Short answer
For an adviser registered or required to be registered with the SEC, one rule sets the frame. Rule 206(4)-7 requires written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules, a review of them at least once a year, and a designated chief compliance officer (CCO) who is a supervised person. [1] The rule does not list the contents. The adopting release says each adviser should write policies that take account of the nature of that firm's operations. [2]
What your policies should cover
The SEC's adopting release names these areas, to the extent they are relevant to your firm: [2]
- Portfolio management, including allocating investments among clients and keeping portfolios consistent with client objectives
- Trading practices, including best execution, soft dollars and aggregating trades
- Proprietary and personal trading by the firm and its supervised persons
- Accuracy of disclosures to clients, investors and regulators
- Safeguarding client assets from misuse
- Accurate records, protected from unauthorized alteration or early destruction
- Marketing, including the use of solicitors
- Valuing client holdings and calculating fees
- Protecting client privacy
- Business continuity planning
Examiners of newly registered advisers found policies that did not adequately address risk areas that applied to the firm, such as portfolio management and fee billing. They also found policies with no procedures to enforce them, policies staff did not know about, and compliance manuals that were off the shelf and not tailored to the firm's business. [4]
Your chief compliance officer
The release says a CCO should be competent in the Advisers Act and have enough seniority and authority within the firm to compel others to follow the policies. [2] At a small firm the owner is often the CCO. Examiners have flagged firms that gave the CCO additional, unrelated duties, leaving little time for compliance, and firms that outsourced compliance functions without checking how they were performed. [4] If you outsource, you still own the program.
The annual review
Review the adequacy of your policies and how well they are working at least once a year. The release says the review should consider compliance matters from the past year, changes in your business and your affiliates' businesses, and changes in the Advisers Act and its rules. [2] Examiners of new advisers found annual reviews that did not address the adequacy of the policies and the effectiveness of their implementation. [4] On Sep 14, 2026 the Division of Examinations issued a risk alert on annual compliance reviews, encouraging advisers to reflect on their practices, policies and procedures and to make appropriate changes to their review process. [5] Keep a written record of each review: Rule 204-2 requires copies of your policies in effect within the past five years, and records of annual reviews. [3]
Code of ethics
Rule 204A-1 requires a written code that includes: [6]
- a standard of business conduct that reflects your fiduciary obligations
- a requirement that supervised persons comply with federal securities laws
- reporting and review of access persons' personal securities holdings and transactions
- prompt reporting of violations to the CCO
- delivery of the code and any amendments to each supervised person, with a written acknowledgment
Access persons file a holdings report within 10 days of becoming one and at least every 12 months, and a transaction report within 30 days after each calendar quarter. They need approval before buying an IPO or a limited offering. If you are the firm's only access person, you do not report to or approve your own trades, but you must keep records of the holdings and transactions the rule would otherwise require. [6]
Books and records
Rule 204-2 lists the records an adviser must keep, including journals and ledgers, order memoranda, bank statements, written communications about advice, written client agreements, copies of advertisements, brochures and Form CRS, performance support, policies and annual reviews. [3]
- Retention. At least five years from the end of the fiscal year in which the last entry was made, the first two years in an appropriate office of the adviser. Advertisements and performance records run five years from the end of the fiscal year they were last disseminated. [3]
- Electronic storage. Allowed if you arrange and index records for easy retrieval, can promptly produce complete copies, keep a separate duplicate copy for the whole retention period, and have procedures to guard against loss and alteration and to limit access. [3]
Other obligations to build in
- Form CRS and brochure delivery. [7] [8] See legal essentials for an independent RIA.
- Marketing. Advertising, testimonials, third-party ratings and performance have their own rules. See the SEC Marketing Rule guide.
- Custody and custodians. See choosing a custodian.
- Privacy, data security and incident response. Amended Regulation S-P adds an incident response program and customer notification. See RIA cybersecurity.
- Fee billing. See fee schedules and pricing models.
A year at a glance
| When | What | Rule |
|---|---|---|
| Within 10 days of becoming an access person | Initial holdings report | [6] |
| Within 30 days after each quarter | Transaction reports | [6] |
| At least every 12 months | Access persons' holdings reports; annual review of policies | [6] [1] |
| Within 90 days after fiscal year end | Annual Form ADV updating amendment | [9] |
| Within 120 days after fiscal year end | Annual brochure delivery to clients (brochure or summary of material changes) | [8] |
AdvisorIQ also keeps a compliance calendar of regulatory deadlines.
State-registered advisers
Rule 206(4)-7 applies by its terms to advisers registered or required to be registered under section 203 of the Advisers Act, that is, SEC-registered advisers. [1] A state-registered adviser follows its state's law. State-registered advisers file Form ADV Part 1A and Part 1B, the part that applies to them only. [10]
In November 2020 NASAA members adopted a model rule that would require advisers to maintain written policies and procedures on regulatory compliance and supervision, proxy voting, physical security and cybersecurity, business continuity and succession, code of ethics compliance, and handling of material nonpublic information. It is a model: each state must adopt it before it applies there. [11] Check which rules your state has adopted through your state regulator. [12]
Where to start
- List what your firm actually does: services, account types, who trades, who bills, where client data lives.
- Write a short policy and a named owner for each area above that applies.
- Name your CCO and give the CCO time to do the job.
- Adopt the code of ethics and collect acknowledgments.
- Set up your records and a place to keep each annual review.
- Test the policies once, then review the whole program on a fixed date every year.
This guide is educational, not legal advice. Talk to securities counsel or a compliance consultant about your own program. See also how to start an RIA.