SEC Compliance Best Practices for Registered Investment Advisors

The SEC's examination program for registered investment advisors has grown more sophisticated, more targeted, and more consequential in recent years. The Office of Examinations has expanded its use of data analytics to identify outliers and prioritize examination candidates, and the areas of focus have shifted to reflect the evolving landscape of advisory services — including alternative investments, digital assets, and fee practices.

For RIAs, compliance is not a back-office function. It is a core business discipline that protects clients, preserves firm value, and enables sustainable growth. The firms that treat compliance as a genuine priority — not a checkbox exercise — are better positioned to survive examinations, avoid enforcement actions, and build lasting client trust.

Here are the compliance areas that deserve the most attention from independent RIAs today.

Form ADV: Accuracy Is Non-Negotiable

Form ADV is the foundation of an RIA's regulatory relationship with the SEC. Part 1 provides quantitative data about the firm; Part 2 — the brochure — is the primary disclosure document that clients receive. Both must be accurate, complete, and current.

Common Form ADV deficiencies that examiners flag include:

Stale or inaccurate AUM figures. AUM reported on Form ADV must reflect assets under management as of a recent date. Firms that fail to update their AUM annually — or that calculate it inconsistently — create an immediate red flag.

Incomplete conflict of interest disclosures. The SEC expects RIAs to identify and disclose all material conflicts of interest, including compensation arrangements with third parties, revenue-sharing agreements, and any financial interests that could influence investment recommendations. Incomplete disclosure is one of the most common examination findings.

Vague or outdated investment strategy descriptions. If your firm has evolved its investment approach — adding alternatives, changing fee structures, or expanding service offerings — the Form ADV must reflect those changes. Examiners compare what firms say they do with what they actually do.

Missing or inadequate Part 3 (Form CRS). Since its introduction, Form CRS has been a consistent examination focus. The relationship summary must be clear, accurate, and filed in the correct format. Firms that have not updated their CRS to reflect current services and fee arrangements are at risk.

Annual review of Form ADV is a regulatory requirement. Many firms treat it as a formality. It should be treated as a substantive compliance exercise.

Fiduciary Duty: The Standard Has Teeth

The SEC's interpretation of the investment advisor fiduciary standard — articulated in its 2019 guidance — makes clear that the duty of care and the duty of loyalty apply to every aspect of the advisory relationship, not just investment recommendations.

Duty of care requires advisors to have a reasonable basis for every recommendation, to understand each client's financial situation and objectives, and to monitor client accounts on an ongoing basis. Advisors who make recommendations without adequate due diligence, or who fail to monitor client portfolios after implementation, are in breach of their fiduciary duty regardless of client outcomes.

Duty of loyalty requires advisors to put client interests ahead of their own. This means identifying and managing conflicts of interest, not just disclosing them. An advisor who recommends a higher-fee product because it generates more compensation — even if the product is disclosed — may still be in violation of the duty of loyalty if a comparable lower-cost alternative was available.

The practical implication: every investment recommendation should be documented with a clear rationale that demonstrates how it serves the client's best interest. "We recommended this because it fit the client's risk profile and investment objectives" is not sufficient. The documentation should show that alternatives were considered and that the recommended approach was selected on the merits.

Custody: A Persistent Examination Priority

Custody of client assets remains one of the SEC's highest examination priorities. The custody rule — Rule 206(4)-2 under the Investment Advisers Act — imposes specific requirements on RIAs that have custody of client funds or securities, whether directly or constructively.

Many RIAs are unaware that they have constructive custody. Common situations that trigger custody include:

• Serving as trustee or co-trustee of a client trust
• Having authority to withdraw funds from a client account for fee payment
• Holding client login credentials for accounts at third-party custodians
• Serving as general partner of a fund in which clients are investors

RIAs with custody must engage a qualified custodian, provide clients with account statements, and — in most cases — undergo an annual surprise examination by an independent public accountant.

Firms that are uncertain about their custody status should consult with compliance counsel. The consequences of inadvertent custody violations can be severe, including enforcement action and reputational damage.

Marketing Rule Compliance

The SEC's amended marketing rule, which became effective in November 2022, significantly changed the framework for RIA advertising and client communications. The rule replaced the prior advertising and cash solicitation rules with a single, principles-based framework that is both more flexible and more demanding.

Key requirements under the new marketing rule:

Testimonials and endorsements are now permitted — but only with specific disclosures, including whether the person providing the testimonial is a client and whether they are being compensated. Firms using client testimonials or third-party endorsements must have written agreements with endorsers and must include required disclosures in all marketing materials.

Performance advertising has new standards. Net performance must be presented alongside gross performance. Time periods must be standardized. Hypothetical performance — including back-tested results — is subject to specific requirements and is prohibited in advertisements directed at retail investors unless the firm has policies and procedures governing its use.

Social media is advertising. Posts on LinkedIn, X (formerly Twitter), and other platforms that promote the firm's services are subject to the marketing rule. Firms must have policies governing employee social media use and must maintain records of all marketing communications.

Third-party ratings and rankings can be used in marketing materials only if the firm has a reasonable basis for believing the rating or ranking is fair and not misleading, and if required disclosures are included.

Compliance with the marketing rule requires a comprehensive review of all existing marketing materials, updated policies and procedures, and ongoing training for anyone involved in client communications.

Recordkeeping: The Foundation of Examination Readiness

The SEC's recordkeeping rules require RIAs to maintain extensive records for specified periods — generally five years, with the first two years in an easily accessible location. The categories of required records include:

• Client agreements and account documentation
• Trade records and order tickets
• Client communications, including emails and text messages
• Performance records and supporting calculations
• Compliance policies and procedures, including annual review documentation
• Marketing materials and related records

The shift to remote and hybrid work has created new recordkeeping challenges. Text messages and personal email accounts used for client communications are subject to the same recordkeeping requirements as firm email. Firms that have not addressed this risk — through policy, technology, or both — are exposed.

Examiners routinely request records going back several years. Firms that cannot produce complete, organized records quickly create a negative impression that can expand the scope of an examination.

Annual Compliance Review

Rule 206(4)-7 requires every SEC-registered RIA to conduct an annual review of its compliance policies and procedures to assess their adequacy and the effectiveness of their implementation. The review must be documented.

An effective annual review is not a self-congratulatory exercise. It should identify gaps between written policies and actual practices, assess whether policies remain appropriate given changes in the firm's business, and produce a written report with specific remediation items and responsible parties.

Firms that conduct superficial annual reviews — or that cannot produce documentation of the review — are at significant examination risk. The annual review is one of the first things examiners request.

Building a Compliance Culture

The most effective compliance programs are not built on policies and procedures alone. They are built on a culture in which compliance is understood as a client service function, not a constraint on business development.

That culture starts at the top. When firm leadership treats compliance as a genuine priority — allocating resources, participating in training, and modeling the behavior they expect from staff — the message is clear. When leadership treats compliance as a cost center to be minimized, the message is equally clear.

For independent RIAs, building that culture is both a regulatory imperative and a competitive advantage. Clients who trust that their advisor operates with integrity and rigor are more loyal, more likely to refer, and more resilient in periods of market stress.

The investment in compliance is an investment in the firm's long-term value. It deserves to be treated that way.