# How to Build an RIA Compliance Program: Rule 206(4)-7, CCO and Annual Review

As of Oct 20, 2026, SEC Rule 206(4)-7 requires an SEC-registered adviser to adopt written compliance policies, review them at least once a year and designate a chief compliance officer, and the SEC's Division of Examinations published a risk alert on annual compliance reviews on Sep 14, 2026.

As of: 2026-10-20
Address: https://advisoriq.com/practice/guides/compliance-program-for-a-new-ria/

## Facts

- Summary: What Rule 206(4)-7 requires, what to write, your chief compliance officer, the code of ethics, records and how state-registered firms differ.
- Key facts: Rule 206(4)-7 applies to an adviser registered or required to be registered under section 203 of the Advisers Act, and requires written policies, an annual review and a designated chief compliance officer.; The SEC's adopting release lists ten areas policies should cover to the extent they are relevant to the firm, from portfolio management to business continuity.; Books and records are kept at least five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the adviser.; SEC examiners of newly registered advisers found off-the-shelf manuals, chief compliance officers with unrelated duties, and policies that left out fee billing.

## Notes

- Educational, not legal, tax or investment advice.
- Practice management content is not eligible for CFP Board CE. CFP Board plans to allow up to five hours of it per cycle once its Q4 2027 changes take effect.

## Sources

- Legal Information Institute, Cornell Law School: 17 CFR 275.206(4)-7, compliance procedures and practices, checked 2026-10-20: https://www.law.cornell.edu/cfr/text/17/275.206(4)-7
- U.S. Securities and Exchange Commission: Compliance Programs of Investment Companies and Investment Advisers, Release IA-2204, checked 2026-10-20: https://www.sec.gov/rules-regulations/2003/12/compliance-programs-investment-companies-investment-advisers
- Legal Information Institute, Cornell Law School: 17 CFR 275.204-2, books and records to be maintained by investment advisers, checked 2026-10-20: https://www.law.cornell.edu/cfr/text/17/275.204-2
- U.S. Securities and Exchange Commission, Division of Examinations: Risk Alert: Observations from Examinations of Newly-Registered Advisers, checked 2026-10-20: https://www.sec.gov/files/risk-alert-newly-registered-ias-032723.pdf
- U.S. Securities and Exchange Commission, Division of Examinations: Risk Alert: Examinations Observations Regarding Investment Adviser Annual Compliance Review, checked 2026-10-20: https://www.sec.gov/compliance/risk-alerts/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426
- Legal Information Institute, Cornell Law School: 17 CFR 275.204A-1, investment adviser codes of ethics, checked 2026-10-20: https://www.law.cornell.edu/cfr/text/17/275.204A-1
- Legal Information Institute, Cornell Law School: 17 CFR 275.204-5, delivery of Form CRS, checked 2026-10-20: https://www.law.cornell.edu/cfr/text/17/275.204-5
- Legal Information Institute, Cornell Law School: 17 CFR 275.204-3, delivery of brochures and brochure supplements, checked 2026-10-20: https://www.law.cornell.edu/cfr/text/17/275.204-3
- Legal Information Institute, Cornell Law School: 17 CFR 275.204-1, amendments to Form ADV, checked 2026-10-20: https://www.law.cornell.edu/cfr/text/17/275.204-1
- U.S. Securities and Exchange Commission: Form ADV (Parts 1A, 1B, 2 and 3), checked 2026-10-20: https://www.sec.gov/files/formadv.pdf
- NASAA: NASAA members adopt model rule consolidating existing policies and procedure for state-registered IAs, checked 2026-10-20: https://www.nasaa.org/56250/nasaa-members-adopt-model-rule-consolidating-existing-policies-and-procedure-for-state-registered-ias/
- NASAA: Contact Your Regulator, checked 2026-10-20: https://www.nasaa.org/contact-your-regulator/

## Related

- [Advisor Capacity Calculator: How Many Households Can You Serve?](https://advisoriq.com/practice/calculators/advisor-capacity/)
- [Advisor Fee Revenue Calculator: AUM Fee Schedule vs Flat Fee](https://advisoriq.com/practice/calculators/fee-revenue/)
- [How to Start an RIA: SEC vs State Registration](https://advisoriq.com/practice/guides/how-to-start-an-ria-sec-vs-state-registration/)
- [How to Price Advisory Services: Fee Schedules and Pricing Models](https://advisoriq.com/practice/guides/advisor-fee-schedules-and-pricing-models/)
- [Hiring Your First Advisor or Operations Hire: Roles, Licensing and Structure](https://advisoriq.com/practice/guides/hiring-first-advisor-or-operations-hire/)
- [Legal Essentials for an Independent RIA: Entity, Advisory Agreement and Insurance](https://advisoriq.com/practice/guides/legal-essentials-for-an-independent-ria/)
- [How to Choose an RIA Custodian: What Custodians Do and What to Ask](https://advisoriq.com/practice/guides/choosing-an-ria-custodian/)
- [Financial Advisor Technology Stack: What You Need, How It Connects and How to Budget](https://advisoriq.com/practice/guides/advisor-technology-stack/)
- [RIA Cybersecurity: Regulation S-P, Regulation S-ID and Practical Controls](https://advisoriq.com/practice/guides/ria-cybersecurity-and-client-data-protection/)
- [Marketing for Financial Advisors: How to Attract Clients](https://advisoriq.com/practice/guides/marketing-for-financial-advisors/)
- [SEC Marketing Rule for Advisors: Testimonials, Ratings and Performance](https://advisoriq.com/practice/guides/sec-marketing-rule-for-advisors/)

## Cite as

AdvisorIQ, as of 2026-10-20. https://advisoriq.com/practice/guides/compliance-program-for-a-new-ria/

License: https://advisoriq.com/license/