/text/15/80b-4
  • SEC off-channel communications enforcement (2022-2024, including RIAs in 2024) - business communications on personal text/WhatsApp must be captured - https://www.sec.gov/newsroom/press-releases/2024-98
• Required records/deliverables:
  • Records inventory mapping each 204-2 item to system of record, retention period, owner and retrieval method
  • Email, chat, text and social archive with legal hold capability
  • Document management with immutable storage (WORM or equivalent) for required records
  • Destruction log for records past retention
• Cadence items:
  • Daily | E-communications capture health check (archive ingestion alerts) | daily
  • Monthly | Random sample review of archived communications (lexicon-based) | monthly
  • Quarterly | Records inventory spot-check: retrieve 5 random required records within 1 hour | quarterly
  • Annual | Retention schedule review and approved destruction run | annually
  • Event | Legal hold on exam notice, complaint, litigation or regulatory inquiry | immediately
• Owner role: Head of Operations owns systems and inventory; CCO owns surveillance and holds.
• Best practices:
  • Archive all channels used for business (email, Teams/Slack, texts via a captured number such as Smarsh, Global Relay, MirrorWeb, CellTrust) and prohibit uncaptured channels in writing with annual attestation.
  • Store "required records" in a separate immutable repository from working files.
  • Name files by a convention (YYYY-MM-DD_Type_Client) and keep an index; examiners ask for lists before documents.
  • Test retrieval under time pressure quarterly.
• Common exam deficiencies / pitfalls:
  • Off-channel texting with clients, no capture.
  • Missing written agreements, old versions of the compliance manual, or prior website versions.
  • Trade blotter incomplete (missing who placed the order or whether discretionary).
  • Records kept only in a vendor system the firm no longer subscribes to.
• Model-provider/TAMP-strategist differences:
  • Rule 204-2(a)(11) covers each notice, circular, newsletter or research report sent to 10 or more persons; keep every published research piece with its distribution date and a memo of the facts supporting any recommendation (the rule requires the memorandum indicating the reasons if the communication recommends a security and the reasons are not stated in it).
  • Keep model change records: the model version, time stamp of decision, time stamp of delivery to each sponsor, and the rationale memo.
  • Sponsor and subscriber agreements are "written agreements" under 204-2(a)(10).

Domain: Privacy, Cybersecurity & Data (Reg S-P, Reg S-ID)

• Why it matters: The 2024 Reg S-P amendments took full effect for smaller advisers on June 3, 2026 and are a named FY2026 exam priority, along with Reg S-ID and AI-driven cyber risk. The adviser-specific cyber rule was withdrawn, so these two rules plus 206(4)-7 are the framework.
• Governing rules:
  • Reg S-P as amended (17 CFR 248.30), Rel. 34-100155 (May 16, 2024) - written incident response program; customer notification as soon as practicable and no later than 30 days after becoming aware of unauthorized access to or use of sensitive customer information (unless no reasonable likelihood of substantial harm); service provider oversight including provider notice to the adviser within 72 hours of a breach; expanded scope to "customer information" including information received from other financial institutions; records of the program and incidents; annual privacy notice exception codified - https://www.sec.gov/files/rules/final/2024/34-100155.pdf
  • Reg S-P Safeguards Rule (248.30(a)) - written policies to protect customer records and information; Disposal Rule (248.30(b)) - https://www.law.cornell.edu/cfr/text/17/248.30
  • Reg S-P Privacy Rule (248.4 to 248.9) - initial and annual privacy notices, opt-out for sharing with nonaffiliated third parties, exceptions - https://www.law.cornell.edu/cfr/text/17/part-248/subpart-A
  • Reg S-ID (17 CFR 248.201-202) - identity theft prevention program for covered accounts: identify red flags, detect, respond, update; board/senior management approval and annual report - https://www.sec.gov/rules-regulations/2013/04/identity-theft-red-flags-rules
  • Rule 206(4)-7 - cybersecurity policies as part of the compliance program (SEC 2015 Cybersecurity Guidance Update IM-2015-02) - https://www.sec.gov/investment/im-guidance-2015-02.pdf
  • State breach notification laws (all 50 states; e.g., Florida FIPA, 30 days) and state privacy laws - firm-specific by client residence - https://www.ncsl.org/technology-and-communication/security-breach-notification-laws
  • SEC Compliance Outreach on Regulation S-P (Sept 25, 2025) - https://www.sec.gov/newsroom/meetings-events/compliance-outreach-regulation-s-p
• Required records/deliverables:
  • Written Information Security Program (WISP) including incident response program, service provider oversight, and disposal
  • Data inventory: where sensitive customer information lives, who can access it, which vendors touch it
  • Service provider list with contract clauses or assurances covering the 72-hour notice and safeguards
  • Incident log (including incidents that did not require notice, with the "no substantial harm" determination)
  • Customer notice templates compliant with 248.30(a)(4) content requirements
  • Reg S-ID program, red flags list, annual report to senior management
  • Annual risk assessment, penetration test / vulnerability scan results, phishing test results, training records
  • Cyber insurance policy and incident response retainer
• Cadence items:
  • Daily | Security monitoring alerts (EDR, MFA anomalies, email security) | daily
  • Monthly | Access review for leavers/movers; patch status | monthly
  • Quarterly | Phishing simulation and security awareness refresh | quarterly
  • Quarterly | Vendor incident-notice assurance check for new vendors | quarterly
  • Annual | Cybersecurity risk assessment and WISP update | annually
  • Annual | Incident response tabletop exercise | annually
  • Annual | Reg S-ID program review and report to senior management | annually
  • Annual | Privacy notice delivery (or document the exception) | with annual ADV delivery or at account opening
  • Event | Incident response: assess within 72 hours-ish internal target, customer notice within 30 days of awareness | per WISP
• Owner role: Head of Operations as information security lead with an outsourced MSP/MSSP; CCO owns regulatory notices; CEO approves customer notices.
• Best practices:
  • MFA everywhere, phishing-resistant for admin and custodian access; EDR on all endpoints; encrypted laptops; conditional access by device.
  • Treat the 30-day clock as starting at "awareness of unauthorized access," and pre-draft notices and a decision memo template so the "no substantial harm" analysis is written the same day.
  • Get vendor assurances in writing: addenda for small vendors, SOC 2 reports and published incident-notice commitments for large ones, and document best efforts where a large provider refuses 72-hour language.
  • Run the tabletop with the actual notification timeline, state law overlay and custodian notification steps.
  • Dispose of data on a schedule; keep the disposal certificate.
• Common exam deficiencies / pitfalls:
  • WISP not updated for the 2024 amendments (no incident response program, no 30-day notice procedure, no service provider oversight).
  • Vendor list incomplete or no evidence of oversight.
  • Reg S-ID program absent because the firm wrongly assumed it has no covered accounts (advisory accounts with fee deduction or money movement typically qualify).
  • Weak access controls: shared logins, no MFA, former employees with active credentials.
• Model-provider/TAMP-strategist differences:
  • "Customer information" includes information about another financial institution's customers that the firm receives; a strategist receiving account-level data from a sponsor is covered even without a direct customer relationship.
  • Research subscribers who are individuals (sole proprietors, individual advisors) may be "consumers" with nonpublic personal information (payment details, contact info). Scope the privacy program to include them.
  • Reg S-ID "covered accounts" may be limited if the firm does not open or maintain investor accounts; document the determination annually.

Domain: Vendor / Third-Party Oversight

• Why it matters: Reg S-P now makes service provider oversight an explicit requirement, the SEC's outsourcing proposal was withdrawn (so there is no stand-alone rule), and most small-RIA operational risk sits in custodians, TAMPs, software and the MSP.
• Governing rules:
  • Reg S-P 248.30(a)(5) - policies to oversee service providers, including due diligence and monitoring, and provider notice to the adviser as soon as possible and no later than 72 hours after becoming aware of a breach of the adviser's customer information - https://www.sec.gov/files/rules/final/2024/34-100155.pdf
  • Rule 206(4)-7 - compliance program must address outsourced functions; the adviser remains responsible - https://www.sec.gov/rules-regulations/2003/12/compliance-programs-investment-companies-investment-advisers
  • Rule 204-2(g) - third-party electronic recordkeeping must still meet accessibility and integrity standards - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Note: SEC proposed outsourcing rule (Oct 2022) withdrawn June 12, 2025 - https://www.stinson.com/newsroom-publications-sec-withdraws-proposed-rules-affecting-investment-advisers-funds-and-broker-dealers
• Required records/deliverables:
  • Vendor inventory with criticality tier, data access type, contract, renewal date, owner
  • Due diligence files (SOC 1/SOC 2 reports, security questionnaires, financials for critical vendors, insurance certificates, BCP summaries)
  • Contract clauses: confidentiality, security, breach notice (72 hours), subcontractor flow-down, data return/destruction, audit rights
  • Annual review memo per critical vendor; issues log
• Cadence items:
  • Event | Pre-contract due diligence and risk tier assignment | before signature
  • Quarterly | Review SOC report bridge letters, security incidents, SLA performance for Tier 1 vendors | quarterly
  • Annual | Full review of Tier 1 and Tier 2 vendors (refresh SOC 2, questionnaire, contract check) | annually
  • Annual | Vendor inventory reconciliation to AP ledger | annually
  • Event | Vendor incident or material change (acquisition, outage, breach) | within 5 business days assess impact
• Owner role: Head of Operations; CCO signs off on vendors touching customer information; CEO signs contracts.
• Best practices:
  • Tier vendors: Tier 1 (custodian, TAMP, portfolio accounting, CRM, email/archive, MSP), Tier 2 (billing, marketing, research data), Tier 3 (no customer data).
  • Keep a standard security addendum and a fallback "assurance letter" for vendors that will not sign custom terms.
  • Reconcile the vendor list to accounts payable annually to catch shadow IT.
  • Include the vendor's own BCP and exit plan in Tier 1 files.
• Common exam deficiencies / pitfalls:
  • No vendor inventory; no due diligence beyond a brochure.
  • Contracts lacking breach notice terms post-June 2026.
  • Reliance on a vendor for required records without a retrieval plan if the relationship ends.
• Model-provider/TAMP-strategist differences:
  • The TAMP is both a client/distribution partner and a critical vendor (data, reporting, fee remittance). Oversee it both ways: strategist due diligence on the sponsor's controls and reconciliation of what the sponsor reports.
  • Data vendors for research (market data, fundamentals, alternative data) require license compliance review (redistribution rights for published research) and, for alternative data, an MNPI/consent review.

Domain: Business Continuity & Succession

• Why it matters: The SEC treats BCP as part of the fiduciary duty and the compliance rule (2016 guidance), and examiners request BCPs routinely. A 12-person firm's key risks are key-person loss, single-location outages and vendor outages.
• Governing rules:
  • Rule 206(4)-7 and SEC IM Guidance Update 2016-04 (June 2016) - advisers should adopt BCPs addressing systems, data, alternate locations, communications, vendor dependencies and transition plans; the 2016 proposed Rule 206(4)-4 was never adopted - https://www.sec.gov/investment/im-guidance-2016-04.pdf
  • Division of Examinations Risk Alert on BCP (Aug 27, 2013, post-Hurricane Sandy) - https://www.sec.gov/about/offices/ocie/business-continuity-plans-risk-alert.pdf
  • Form ADV Part 2A Item 18 - financial condition disclosure if impairment could affect commitments - https://www.sec.gov/files/formadv-instructions.pdf
  • Section 205(a)(2) - assignment of advisory contracts requires client consent (relevant to succession and sale) - https://www.law.cornell.edu/uscode/text/15/80b-5
  • State continuity/succession rules for state-registered advisers (NASAA Model Rule 2015) - reference only - https://www.nasaa.org/wp-content/uploads/2011/07/NASAA-Model-Rule-on-Business-Continuity-and-Succession-Planning.pdf
• Required records/deliverables:
  • Written BCP with RTO/RPO per critical function, call tree, alternate work arrangements, vendor contacts, data backup and restore procedures
  • Succession plan: interim decision authority, key-person insurance or buy-sell, client communication plan, custodian notification plan
  • Annual test results and remediation log
  • Backup verification logs (restore tests)
• Cadence items:
  • Monthly | Backup restore test of a sample | monthly
  • Quarterly | Call tree and vendor contact verification | quarterly
  • Annual | Full BCP test (tabletop or live failover) and plan update | annually
  • Annual | Succession plan review with owners and counsel | annually
  • Event | Plan activation and post-incident review | within 10 business days after event
• Owner role: Head of Operations owns the BCP; CEO owns succession; CCO ensures ADV disclosures and client notification obligations.
• Best practices:
  • Cloud-first stack with documented alternate access (any device, MFA) makes location loss a non-event; test it anyway.
  • Name a backup for every critical role (trading, billing, CCO, model delivery, research publication).
  • Keep a one-page "if the CEO is unavailable for 30 days" plan with signatories, bank access and custodian authorizations.
  • Include TAMP delivery continuity (who can send a model update if the PM is out) and research publication continuity.
• Common exam deficiencies / pitfalls:
  • BCP not tested or not updated after a move to remote work.
  • No succession plan at owner-dependent firms.
  • Vendor outage scenarios missing (custodian, portfolio accounting, email).
• Model-provider/TAMP-strategist differences:
  • Sponsors' due diligence will ask for the BCP and key-person plan; a thin plan can cost platform placement.
  • Research publication cadence commitments (e.g., weekly) create a service-level dependency; define the fallback (delay notice to subscribers, backup author).

Domain: HR, Supervision & Licensing (Series 65, U4, IAR CE)

• Why it matters: IAR registration is a state function even for SEC advisers; CE deficiency can make an IAR unable to renew. Supervision failures are a stand-alone basis for sanctions under Section 203(e)(6).
• Governing rules:
  • Section 203A(b)(1) and NSMIA - states retain authority to license IARs of SEC-registered advisers who have a place of business in the state - https://www.nasaa.org/industry-resources/investment-advisers/state-investment-adviser-registration-information/
  • NASAA Model Rule on IAR Examination Requirements - Series 65, or Series 66 plus Series 7, or waiver for CFP, CFA, ChFC, PFS, CIC designations; exam validity typically 2 years out of registration - https://www.nasaa.org/adopted-model-rule/examination-requirements-for-investment-adviser-representatives-2
  • NASAA IAR CE Model Rule - 12 credits per year (6 Products and Practice, 6 Ethics and Professional Responsibility), due Dec 31, reported to CRD; 25 jurisdictions adopted as of Sept 2026 (24 effective; Indiana Jan 1, 2027) - https://www.nasaa.org/industry-resources/investment-advisers/investment-adviser-representative-continuing-education/member-adoption/
  • Form U4 and U5 (via IARD/CRD) - register IARs; amend U4 within 30 days of a disclosable event; file U5 within 30 days of termination - https://www.finra.org/registration-exams-ce/classic-crd/forms
  • Section 203(e)(6) - supervision; Section 203(f) - bars on persons - https://www.law.cornell.edu/uscode/text/15/80b-3
  • Form ADV Part 2B - brochure supplement for each supervised person who formulates advice or has direct client contact with discretion; includes supervision description - https://www.sec.gov/files/formadv-instructions.pdf
  • Rule 204A-1 - access person onboarding reports - https://www.sec.gov/rules-regulations/2004/07/investment-adviser-codes-ethics
  • Employment law overlays (I-9, state wage law, remote worker nexus) - firm-specific
• Required records/deliverables:
  • Personnel compliance file: U4, fingerprints if required by state, exam/designation evidence, CE transcript, background check, attestations, training records, disciplinary history review (BrokerCheck/IAPD check at hire and annually)
  • Supervisory structure chart and written supervisory procedures
  • Onboarding/offboarding checklists with access provisioning and deprovisioning logs
  • Outside business activity (OBA) disclosures and approvals; Form U4 Item 13 accuracy
• Cadence items:
  • Event | New hire: background check, U4 (if IAR), access person setup, policy acknowledgments, initial holdings within 10 days | before client contact
  • Event | Termination: U5 within 30 days, access revoked same day, device return, final attestation | same day / 30 days
  • Quarterly | OBA and disciplinary attestation | quarterly
  • Annual | IAR CE completion check (target early December) | Dec 31 (practical cutoff ~Dec 26 CRD processing)
  • Annual | IAR registration renewals through IARD | December
  • Annual | Supervisory review of each IAR's client files and communications | annually
  • Event | U4 amendment for disclosable events | 30 days
• Owner role: CCO (registration and supervision); Head of Operations (HR administration, access); CEO (hiring decisions).
• Best practices:
  • Set the firm's internal IAR CE due date to Nov 30 using the FINRA Gateway firm due-date feature (available since May 2025 per iard.com).
  • Keep the IAR registration matrix (person, states, exam basis, CE status) reviewed monthly.
  • Use an HRIS or at least a shared checklist for onboarding and offboarding with IT ticket evidence.
  • Document supervision: who supervises whom, what they review, how often; match Part 2B wording.
• Common exam deficiencies / pitfalls:
  • IARs giving advice in states where they are not registered (place of business test).
  • U4 not updated for liens, bankruptcies, OBAs; U5 late.
  • CE lapses leading to "CE Inactive" status.
  • Terminated employees retaining access to systems or client data.
• Model-provider/TAMP-strategist differences:
  • Research analysts who do not give personalized advice to clients may not need IAR registration in some states, but anyone presenting to prospects or sponsors on behalf of the adviser often does; check each state's definition of "investment adviser representative."
  • Analysts are access persons regardless of licensing.

Domain: Insurance & Risk (E&O, fidelity bond)

• Why it matters: No SEC rule requires RIA insurance, but custodians, TAMPs and institutional clients require E&O and cyber coverage, and ERISA requires a fidelity bond when handling plan assets.
• Governing rules:
  • ERISA Section 412 and 29 CFR 2580 - fidelity bond for persons who handle plan funds: 10% of funds handled, minimum $1,000, maximum $500,000 ($1M if plan holds employer securities) - https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/fact-sheets/protect-your-employee-benefit-plan-with-an-erisa-fidelity-bond
  • Form ADV Part 2A Item 18 - financial condition disclosure - https://www.sec.gov/files/formadv-instructions.pdf
  • State-registered adviser bond requirements (NASAA model) - reference only if any state registration applies
  • Reg S-P - cyber insurance is not required but incident response funding is an implicit need - https://www.sec.gov/files/rules/final/2024/34-100155.pdf
• Required records/deliverables:
  • Policies: E&O (professional liability), cyber liability, fidelity/crime bond, D&O, EPLI, general liability, key-person life if used in succession
  • Certificates of insurance for sponsors/clients who require them
  • Annual coverage review memo (limits vs AUM, revenue, contractual requirements)
  • Claims and incident notice log (most policies require prompt notice)
• Cadence items:
  • Annual | Coverage review and renewal; broker market check | 90 days before renewal
  • Annual | Confirm ERISA bond amounts if handling plan assets | with plan year-end
  • Event | Notice to carrier of claim, complaint or incident that may give rise to claim | per policy (often 30 days)
• Owner role: CEO/COO with insurance broker; CCO coordinates claim notices.
• Best practices:
  • Match E&O limits to the largest sponsor or client contractual requirement (commonly $1M to $5M) and confirm coverage for model delivery and published research (some E&O forms exclude "publishing" activities; get an endorsement).
  • Confirm cyber policy covers regulatory notification costs, forensics and business interruption.
  • Keep a one-page insurance summary in the exam folder.
• Common exam deficiencies / pitfalls:
  • Not an exam deficiency per se, but late claim notice can void coverage; failing to disclose a material adverse financial condition in Item 18 is.
• Model-provider/TAMP-strategist differences:
  • Publisher's liability (media liability) coverage for research content; IP infringement coverage for data use.
  • Sponsors frequently require being named as additional insured or receiving certificates annually.

Domain: Finance, Accounting & Tax

• Why it matters: Financial books are required records (204-2(a)(1), (2), (4), (5)), Item 18 requires disclosure of financial impairment, and clean monthly closes make fee reconciliation and revenue recognition defensible.
• Governing rules:
  • Rule 204-2(a)(1), (2), (4), (5), (6) - journals, general and auxiliary ledgers, checkbooks, bank statements, cancelled checks, bills, trial balances and financial statements - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Form ADV Part 2A Item 18 - audited balance sheet if the adviser requires or solicits prepayment of more than $1,200 in fees per client six months or more in advance; disclose any financial condition reasonably likely to impair ability to meet contractual commitments - https://www.sec.gov/files/formadv-instructions.pdf
  • Internal Revenue Code (entity tax, payroll, 1099-NEC for contractors) and state nexus for remote workers - firm-specific
  • State sales and use tax on digital information services and SaaS (varies; e.g., New York taxes information services, Texas taxes data processing; Florida generally does not tax SaaS) - firm-specific; see state DOR guidance
• Required records/deliverables:
  • Monthly close package: bank reconciliations, revenue by line (advisory fees, strategist fees, subscriptions), deferred revenue schedule, AR aging, AP, payroll
  • Annual financial statements (reviewed or audited if required by Item 18 or lenders/sponsors)
  • Budget and cash forecast; owner distributions policy
  • Tax calendar (federal, state, payroll, 1099s, sales tax where applicable)
• Cadence items:
  • Monthly | Close within 10 business days; reconcile fee receipts to billing | monthly
  • Quarterly | Estimated taxes; sales tax returns if applicable | quarterly
  • Annual | Financial statements, tax returns, 1099s by Jan 31 | annually
  • Annual | Item 18 determination (prepayment test, financial condition) | with ADV
• Owner role: Outsourced bookkeeper/fractional CFO; Head of Operations reviews; CEO approves.
• Best practices:
  • Separate revenue streams in the chart of accounts so RAUM-based fees, strategist fees and subscriptions can each be reconciled to their source data.
  • Recognize subscription revenue ratably; keep deferred revenue tied to the subscription system.
  • Keep three months of operating expenses in reserve and document it for sponsor due diligence.
• Common exam deficiencies / pitfalls:
  • Missing bank records or ledgers in the exam production.
  • Item 18 not updated when the firm began billing annually in advance above $1,200.
• Model-provider/TAMP-strategist differences:
  • Sales tax exposure on subscriptions is the distinctive issue; get a nexus and taxability study.
  • Strategist fee accruals depend on sponsor data; book estimates and true up on receipt.

Domain: Client Service & Complaints

• Why it matters: Complaints are evidence in exams and in Form U4/ADV disclosure obligations; retail-facing conduct toward older investors is an FY2026 emphasis.
• Governing rules:
  • Rule 204-2(a)(7) - retain all written communications received and sent relating to recommendations, receipt/disbursement of funds, placing of orders, and (since the Marketing Rule) predecessor performance and testimonials - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Form ADV Part 1A Item 11 and Part 2A Item 9 - disciplinary disclosure; Form U4 Item 14I - customer complaint reporting for written complaints alleging sales-practice violations with damages at or above $5,000 or involving forgery, theft, misappropriation - https://www.finra.org/registration-exams-ce/classic-crd/forms
  • Senior Safe Act (2018) - immunity for reporting suspected elder financial exploitation when training is provided - https://www.congress.gov/bill/115th-congress/senate-bill/223
  • State senior-protection statutes (temporary holds on disbursements; e.g., Florida Statute 517.34) - firm-specific
  • Section 206 - fair dealing; prompt and honest handling of client issues
• Required records/deliverables:
  • Complaint log (date received, client, summary, product/service, person involved, resolution, date closed, regulatory reporting analysis)
  • Written complaint files with all correspondence
  • Senior investor and diminished capacity procedures; trusted contact records
  • Client service standards (response times) and annual review meeting records
• Cadence items:
  • Event | Log any complaint within 1 business day; CCO assessment within 5 business days; acknowledgment to client within 5 business days; resolution target 30 days | per policy
  • Event | U4/ADV disclosure analysis for each complaint | within 30 days of trigger
  • Quarterly | Complaint log review and trend analysis in compliance meeting | quarterly
  • Annual | Senior Safe Act training | annually
• Owner role: CCO owns the log and regulatory analysis; advisor/relationship lead handles the client; CEO reviews material complaints.
• Best practices:
  • Define "complaint" broadly (any expression of dissatisfaction about service, fees, performance or conduct, oral or written) and log all of them even if only written ones trigger U4.
  • Route complaint emails to a monitored compliance mailbox; never let the subject of the complaint be the sole responder.
  • Use a standard acknowledgment letter and a resolution letter; retain both.
  • Report insurance-notifiable complaints to the E&O carrier within policy deadlines.
• Common exam deficiencies / pitfalls:
  • No complaint log or a log that contradicts emails found in the archive.
  • Missed U4 reporting of written complaints meeting the $5,000 threshold.
  • Settlements with clients lacking documentation or ADV disclosure analysis.
• Model-provider/TAMP-strategist differences:
  • Complaints will often arrive via the sponsor or the end-client's advisor about model performance or implementation; log them, respond to the sponsor, and distinguish strategist responsibility from sponsor implementation.
  • Subscriber complaints (billing, content quality, access) are commercial, but allegations about research integrity or trading ahead should be escalated to compliance as potential Section 206 issues.

Domain: Technology Stack

• Why it matters: The stack is where records, security and controls actually live; FY2026 priorities flag AI use (accuracy of AI claims, supervision of AI tools) and AI-driven cyber risk.
• Governing rules:
  • Rule 204-2(g) - electronic records requirements - https://www.law.cornell.edu/cfr/text/17/275.204-2
  • Reg S-P / Reg S-ID - safeguards and red flags - https://www.sec.gov/files/rules/final/2024/34-100155.pdf
  • Marketing Rule general prohibitions - no untrue statements about AI capabilities ("AI washing" enforcement, March 2024 Delphia and Global Predictions cases) - https://www.sec.gov/newsroom/press-releases/2024-36
  • FY2026 Exam Priorities - AI representations, supervision of AI/algorithmic tools, AI-based cyber threats - https://www.sec.gov/files/2026-exam-priorities.pdf
  • E-SIGN Act and Rule 204-3 electronic delivery guidance (SEC 1995/1996 releases; consent to electronic delivery) - https://www.sec.gov/rules/interp/33-7288.txt
• Required records/deliverables:
  • System inventory (CRM, portfolio accounting, rebalancer, billing, document management, e-comms archive, custodian portals, TAMP portal, research publishing platform, subscription billing, data vendors, MSP tools)
  • Access control matrix (role-based) and quarterly access reviews
  • AI use policy: approved tools, prohibited data inputs (client PII, MNPI), human review of outputs, disclosure standards
  • Change management log for system changes affecting records or billing
• Cadence items:
  • Monthly | Access review and license reconciliation | monthly
  • Quarterly | Data flow and integration health review (custodian feeds, TAMP feeds) | quarterly
  • Annual | Stack review vs requirements; contract renewals; data export test from each critical system | annually
  • Event | New tool intake review (security, records, AI policy) | before adoption
• Owner role: Head of Operations with MSP; CCO for records and AI policy.
• Best practices:
  • Prefer vendors with SOC 2 Type II, SSO/MFA, audit logs and bulk export.
  • Treat generative AI as a vendor and a records issue: capture prompts/outputs used in client work if they inform advice or advertisements; prohibit entering client PII into non-enterprise tools.
  • Keep the data lineage for performance and billing documented (custodian to accounting to report).
• Common exam deficiencies / pitfalls:
  • Statements about AI or "proprietary algorithms" that the firm cannot substantiate.
  • No inventory of systems holding customer information.
  • Business texting on personal phones without capture.
• Model-provider/TAMP-strategist differences:
  • Model delivery pipelines (sponsor portals, APIs, spreadsheets by email) need version control and delivery logs; email-based model delivery should be archived and time-stamped.
  • Research publishing platforms (Substack-style, member portals, email tools) must be captured as advertising/records and entitlement controls must prevent unauthorized redistribution.

Domain: AML/CFT

• Why it matters: RIAs are not yet "financial institutions" under the BSA; the FinCEN rule making them so is effective Jan 1, 2028 (postponed from Jan 1, 2026) and FinCEN has said it may narrow the scope. OFAC and anti-fraud duties apply today, and custodians, TAMPs and sponsors already push KYC demands downstream.
• Governing rules:
  • FinCEN IA AML Rule, 31 CFR 1032 (final Aug 28, 2024; effective date delayed to Jan 1, 2028 by final rule Dec 31, 2025) - risk-based AML/CFT program (policies, compliance officer, training, independent testing, customer due diligence), SAR filing within 30 days of detection (60 if no subject identified), CTR, recordkeeping and travel rule, 314(a)/(b) information sharing - https://www.fincen.gov/news/news-releases/fincen-issues-final-rule-postpone-effective-date-investment-adviser-rule-2028 ; https://www.federalregister.gov/documents/2024/09/04/2024-19260/financial-crimes-enforcement-network-anti-money-launderingcountering-the-financing-of-terrorism
  • Joint SEC/FinCEN CIP rule for RIAs - proposed May 13, 2024; I could not verify a final rule; treat as pending - https://www.sec.gov/rules-regulations/2024/05/customer-identification-programs-registered-investment-advisers-exempt-reporting-advisers
  • OFAC regulations (31 CFR Chapter V) - no dealings with sanctioned persons; applies now to all U.S. persons - https://ofac.treasury.gov/faqs
  • Section 206 and Rule 206(4)-7 - fraud prevention duties support voluntary AML controls now; FY2026 priorities mention AML programs for advisers - https://www.sec.gov/files/2026-exam-priorities.pdf
  • Custodian/BD obligations (31 CFR 1023) - the custodian performs CIP and SAR duties on accounts it holds; expect KYC document requests from custodians and sponsors
• Required records/deliverables:
  • Current: OFAC screening records for clients and payers; client identity information collected for the custodian; red flags and escalation log; voluntary SAR capability analysis
  • By Jan 1, 2028 (if not narrowed): written AML/CFT program, designated AML officer, risk assessment, training, independent test schedule, SAR procedures, 314(a) registration via FinCEN
• Cadence items:
  • Event | OFAC screen at onboarding and on list updates (automated daily if using a screening tool) | onboarding; ongoing
  • Quarterly | Review unusual activity reports from custodians and money-movement patterns | quarterly
  • Annual | AML risk assessment and training (voluntary now; required from 2028) | annually
  • Event | Monitor FinCEN rulemaking on scope revisions during 2026-2027 | ongoing
  • Annual | Independent AML test (required from 2028; good practice to pilot in 2027) | annually
• Owner role: CCO as AML officer; Operations runs screening.
• Best practices:
  • Adopt a right-sized AML policy now (OFAC screening, red flags, escalation, voluntary SAR process) so the 2028 program is an upgrade, not a build.
  • Use custodian-provided screening plus a low-cost screening service for non-custodied payers (subscribers, sponsors).
  • Pilot independent testing in 2027 so the first required test is routine.
• Common exam deficiencies / pitfalls:
  • Claiming an AML program in ADV or sponsor DDQs that does not exist.
  • No OFAC screening of subscribers or vendors receiving payments.
• Model-provider/TAMP-strategist differences:
  • Model providers typically have no end-investor accounts; under the 2024 rule, "customer" and SAR scope would be driven by advisory relationships (sponsor), which is less burdensome. FinCEN's scope revision may change this; monitor.
  • Research subscriptions paid by card or ACH from professionals: screen payers against OFAC; the payment processor does its own KYC.

B. ANNUAL COMPLIANCE CALENDAR

Assumes a December 31 fiscal year-end. Shift by the same number of days for other FYEs. "~" means the exact date is set each year by IARD/FINRA; check iard.com/renewal-program in October.

C. PROCESS MAPS

Format: "N. [STEP|DECISION|RECORD] Short label :: detail :: tool/owner". Control points are marked (CONTROL) inside the detail.

Process 1: New client onboarding (standard retail, discretionary, third-party custodian)

1. [STEP] Discovery meeting :: Collect goals, time horizon, liquidity needs, risk tolerance, tax situation, existing holdings, trusted contact; deliver Form CRS at or before the first recommendation and record the date :: Advisor / CRM (Wealthbox, Redtail)
2. [RECORD] Prospect file opened :: CRM record with Form CRS delivery date and method, meeting notes, documents requested :: Operations / CRM
3. [DECISION] Fit and eligibility :: Does the prospect meet minimums, service model, and no conflicts (related party, insider, sanctioned person)? -> Yes: step 4 / No: decline letter, retain record, end
4. [STEP] Proposal and disclosures :: Deliver ADV Part 2A, Part 2B for the advisor, privacy notice, fee schedule, proposed strategy and IPS draft; record delivery date and method (CONTROL: no agreement may be signed before disclosures are delivered) :: Advisor / Operations
5. [STEP] Agreement execution :: Advisory agreement with fee terms matching Part 2A Item 5, discretion scope, termination and assignment clauses; e-signature with audit trail :: Operations / DocuSign or custodian e-sign
6. [RECORD] Executed agreement and IPS :: Store PDFs in document management under the client folder; CRM status "Agreement signed" :: Operations
7. [STEP] Custodian account opening :: Submit applications via custodian digital onboarding; LPOA for trading and fee deduction; collect identity documents per custodian CIP; run OFAC screen; attach beneficiary/trust documents :: Operations / Schwab Advisor Center, Fidelity Wealthscape
8. [DECISION] Custody triggers :: Any SLOA, bill-pay, trustee role, or request for client passwords? -> Yes: complete 7-condition SLOA checklist or decline; update custody inventory, go to step 9 / No: step 9
9. [STEP] Funding and transfers :: Initiate ACATs or wires; track in transfer log; identify legacy positions and tax lots; confirm cost basis transfers :: Operations
10. [RECORD] Account setup in portfolio accounting and billing :: Create household, assign model/strategy, fee schedule, billing exclusions, benchmark, performance inception date (CONTROL: second person verifies fee schedule and exclusions against the agreement) :: Operations / Orion, Black Diamond, Tamarac
11. [DECISION] Ready to trade :: Agreement countersigned, custodian account open and funded, IPS signed, billing verified, restrictions entered? -> Yes: step 12 / No: hold in "pending" queue, follow up weekly
12. [STEP] Initial investment :: Generate trades from the rebalancer; pre-trade review for restrictions, cash reserve, wash sales, settlement (T+1); place and allocate :: Trader / Rebalancer
13. [RECORD] Onboarding checklist complete :: CRM checklist closed with dates for each disclosure, agreement, account, funding and first trade; CCO monthly sample review :: Operations / CCO
14. [STEP] 30-day welcome review :: Confirm client received custodian statement and portal access; schedule annual review cadence :: Advisor

Process 2: Quarterly fee billing

1. [STEP] Lock quarter-end data :: Confirm all custodian reconciliations clean as of quarter-end; freeze valuations in portfolio accounting :: Operations / Portfolio accounting
2. [STEP] Review billing exceptions :: New accounts (proration from funding date), terminated accounts (proration to termination), fee schedule changes, excluded assets, household links :: Operations
3. [RECORD] Billing exception log :: List of every manual adjustment with reason and approver :: Operations / CCO
4. [STEP] Run billing :: Generate fee calculations per account and household (value date, rate, tiering, exclusions, advance or arrears per Part 2A Item 5) :: Operations / Billing module
5. [DECISION] CCO sample test passes :: Recompute 10% of accounts (minimum 25) by hand; compare to agreement and Part 2A; all within tolerance? -> Yes: step 6 / No: correct, re-run, re-test (CONTROL)
6. [STEP] Client fee statements :: Produce statements showing formula, value, period, amount; deliver via portal or email with archive :: Operations
7. [STEP] Custodian fee file :: Upload fee deduction file to each custodian; confirm acceptance report :: Operations / Custodian portal
8. [RECORD] Billing package :: Billing file, exception log, test workpapers, statements, custodian acceptance reports saved to quarter folder :: Operations
9. [STEP] Reconcile receipts :: Match custodian debits to billing file and to bank deposits; investigate breaks over $1 within 5 business days :: Bookkeeper / Operations
10. [DECISION] Any overbilling found :: -> Yes: refund with interest if appropriate within 30 days, log, assess ADV/complaint implications, root-cause fix / No: step 11
11. [RECORD] GL posting and deferred revenue :: Post revenue, deferred revenue (advance billing), and refunds; close memo signed :: Bookkeeper / QuickBooks
12. [STEP] Quarterly billing summary to compliance meeting :: Error rate, refunds, exceptions, trend :: CCO

Process 3: Marketing content review and approval (Marketing Rule)

1. [STEP] Intake :: Submitter logs the item (type, audience, channel, performance included?, testimonials?, third-party ratings?, hypothetical?) :: Marketing / Review log or tool
2. [DECISION] Is it an advertisement :: Direct or indirect communication offering advisory services to more than one person, or any compensated testimonial/endorsement? -> Yes: step 3 / No: record determination, route to normal communications archive
3. [STEP] Substantiation :: Attach source for every statement of fact, performance data file, calculation methodology, benchmark rationale :: Submitter
4. [DECISION] Performance present :: -> Yes: step 5 / No: step 7
5. [STEP] Performance checklist :: Net and gross with equal prominence; 1/5/10 year or since inception as of latest calendar year-end; related/extracted/hypothetical/predecessor conditions; model fee basis documented; disclosures :: CCO / Performance analyst
6. [DECISION] Hypothetical or model performance :: -> Yes: confirm intended audience has resources to analyze and the (d)(6) policies apply; prohibit general-public use; attach audience memo; step 7 / No: step 7
7. [DECISION] Testimonial, endorsement or third-party rating :: -> Yes: confirm written agreement (if over $1,000 in 12 months), compensation and client-status disclosures, disqualification check, rating due diligence (questionnaire not pay-to-play, date and period shown) / No: step 8
8. [STEP] General prohibitions review :: Untrue or misleading statements, unsubstantiated claims, cherry-picking, fair and balanced treatment of benefits and risks, specific recommendations context :: CCO
9. [DECISION] Approve :: -> Approved: step 10 / Changes required: return to submitter with comments, loop to step 3 / Rejected: record reason
10. [RECORD] Approval record :: Final version, reviewer, date, substantiation, disclosures, expiry date (for performance pieces) stored in archive :: CCO / Archive
11. [STEP] Publish and capture :: Post or send; website snapshot or social archive captures the live version :: Marketing / Archive tool
12. [STEP] Expiry and refresh :: Performance pieces flagged for refresh after calendar year-end; monthly website sweep confirms only approved versions are live :: CCO

Process 4: New vendor due diligence and ongoing oversight (Reg S-P)

1. [STEP] Intake request :: Business owner describes service, data involved, integrations, cost, alternatives :: Requester / Vendor form
2. [DECISION] Does the vendor receive, maintain, process or access customer information or support a critical function :: -> Yes: Tier 1 or 2, step 3 / No: Tier 3, record and proceed to contract with standard confidentiality
3. [STEP] Due diligence :: Collect SOC 2 Type II (or SOC 1), security questionnaire, breach history, insurance certificate, financial viability indicators, BCP summary, subcontractor list, data location :: Operations
4. [DECISION] Reg S-P assurance :: Will the vendor contractually commit to safeguards and breach notice to the firm within 72 hours of awareness? -> Yes: step 5 / No: can the firm obtain alternative assurances (published commitments, certifications) and document best efforts? -> Yes: step 5 with memo / No: reject or escalate to CEO
5. [STEP] Contract :: Security addendum, confidentiality, breach notice, data return and destruction, audit/report rights, subcontractor flow-down, termination assistance :: CEO signs / Counsel as needed
6. [RECORD] Vendor file :: Inventory entry (tier, data, owner, renewal date), due diligence documents, contract, risk memo, approval signatures (CONTROL: CCO approves any vendor touching customer information) :: Operations / CCO
7. [STEP] Implementation controls :: SSO/MFA, least-privilege roles, data minimization, records capture confirmed if vendor holds required records :: Operations / MSP
8. [STEP] Ongoing monitoring :: Quarterly SLA and incident check for Tier 1; annual SOC 2 refresh and questionnaire for Tier 1 and 2; bridge letters reviewed :: Operations
9. [DECISION] Material change or incident :: Acquisition, breach, outage, financial distress? -> Yes: impact assessment within 5 business days, consider customer-notice obligations under the incident response program, document / No: continue monitoring
10. [RECORD] Annual vendor review memo :: Per Tier 1 and Tier 2 vendor, with findings and renew/replace decision :: Operations / CCO
11. [STEP] Offboarding :: Data return or certified destruction, access revoked, records exported into firm storage, inventory updated :: Operations

Process 5: Personal trading preclearance and code of ethics reporting

1. [STEP] Identify access persons :: Anyone with access to nonpublic recommendations, model changes, draft research, or client holdings; include interns and contractors; maintain the roster :: CCO
2. [RECORD] Onboarding acknowledgments and initial holdings :: Code acknowledgment; initial holdings report within 10 days of becoming an access person, information no older than 45 days; broker feed authorizations :: CCO / Compliance platform
3. [STEP] Preclearance request :: Employee submits ticker, side, quantity, account before trading for any reportable security covered by policy; mandatory for IPOs and limited offerings :: Employee / Platform
4. [DECISION] Restricted or blackout :: Is the security on the restricted list, in a pending model change, in draft research, or traded for clients within the blackout window? -> Yes: deny, record / No: step 5
5. [DECISION] Other policy checks :: Holding period, short-term trading limit, de minimis exceptions satisfied? -> Yes: approve with validity window (same day or 2 days) / No: deny
6. [RECORD] Preclearance decision :: Approval or denial with timestamp and reviewer; stored in platform :: CCO
7. [STEP] Post-trade surveillance :: Daily broker feed matched to approvals; flag unapproved trades, front-running vs client/model trades, restricted list hits :: CCO / Platform
8. [STEP] Quarterly transaction reports :: Collect within 30 days of quarter-end or rely on feeds plus attestation; include political contributions and OBA attestations :: Employees / Platform
9. [STEP] Annual holdings reports :: Within 45 days of the as-of date; code re-acknowledgment; training :: Employees / CCO
10. [DECISION] Violation found :: -> Yes: document, interview, apply sanction per matrix (warning, disgorgement, suspension, termination), report to CEO, consider ADV/U4 implications / No: close review
11. [RECORD] Violation log and annual summary :: Log entries and the annual review section summarizing code compliance :: CCO
12. [STEP] CCO's own trades :: Reviewed by CEO or outside consultant (CONTROL: no self-approval) :: CEO

Process 6: Annual compliance review and ADV update

1. [STEP] Plan :: Set scope from risk assessment, prior findings, SEC priorities (FY2026: fiduciary conduct, compliance program effectiveness, Reg S-P, Reg S-ID, custody, AI, marketing), business changes :: CCO
2. [STEP] Gather data :: RAUM tie-out, client counts by type and state, custody inventory, marketing log, trade error log, complaint log, personal trading summary, vendor review memos, cyber assessment, BCP test, billing tests, training records :: Operations / CCO
3. [STEP] Forensic testing :: Fee recomputation sample, best execution review, allocation fairness test, e-comms sample, ADV-to-practice crosswalk, disclosure delivery sample :: CCO / Consultant
4. [RECORD] Testing workpapers :: Each test with population, sample, method, result, exceptions :: CCO
5. [DECISION] Findings require policy changes :: -> Yes: draft manual revisions with effective dates; step 6 / No: step 6
6. [STEP] Draft annual review report :: Findings, root cause, remediation owner and date, policy changes, training plan; date and sign (CONTROL: never backdate; version history retained) :: CCO
7. [STEP] Management review :: CEO reviews report and approves remediation budget; minutes :: CEO / CCO
8. [RECORD] Final annual review report and minutes :: Stored in compliance evidence folder; prior-year reports retained 5 years :: CCO
9. [STEP] Form ADV annual amendment drafting :: Update Part 1A (Items 5, 7, 9, 11, 5.L), Part 2A all items with Item 2 summary of material changes, Part 2B, Part 3 if changed; redline against prior year :: CCO / Counsel
10. [DECISION] SEC eligibility :: RAUM at or above $90M (or an exemption applies)? -> Yes: file / No: plan ADV-W within 180 days and state registrations
11. [STEP] File on IARD :: Submit by March 31 (90 days after Dec 31 FYE); confirm acceptance; pay state notice fees :: CCO / IARD
12. [STEP] Deliver :: Part 2A or summary with offer, privacy notice (if applicable), Form CRS changes exhibit to retail clients within 120 days of FYE (April 30); log delivery :: Operations
13. [RECORD] ADV package :: Filed forms, redlines, data workpapers, delivery log :: CCO

Process 7: Trade error handling

1. [STEP] Detect :: Trader, reconciliation (T+1), custodian alert, or client report identifies deviation from intended order (wrong account, security, side, quantity, price limit, missed trade) :: Trader / Operations
2. [RECORD] Error ticket opened :: Date/time discovered, trade details, discovery method, who was involved, preliminary impact :: Trader / Error log
3. [STEP] Contain :: Stop further automated trades on the affected accounts; notify CCO same day :: Trader / CCO
4. [DECISION] Correction method :: Can the error be corrected in the client account to put the client in the intended position? -> Yes: step 5 / No (e.g., missed trade, market moved): step 6
5. [STEP] Correct in account :: Execute correcting trades; move any loss to the firm or custodian error account; client keeps any gain unless policy and disclosures provide otherwise :: Trader / Custodian error account
6. [STEP] Calculate client impact :: Compare actual vs intended position value as of correction; document methodology :: Operations
7. [DECISION] Client made whole :: Does the client have any residual loss, including transaction costs and lost opportunity per policy? -> Yes: firm reimburses via custodian error account or check; step 8 / No: step 8
8. [RECORD] Error resolution memo :: Root cause, correction, cost to firm, client communication (if any), approval by CCO (CONTROL: firm never nets losses against gains across clients; no soft-dollar or commission offsets) :: CCO
9. [DECISION] Client notification :: Was the client account affected in a way visible on statements or material? -> Yes: notify client in writing and retain / No: document decision not to notify
10. [STEP] Trend review :: Quarterly review of error log for patterns (person, system, process); adjust controls or training :: CCO / Compliance meeting
11. [RECORD] Error log quarterly summary :: Count, cost, root causes, actions :: CCO

Process 8: Client complaint handling

1. [STEP] Receive :: Any expression of dissatisfaction, oral or written, from client, sponsor, subscriber or their representative; forward to compliance mailbox within 1 business day :: Any employee
2. [RECORD] Complaint log entry :: Date received, source, summary, person involved, product/service, initial classification :: CCO
3. [STEP] Acknowledge :: Written acknowledgment to the complainant within 5 business days stating who is handling it :: CCO / Relationship lead (not the subject of the complaint)
4. [STEP] Investigate :: Pull agreements, trade records, communications, billing; interview staff; preserve records (legal hold if litigation threatened) :: CCO
5. [DECISION] Regulatory reporting trigger :: Written complaint alleging sales-practice violation with damages $5,000 or more, or forgery/theft/misappropriation (U4 Item 14I)? Any ADV Item 11 disciplinary trigger? -> Yes: file U4 amendment within 30 days; assess ADV; step 6 / No: document analysis; step 6
6. [DECISION] Insurance notice :: Could the matter give rise to an E&O claim? -> Yes: notify carrier within policy deadline / No: document
7. [STEP] Resolve :: Decide remedy (explanation, correction, refund, goodwill payment); CEO approves any payment; written resolution letter to the complainant :: CCO / CEO
8. [RECORD] Complaint file closed :: All correspondence, analysis, resolution, approvals, reporting decisions :: CCO
9. [STEP] Root cause and trend :: Quarterly review in compliance meeting; policy or training changes :: CCO
10. [RECORD] Quarterly complaint summary :: Included in annual review :: CCO

Process 9: Employee onboarding and offboarding

1. [STEP] Pre-hire screening :: Background check, BrokerCheck/IAPD review, reference checks, OBA disclosure, conflicts questionnaire :: Head of Operations / CCO
2. [DECISION] Registration needed :: Will the person give advice or solicit in a state with a place of business or client contact? -> Yes: Form U4, exam or designation evidence, state fees; wait for approval before client-facing advice / No: document determination
3. [STEP] Access provisioning :: Role-based access requests to CRM, portfolio accounting, custodian portals (view or trade), email with archive, document system; MFA enrollment; device issuance with encryption and EDR :: MSP / Operations
4. [RECORD] Onboarding compliance file :: Signed code of ethics and manual acknowledgments, initial holdings report within 10 days, broker feed authorization, privacy and cybersecurity training completion, e-comms policy acknowledgment, Senior Safe Act training :: CCO
5. [STEP] Supervision setup :: Assign supervisor; add to Part 2B if advice-giving; add to access person roster and IAR CE tracking :: CCO
6. [DECISION] 90-day check :: Attestations complete, registration approved, training done? -> Yes: close onboarding / No: escalate to supervisor
7. [STEP] Offboarding trigger :: Resignation or termination notice received; HR notifies Operations and CCO same day :: Head of Operations
8. [STEP] Same-day access revocation :: Disable SSO, email forwarding to supervisor with archive retained, custodian portal access removed, device collected and wiped after records preserved, shared credentials rotated :: MSP / Operations
9. [RECORD] Deprovisioning log :: System-by-system revocation timestamps :: Operations
10. [STEP] Regulatory filings :: Form U5 within 30 days with accurate termination reason; remove from Part 2B; update ADV Schedule A/B if an owner or officer; notify custodians to remove authorized user :: CCO
11. [STEP] Final attestations and client transition :: Exit attestation on confidentiality and records return; final personal trading report; reassign clients and communicate per agreements :: CCO / Advisor
12. [RECORD] Offboarding file :: U5 receipt, deprovisioning log, attestations, client reassignment memo :: CCO

Process 10: Data incident response (Reg S-P, 30-day customer notice)

1. [STEP] Detect and report :: Any employee or vendor reports suspected unauthorized access or use of customer information to the incident lead immediately; vendor contractual notice is 72 hours :: All / Incident lead (Head of Operations)
2. [RECORD] Incident ticket :: Date/time of awareness (this starts the 30-day clock), reporter, systems, data types, initial facts :: Incident lead
3. [STEP] Contain :: Isolate systems, reset credentials, revoke tokens, preserve logs and evidence; engage MSSP/forensics and cyber carrier (CONTROL: notice to carrier per policy) :: MSP / Incident lead
4. [STEP] Assess scope :: Determine whether sensitive customer information (as defined in 248.30(d)) was or is reasonably likely to have been accessed or used without authorization; identify affected customers and states :: Incident lead / Counsel
5. [DECISION] Is notice required :: Was sensitive customer information accessed or used without authorization, and is substantial harm or inconvenience reasonably likely (absence of harm must be affirmatively determined after investigation)? -> Yes: step 6 / No: document the determination and evidence; step 9
6. [STEP] Draft customer notice :: Required content: nature and date of incident, data involved, how to respond, contact information; include state-law content requirements; CEO approval :: Counsel / CCO / CEO
7. [DECISION] Law enforcement delay :: Has the U.S. Attorney General determined notice poses a substantial national security or public safety risk? -> Yes: delay per the rule's limited exception and document / No: step 8
8. [STEP] Deliver notice :: As soon as practicable and no later than 30 days after awareness; by mail or electronic means reasonably designed to reach the customer; coordinate state regulator notices if required; notify custodian and affected sponsors :: Operations / Counsel
9. [RECORD] Incident file :: Timeline, evidence, determination memo, notices sent, recipient list, vendor notices received, remediation :: CCO
10. [STEP] Remediate and lessons learned :: Patch, policy updates, training, vendor action; post-incident review within 30 days of closure :: Incident lead
11. [STEP] Disclosure review :: Assess whether the incident affects Form ADV disclosures, client reports, or sponsor DDQ answers :: CCO
12. [RECORD] Incident log update and annual review summary :: Incident included in annual Reg S-P program review :: CCO

Process 11: Business continuity test

1. [STEP] Define scenario :: Choose one per year on rotation: office/home loss, key-person unavailability, custodian outage, portfolio accounting outage, email/archive outage, cyber ransomware :: Head of Operations
2. [STEP] Set objectives :: Confirm RTO/RPO per critical function (trading, model delivery, research publication, billing, client communication, compliance) :: Head of Operations
3. [STEP] Notify participants and start :: Call tree activation; participants work from alternate devices/locations as the scenario dictates :: Head of Operations
4. [STEP] Execute critical functions :: Place a test trade or model delivery via backup path; restore a backup file; send client communication from alternate channel; access custodian via secondary admin :: Trading / Operations / MSP
5. [DECISION] Objectives met within RTO :: -> Yes: step 7 / No: step 6
6. [STEP] Gap analysis :: Identify failures (access, documentation, vendor dependency, people) and assign remediation with due dates :: Head of Operations
7. [RECORD] Test report :: Scenario, participants, timeline, results vs RTO/RPO, gaps, remediation plan; CEO sign-off :: Head of Operations / CEO
8. [STEP] Update BCP :: Revise contacts, procedures, vendor list, succession steps; version and distribute :: Head of Operations
9. [RECORD] Updated BCP and distribution acknowledgments :: Stored in compliance evidence folder and offline copy :: Operations
10. [STEP] Share summary with sponsors on request :: Many TAMP DDQs ask for last test date and results :: Head of Operations

Process 12: Books and records retention and retrieval for an SEC exam request

1. [STEP] Maintain records inventory :: Map each Rule 204-2 item to system of record, format, retention period, owner, retrieval steps; update at every system change :: Head of Operations
2. [STEP] Immutable storage :: Required records in a WORM-equivalent repository or archive with audit trail; e-comms in a compliant archive; duplicate copy maintained :: Operations / Archive vendor
3. [STEP] Quarterly retrieval drill :: Pull 5 random required records within 1 hour; log time and issues :: CCO
4. [STEP] Exam notice received :: Immediately issue legal hold (suspend destruction), notify CEO, counsel and consultant; log the request list with item numbers :: CCO
5. [STEP] Request list triage :: Assign each item an owner, source system, and due date; identify "lists first" items (client list, employee list, trade blotter, marketing list) :: CCO / Operations
6. [DECISION] Record exists and is retrievable as requested :: -> Yes: step 7 / No: document why (outside retention, not applicable, never created) and prepare a written explanation; escalate to counsel
7. [STEP] Produce :: Export in requested format (Excel for lists, PDF for documents), label by request item number, Bates or file naming convention, privilege review by counsel :: Operations / Counsel
8. [RECORD] Production log :: Item number, description, file names, date produced, producer, reviewer :: CCO
9. [STEP] Quality check :: Second person confirms completeness and that lists reconcile (client list to billing to custodian accounts) before submission (CONTROL) :: CCO / Operations
10. [STEP] Submit via SEC secure method :: Retain exact copies of everything produced :: CCO
11. [RECORD] Exam file :: Request lists, productions, correspondence, interview notes, deficiency letter and responses :: CCO
12. [STEP] Post-exam :: Lift hold only after counsel confirms; implement deficiency letter remediation within the committed period (typically 30 days to respond) :: CCO / CEO

Process 13: SEC exam readiness (document request list response)

1. [STEP] Standing readiness :: Maintain a pre-built exam binder mirroring a typical initial request list: organizational chart, ADV filings, compliance manual and annual reviews, code of ethics and reports, client list with account numbers, fee schedules and billing records, trade blotter, best execution reviews, marketing archive and review log, custody inventory, vendor list, cyber assessment, BCP, complaint log, financials :: CCO / Operations
2. [STEP] Annual refresh :: Update the binder after the ADV annual amendment; test that lists reconcile to each other :: CCO
3. [STEP] Exam notification call :: Take notes; confirm scope, period, on-site vs remote, point of contact; schedule kickoff :: CCO / CEO
4. [STEP] Engage advisors :: Notify counsel and compliance consultant; brief all staff on exam protocol (truthful, do not guess, route requests through CCO) :: CEO / CCO
5. [RECORD] Exam log opened :: Chronological log of every contact, request, production and interview :: CCO
6. [STEP] Request list response plan :: Convert list into tracker with owner and due date; prioritize lists and policies due first (often 7 to 14 days) :: CCO / Operations
7. [DECISION] Any known issue that will surface :: -> Yes: prepare a written explanation and remediation already taken or planned; discuss with counsel about proactive disclosure / No: proceed
8. [STEP] Interview preparation :: Prepare CEO, CCO, PM, trader, operations lead on their areas; review the firm's own policies with them :: CCO / Counsel
9. [STEP] Produce and track :: Follow Process 12 steps 6 to 10 for each item; weekly status call with the exam team :: CCO
10. [STEP] Supplemental requests :: Treat each follow-up as a new tracker item; keep the same production discipline :: CCO
11. [RECORD] Exit meeting notes and deficiency letter :: Record the staff's preliminary observations; respond in writing within the stated period with corrective actions and evidence :: CCO / Counsel
12. [STEP] Remediation and lessons learned :: Update manual, training, and the readiness binder; brief the team; record in the next annual review :: CCO

Process 14: Research publication and model update governance (model-provider / TAMP-strategist specific)

1. [STEP] Research or model decision :: PM/analyst documents the thesis, data sources, and proposed change with timestamp :: Research team
2. [DECISION] MNPI or data license concern :: Any nonpublic information source or data whose license prohibits redistribution? -> Yes: stop, escalate to CCO / No: step 3
3. [STEP] Blackout activation :: Add affected securities to the restricted list from decision time until 2 trading days after final delivery (or per policy) :: CCO / Compliance platform
4. [STEP] Pre-publication review :: Compliance reviews for Marketing Rule issues (performance claims, hypothetical performance labeling, fair and balanced), required disclosures, and that the memo of reasons exists (Rule 204-2(a)(11)) :: CCO
5. [DECISION] Approved for release :: -> Yes: step 6 / No: revise and loop to step 4
6. [STEP] Simultaneous delivery :: Deliver model update to all sponsors at the same time via their portals/API (or per the disclosed rotation); publish research to all subscribers at once; record delivery timestamps per recipient :: Operations
7. [STEP] Firm-managed accounts :: Trade any directly managed accounts per the disclosed sequencing policy relative to sponsor delivery :: Trader
8. [RECORD] Publication and model change record :: Final document or model version, memo of reasons, approval, delivery log with timestamps, restricted list entries :: CCO / Operations
9. [STEP] Post-delivery surveillance :: Review personal trading in affected names around the change; review sponsor implementation dispersion when data arrives :: CCO
10. [RECORD] Quarterly governance summary :: Model changes, publications, blackout exceptions, dispersion findings :: CCO

D. SOURCES

1. SEC, Regulation S-P final rule, Rel. 34-100155 / IA-6604 (May 16, 2024): https://www.sec.gov/files/rules/final/2024/34-100155.pdf
2. Holland & Knight, Reg S-P smaller-entity deadline (May 7, 2026): https://www.hklaw.com/en/insights/publications/2026/05/regulation-s-p-amendments-compliance-deadline-approaching
3. Baker Donelson, Reg S-P June 3, 2026 compliance deadline (Feb 24, 2026): https://www.bakerdonelson.com/regulation-s-p-june-3-2026-compliance-deadline-for-smaller-investment-advisers
4. SEC Compliance Outreach on Regulation S-P (Sept 25, 2025): https://www.sec.gov/newsroom/meetings-events/compliance-outreach-regulation-s-p
5. FinCEN, final rule postponing IA AML rule effective date to Jan 1, 2028 (Dec 31, 2025): https://www.fincen.gov/news/news-releases/fincen-issues-final-rule-postpone-effective-date-investment-adviser-rule-2028
6. Federal Register, FinCEN IA AML/CFT final rule (Sept 4, 2024): https://www.federalregister.gov/documents/2024/09/04/2024-19260/financial-crimes-enforcement-network-anti-money-launderingcountering-the-financing-of-terrorism
7. Orrick, FinCEN postpones IA AML rule until 2028: https://www.orrick.com/en/Insights/2025/07/FinCEN-Postpones-Investment-Adviser-AML-Rule-Until-2028
8. SEC, Cybersecurity Risk Management proposal page showing withdrawal (June 12, 2025): https://www.sec.gov/rules-regulations/2025/06/cybersecurity-risk-management-investment-advisers-registered-investment-companies-business
9. Stinson, SEC withdraws 14 proposed rules (July 2, 2025): https://www.stinson.com/newsroom-publications-sec-withdraws-proposed-rules-affecting-investment-advisers-funds-and-broker-dealers
10. SEC Division of Examinations, FY2026 Examination Priorities (Nov 17, 2025): https://www.sec.gov/files/2026-exam-priorities.pdf
11. SEC press release 2025-132, 2026 priorities: https://www.sec.gov/newsroom/press-releases/2025-132-sec-division-examinations-announces-2026-priorities
12. SEC, Examination Priorities index page: https://www.sec.gov/compliance/examination-priorities
13. Goodwin, 2026 SEC exam priorities for RIAs: https://www.goodwinlaw.com/en/insights/publications/2025/12/alerts-privateequity-pif-2026-sec-exam-priorities-for-registered-investment-advisers
14. White & Case, New priorities for 2026 (Jan 30, 2026): https://www.whitecase.com/insight-alert/new-priorities-2026-what-investment-advisers-and-broker-dealers-can-expect
15. Troutman, FY2026 priorities summary: https://www.troutman.com/insights/sec-division-of-examination-announces-fiscal-year-2026-priorities/
16. SEC Division of Investment Management, Marketing Compliance FAQs (updated March 19, 2025 and Jan 15, 2026): https://www.sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/marketing-compliance-frequently-asked-questions
17. SEC Division of Examinations Risk Alert on Marketing Rule testimonials, endorsements, third-party ratings (Dec 16, 2025): https://www.sec.gov/files/exams-riskalert-mrkt-rule-2512-508.pdf
18. Morgan Lewis, SEC staff issues updated Marketing Rule FAQs (March 21, 2025): https://www.morganlewis.com/pubs/2025/03/sec-staff-issues-updated-marketing-rule-faqs
19. Mayer Brown on March 2025 Marketing Rule FAQs: https://www.mayerbrown.com/en/insights/publications/2025/03/past-guidance-is-no-assurance-of-future-guidance-sec-staff-reverses-course-with-new-marketing-rule-faqs-on-extracted-performance-and-portfolio-characteristics
20. DOL EBSA, Retirement Security Rule page with notice of court vacatur (91 FR 13503, March 20, 2026): https://www.dol.gov/agencies/ebsa/laws-and-regulations/laws/erisa/retirement-security
21. IFEBP, DOL vacates fiduciary investment advice rule (April 14, 2026): https://blog.ifebp.org/dol-vacates-fiduciary-investment-advice-rule
22. Global Financial Regulatory Blog, Form N-PX for 13F filers effective July 1, 2024: https://www.globalfinregblog.com/2023/06/form-n-px-say-on-pay-disclosure-requirement-for-13f-filers-will-become-effective-july-1-2024/
23. Skadden, New Schedule 13G accelerated filing deadlines effective Sept 30, 2024: https://www.skadden.com/insights/publications/2024/09/new-schedule-13g-accelerated-filing-deadlines
24. SEC, Transition of Mid-Sized Advisers investor bulletin: https://www.sec.gov/files/transition-of-mid-sized-investment-advisers.pdf
25. SEC Division of Investment Management, FAQs regarding mid-sized advisers: https://www.sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/division-investment-management-frequently-asked-questions-regarding-mid-sized-advisers
26. NASAA, IAR CE FAQ: https://www.nasaa.org/industry-resources/investment-advisers/resources/iar-ce-faq
27. NASAA, IAR CE Member Adoption list: https://www.nasaa.org/industry-resources/investment-advisers/investment-adviser-representative-continuing-education/member-adoption/
28. NASAA, IAR CE FAQs PDF (July 2026): https://www.nasaa.org/wp-content/uploads/2026/07/IAR-CE-FAQs.pdf
29. IARD.com, IAR CE page (firm due-date feature): https://iard.com/iar-ce
30. STC, IAR CE requirements guide (25 jurisdictions as of Sept 2026): https://www.stcusa.com/resource-center/career/iar-ce-requirements-a-complete-guide/
31. Quest CE, IAR CE countdown and Dec 26 roster cutoff (Dec 9, 2025): https://www.questce.com/blog-iar-ce-countdown-what-you-need-to-know-before-dec-31/
32. California DFPI, IAR CE page: https://dfpi.ca.gov/regulated-industries/broker-dealers-and-investment-advisers/investment-adviser-representative-continuing-education-iar-ce
33. McDermott, T+1 and RIA books and records amendment effective May 28, 2024: https://www.mcdermottlaw.com/insights/reminder-t1-settlement-cycle-and-corresponding-ria-books-and-records-rules-go-into-effect-may-28/
34. SEC press release 2024-62, T+1 implementation statement: https://www.sec.gov/newsroom/press-releases/2024-62
35. SEC, Form ADV General Instructions (SEC 1707, 07-24): https://www.sec.gov/files/formadv-instructions.pdf
36. SEC, FAQs on Form ADV and IARD: https://www.sec.gov/about/divisions-offices/division-investment-management/electronic-filing-investment-advisers-iard/frequently-asked-questions-form-adv-iard
37. SEC, IARD information page (deferral of effective dates for late-year applicants): https://sec.gov/divisions/investment/iard.shtml
38. ACA Group, Tips for preparing your SEC Form ADV 2025 update: https://www.acaglobal.com/industry-insights/tips-preparing-your-sec-form-adv-2025-update/
39. IARD.com, Renewal Program: https://iard.com/renewal-program
40. IARD, 2026 Investment Adviser Renewal Program bulletin (Oct 2025): https://iard.com/sites/iard/files/2025-10/2026-IARD-Renewal-Bulletin.pdf
41. Dorsey, Deadlines for 2026 IARD renewal program: https://www.dorsey.com/newsresources/publications/client-alerts/2025/10/deadlines-for-2026-iard-renewal-program
42. SEC Order IA-6961, qualified client inflation adjustment (April 28, 2026): https://www.sec.gov/files/rules/ia/2026/ia-6961.pdf
43. Federal Register, qualified client order (May 1, 2026): https://www.federalregister.gov/documents/2026/05/01/2026-08480/order-approving-adjustment-for-inflation-of-the-dollar-amount-tests-in-rule-205-3-under-the
44. Kirkland, SEC announces new qualified client thresholds (May 4, 2026): https://www.kirkland.com/publications/kirkland-aim/2026/05/sec-announces-new-qualified-client-thresholds
45. Holland & Knight, SEC raises qualified client thresholds (June 11, 2026): https://www.hklaw.com/en/insights/publications/2026/06/sec-raises-qualified-client-thresholds-under-rule-205-3
46. 17 CFR 275.205-3 (Cornell LII): https://www.law.cornell.edu/cfr/text/17/275.205-3
47. SEC, Compliance Programs rule 206(4)-7 adopting release (2003): https://www.sec.gov/rules-regulations/2003/12/compliance-programs-investment-companies-investment-advisers
48. SEC, Investment Adviser Codes of Ethics rule 204A-1 (2004): https://www.sec.gov/rules-regulations/2004/07/investment-adviser-codes-ethics
49. SEC, Custody rule 206(4)-2 2009 amendments: https://www.sec.gov/rules-regulations/2009/12/custody-funds-or-securities-clients-investment-advisers
50. SEC, IM Guidance Update 2017-01 on SLOAs: https://www.sec.gov/investment/im-guidance-2017-01.pdf
51. SEC, Custody Rule Staff FAQs: https://www.sec.gov/divisions/investment/custody_faq_030510.htm
52. SEC, Standard of Conduct Interpretation IA-5248 (June 5, 2019): https://www.sec.gov/rules/interp/2019/ia-5248.pdf
53. SEC, Investment Adviser Marketing final rule (Dec 22, 2020): https://www.sec.gov/rules-regulations/2020/12/investment-adviser-marketing
54. SEC Risk Alert, Marketing Rule general prohibitions (April 17, 2024): https://www.sec.gov/files/exams-risk-alert-marketing-rule-041724.pdf
55. SEC Risk Alert, best execution (July 11, 2018): https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Best%20Execution.pdf
56. SEC Risk Alert, fee calculations (Nov 10, 2021): https://www.sec.gov/files/exams-risk-alert-fee-calculations.pdf
57. SEC, IM Guidance Update 2016-04 on business continuity: https://www.sec.gov/investment/im-guidance-2016-04.pdf
58. SEC, IM Guidance Update 2015-02 on cybersecurity: https://www.sec.gov/investment/im-guidance-2015-02.pdf
59. SEC, Identity Theft Red Flags Rules (Reg S-ID) 2013: https://www.sec.gov/rules-regulations/2013/04/identity-theft-red-flags-rules
60. 17 CFR 275.204-2 Books and records (Cornell LII): https://www.law.cornell.edu/cfr/text/17/275.204-2
61. 17 CFR 275.204-3 Brochure rule (Cornell LII): https://www.law.cornell.edu/cfr/text/17/275.204-3
62. 17 CFR Part 248 Subpart A, Reg S-P (Cornell LII): https://www.law.cornell.edu/cfr/text/17/part-248/subpart-A
63. SEC, Form CRS adopting release (June 2019): https://www.sec.gov/rules-regulations/2019/06/form-crs-relationship-summary-amendments-form-adv
64. SEC, Pay-to-play rule 206(4)-5 (2010): https://www.sec.gov/rules-regulations/2010/07/political-contributions-certain-investment-advisers
65. SEC, Proxy voting rule 206(4)-6 (2003): https://www.sec.gov/rules-regulations/2003/01/proxy-voting-investment-advisers
66. SEC, Internet adviser exemption amendments (March 2024): https://www.sec.gov/rules-regulations/2024/03/exemption-certain-investment-advisers-operating-through-internet
67. SEC, Beneficial ownership reporting modernization (Oct 2023): https://www.sec.gov/rules-regulations/2023/10/modernization-beneficial-ownership-reporting
68. SEC, Form 13F FAQs: https://www.sec.gov/divisions/investment/13ffaq.htm
69. SEC, CIP proposal for RIAs and ERAs (May 2024): https://www.sec.gov/rules-regulations/2024/05/customer-identification-programs-registered-investment-advisers-exempt-reporting-advisers
70. SEC press release 2024-98, off-channel communications settlements including RIAs (Aug 2024): https://www.sec.gov/newsroom/press-releases/2024-98
71. SEC press release 2024-36, AI washing enforcement (March 2024): https://www.sec.gov/newsroom/press-releases/2024-36
72. DOL EBSA, ERISA fidelity bond fact sheet: https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/fact-sheets/protect-your-employee-benefit-plan-with-an-erisa-fidelity-bond
73. DOL, 408(b)(2) service provider disclosure regulation: https://www.dol.gov/agencies/ebsa/laws-and-regulations/rules-and-regulations/completed-rulemaking/1210-AB08
74. NASAA, state investment adviser registration information: https://www.nasaa.org/industry-resources/investment-advisers/state-investment-adviser-registration-information/
75. NASAA, IAR examination requirements model rule (Dec 2024): https://www.nasaa.org/adopted-model-rule/examination-requirements-for-investment-adviser-representatives-2
76. FINRA, CRD forms (U4, U5): https://www.finra.org/registration-exams-ce/classic-crd/forms
77. OFAC FAQs: https://ofac.treasury.gov/faqs
78. CFA Institute, GIPS Standards: https://www.gipsstandards.org/
79. NCSL, state security breach notification laws: https://www.ncsl.org/technology-and-communication/security-breach-notification-laws

Note on sources 47 through 79: these are the standard primary rule pages and well-known guidance documents; their substance was not re-verified in this pass because the underlying rules did not change in 2024-2026 (except where noted above). Marketing Rule, custody, code of ethics, books and records, and compliance rule content reflects the rule text as it stands.

E. OPEN QUESTIONS (firm-specific facts needed)

1. Regulatory assets under management and SEC eligibility basis. If most revenue comes from model delivery and research subscriptions, model assets may not count as RAUM. Confirm the firm's current RAUM, whether it exceeds $90M, and if not, which Rule 203A-2 exemption (multi-state, internet adviser, pension consultant) or other basis supports SEC registration. This drives the whole Section A Registration domain.
2. Publisher's exclusion analysis. Does the research product qualify as a bona fide publication of general and regular circulation that is impersonal and disinterested (Section 202(a)(11)(D), Lowe v. SEC, 472 U.S. 181 (1985))? If the firm is registered anyway because of model delivery or managed accounts, the exclusion does not remove Advisers Act duties for the registered entity, but it affects how the research line is described in Form ADV and whether brochure delivery to subscribers is required (Rule 204-3(c) exception for impersonal advice under $500 per year).
3. Who is the client for the TAMP relationship. Is the firm a sub-adviser to the TAMP (with the TAMP as client), a model provider under a license agreement, or does it have any discretion or trading authority over end-investor accounts? This determines custody, Form ADV Item 5 client counts, RAUM, Form CRS applicability, trade rotation disclosures, and whether Form 13F aggregation is needed.
4. Retail investors. Does the firm have any direct retail clients? If yes, Form CRS, Reg S-ID covered accounts, Senior Safe Act procedures and retail-focused exam priorities apply in full. If no, document the determination annually.
5. Custody. Does the firm deduct fees from any end-investor account, hold any SLOAs, serve as trustee, or receive client funds? If none, the custody determination should be a one-page annual memo.
6. Performance fees. Are any fees (sponsor, subscriber or managed account) tied to performance? If yes, confirm qualified client status under the $1.4M/$2.7M thresholds for contracts on or after June 29, 2026, and check state law incorporation of the standard.
7. State footprint. Where are employees located (place of business for IAR registration), and in which states does the firm have more than 5 non-institutional clients in 12 months (notice filings)? Which of those states have adopted IAR CE? Remote employees create both registration and payroll/tax nexus.
8. ERISA exposure. Do any sponsor platform accounts or subscriber clients include ERISA plan assets where the firm could be a covered service provider under 408(b)(2) or a 3(21)/3(38) fiduciary? Does the firm handle plan funds (fidelity bond)? With the Retirement Security Rule vacated, the 1975 five-part test governs fiduciary status; confirm with ERISA counsel.
9. 13F and related filings. Does the firm exercise investment discretion over $100M or more in Section 13(f) securities (including any directly managed accounts)? If yes, Form 13F quarterly and Form N-PX by Aug 31 apply; if no, record the determination each quarter.
10. Private funds. Does the firm advise any private fund (Form PF, Form D, audited financials under the custody rule, qualified client look-through)? Assumed no.
11. Reg S-P scope. What sensitive customer information does the firm actually hold (sponsor account-level data, subscriber payment data, any end-investor PII)? Which vendors touch it, and have 72-hour notice assurances been obtained or best efforts documented after June 3, 2026?
12. Sales tax on subscriptions. In which states does the firm have nexus, and do those states tax digital information services or SaaS? A taxability study is a one-time project.
13. Insurance. Do current E&O and cyber policies cover publishing/media liability and model delivery, and do sponsor agreements require specific limits or additional-insured status?
14. AML posture before 2028. Does the firm want to adopt a voluntary right-sized AML policy now (OFAC screening, red flags, escalation) given sponsor DDQ expectations, and will FinCEN's promised scope revision change the firm's obligations?
15. CCO structure. Is the CCO role held by an operations leader or executive with other duties? If so, document the conflicts analysis, backup CCO, and whether an outside compliance consultant provides independent testing.
16. Communications channels. Which channels are used with sponsors and subscribers (email, Slack Connect, text, LinkedIn messages)? Each must be captured or prohibited in writing.
17. AI use. Which AI tools are used in research production, marketing, or client service, and what is said publicly about them? Any claim must be substantiated (FY2026 priority).
18. Not verified in this research: whether the joint SEC/FinCEN CIP rule for RIAs was finalized; the complete list of 25 IAR CE jurisdictions and whether Florida is among them; whether any Reg S-P staff FAQ was issued after the Sept 25, 2025 outreach event; whether any new Form ADV amendments were adopted in 2025-2026 (none found).