Highlights:

GENERAL PROHIBITIONS 

First, please be aware that the Rule prohibits the following practices (also called the “General Prohibitions”): 

• Making an untrue statement of material fact, or omitting a material fact that is necessary to make a statement not misleading; 
• Making a material statement of fact that cannot be substantiated;
• Providing information that would reasonably be likely to cause an untrue or misleading implication; 
• Discussing potential benefits without a fair and balanced treatment of associated risks; 
• Referencing specific advice that is not presented in a fair and balanced manner; 
• Including or excluding performance results or time periods, in a manner that is not fair and balanced; and
• Including information that is otherwise materially misleading.

These are principal-based prohibitions and should not be a problem with any compliance program. 

DEFINITION OF ADVERTISEMENT 

The definition of “advertisement” has changed. Under the Rule, “advertisement” contains two prongs: 

1. The first prong includes any direct or indirect communication made that:
   1. Offers advisory services to prospective clients (more than one); or
   2. Offers new advisory services to current clients (more than one).
2. The second prong includes any endorsement or testimonial for which an adviser provides cash or non-cash compensation directly or indirectly. 

This is a substantial change in that the first prong will exclude most one-on-one communications.

TESTIMONIALS AND ENDORSEMENTS

Testimonials and endorsements are allowed, as long as certain disclosure, oversight and disqualification provisions are in place such as:

• Disclosure. Disclosure means that any testimonial or endorsement must be clearly and prominently disclosed whether the promoter is a client and/or whether he or she is being compensated; 
• Oversight and a written agreement. The adviser must oversee that the firm is in compliance with the Rule; 
• Written Agreement. The adviser must seek a written agreement with the promoter, except where the promoter is an affiliate of the adviser or is receiving de minimis compensation (less than $1,000, directly or indirectly);
• Disqualification of Promoters. No “bad actors” can be promoters. 

The key here is that testimonials and endorsements are now allowed under “common sense” conditions. 

THIRD-PARTY RATINGS

The Rule allows the continued use of third-party ratings as long as certain criteria are used when preparing the rating. Some of the criteria are as follows:

• Third-party ratings include ratings or rankings of the firm that unrelated people provide in the ordinary course of business.
• Advisers must have a reasonable basis to believe that any questionnaire or survey used in the preparation of third-party ratings is structured to make it equally easy for participants to provide favorable and unfavorable responses and is not designated or prepared to produce any predetermined results. This requirement ensures that any third-party ratings in ads are unbiased and therefore reliable to investors (from a credible source and presents a complete picture of an adviser’s track record);
• Disclosure to ensure third-party ratings are presented contextually in a way that helps establish the third-party’s trustworthiness. Third-party ratings must disclose as follows:
  • The date the ratings were given and the period of time on which the ratings were based;
  • The identity of the third parties that created and tabulated the ratings; and 
  • If applicable, that advisers provided compensation directly or indirectly in connection with obtaining or using the third-party ratings.

PRESENTATION OF PERFORMANCE INFORMATION

The changes to the performance results are the most substantial part of the Rule and should be carefully reviewed when using performance numbers as part of the firm’s marketing. The following changes affect how the adviser will present “performance” information in advertisements:

• Gross performance can be presented only if net performance is also shown;
• Performance results generally must also show 1, 5 and 10-year time periods;
• Performance results must include all substantially similar strategies; less than all portfolios can be shown if it doesn’t cause results to be materially higher; 
• An extracted portfolio result can be used if the total performance results is also discussed; and
• Hypothetical performance can be used as long as the adviser can ensure that the performance is relevant and abides by policies and procedures that comply with the Rule.

BOOKS AND RECORDS; FORM ADV 

The Rule also has amendments to the books and records rule, and the Commission amended the Form ADV to require advisers to provide additional information regarding their marketing practices to help facilitate the Commission’s inspection and enforcement capabilities. 

CONCLUSION

In summary, the New Marketing Rule will impact your firm and must be implemented by November 4, 2022, one month away. This article aims to set forth the most critical changes. The Rule will require updated and new policies and procedures, likely an amended Form ADV (under Item 14, if Rule 206(4)-3, which will be  replaced, is mentioned), and significant training so that advisers understand what can, and cannot, be disclosed.  While the Rule may be voluminous and technical, we are always here to help you sort through the compliance jargon in order to devise a plan to ensure your compliance requirements are met so you can feel confident your firm is following the Rule properly and prepared for an eventual audit. 

This article does not in any way create an attorney-client relationship. This article should not be seen as legal advice. You should consult with an attorney before you rely on this information.

On Wednesday, March 30th, the SEC’s Division of Examinations (the “Division”) released its annual examination priorities for 2022, which cited a 20% increase in the number of RIAs over the past five years (from about 12,250 to over 14,800 RIAs). During this period, the number of RIAs with AUM over $10 billion rose by 30%, and total AUM now exceeds $113 trillion – almost 70% more than five years ago. Because the growth of RIAs has outpaced the Division’s own staff increases, the Division will likely lower its current examination coverage target of 15% of RIAs. However, as in past years, the Division intends to continue prioritizing RIAs that have never been examined, as well as those that have not been examined for several years.

Highlights:

1. Examination Focus Areas. The Division stated that it “will prioritize examinations of several significant focus areas that pose unique or emerging risks to investors or the markets, as well as examinations of core and perennial risk areas.” The significant focus areas are:

• Private Funds
• Environmental, Social, And Governance (ESG) Investing
• Standards of Conduct: Regulation Best Interest, Fiduciary Duty, and Form CRS
• Information Security and Operational Resiliency
• Emerging Technologies and Crypto-Assets

2. Fiduciary Duty. The third focus area listed above is, of course, central to all RIAs in that they have a fiduciary duty to their clients, “looking at both duties of care and loyalty, including best execution obligations, financial conflicts of interest and related impartiality of advice, and any attendant client disclosures.” The Division explains that key areas of RIAs it will review include:

(1) revenue sharing arrangements;

(2) recommending or holding more expensive classes of investment products when lower cost classes are available (e.g., RIAs that recommend no transaction fee mutual fund share classes that have 12b-1 fees in wrap fee accounts where the RIA may be responsible for paying transaction fees); 

(3) recommending wrap fee accounts without assessing whether such accounts are in the best interests of clients, including the impact of the move to zero commissions on certain types of securities transactions by a number of broker-dealers; and 

(4) recommending proprietary products resulting in additional or higher fees. Such reviews also will include an assessment of the adequacy of RIAs’:

(a) compliance policies and procedures designed to address conflicts and ensure advice in the best interest of clients, including the cost of investing; and 

(b) disclosures to enable investors to provide informed consent.”

3. Information Security and Operational Resiliency. Information security (and operational resiliency) is a perennial area of focus to all regulators given its critical role to ensuring the data of the RIA and its clients is protected. The Division will review RIAs to determine whether they “have appropriate measures to:

(1) safeguard customer accounts and prevent account intrusions, including verifying an investor’s identity to prevent unauthorized account access;

(2) oversee vendors and service providers;

(3) address malicious email activities, such as phishing or account intrusions;

(4) respond to incidents, including those related to ransomware attacks;

(5) identify and detect red flags related to identity theft; and

(6) manage operational risk as a result of a dispersed workforce in a work-from-home environment.”

The Division intends to review RIAs’ business continuity and disaster recovery plans, as well as to ensure they are complying with applicable privacy and information security regulations.

4. Emerging Technologies and Crypto-Assets. The last significant focus area is Emerging Technologies and Crypto-Assets and stems from the Division’s observation of a significant increase in the number of “robo-advisers” being used by RIAs, and the proliferation of offering crypto-assets as an investment option by RIAs.

5. Overview of the Division’s Examination Program. The Division’s examination of RIAs typically consists of a review “in one or more of the following core areas: marketing practices, custody and safety of client assets, valuation, portfolio management, brokerage and execution, conflicts of interest, and related disclosures.”

6. Policies and Procedures. In any examination of an RIA, it is a sure bet that the Division will review the RIA’s policies and procedures, its compliance program, and the RIA’s disclosure and assessment of its fees and expenses. The following chart summarizes what the Division will be looking for as it reviews these three key areas:

Policies & Procedures will be assessed to determine: 

(1) whether they are reasonably designed to prevent violations of the Advisers Act and its rules, including breaches of the RIA’s   fiduciary duty in violation of the antifraud provisions; and

(2) whether the RIA is reviewing and testing them periodically to ensure they are maintained and updated as appropriate. 

The RIA’s Compliance Program will be reviewed to determine:

(1) whether they address that investment advice is in each client’s best interest (i.e., that they are satisfying their obligations under Regulation BI); 

(2) whether the RIA’s oversight of service providers is adequate; 

(3) whether sufficient resources exist to perform compliance duties; 

(4) to   the extent RIAs use “alternative data or data gleaned from non-traditional   sources as part of their business and investment decision-making processes, whether RIAs are implementing appropriate compliance and controls around the creation, receipt, and use of potentially MNPI (material nonpublic information)”; and

(5) whether the RIA has implemented oversight practices to address any heightened risks. (The Division cites three (3) examples: (a) employing individuals with prior disciplinary histories; (b)   ensuring that a transition from a broker-dealer model to an RIA is in the   client’s best interest; and (c) for RIAs with multiple branch locations, ensuring their compliance program has been enhanced to appropriately oversee the activities of their branches.)

Disclosure and Assessment of Fees & Expenses  will be reviewed to identify any issues pertaining to: 

(1) advisory fee calculation errors, including, but not limited to, failure to adjust management fees in accordance with investor agreements; 

(2) inaccurate calculations of tiered fees, including failure to provide breakpoints and aggregate household accounts; and

(3) failures to refund prepaid fees for terminated accounts or pro-rated fees for onboarding clients.

Final Thoughts:

By conducting these examinations, the Division’s chief objective is to ensure RIAs have adequate and effective compliance programs (including ongoing testing, and training) that are designed to support and protect investors whose assets are entrusted with RIAs. To this end, every RIA should continue to place a high priority on maintaining and complying with their policies and procedures, compliance programs and disclosures (such as their Form ADV, Form CRS and any other client disclosures), and by doing so should result in having a fairly “pain-free” examination by the SEC’s Division of Examination. 

Please do not hesitate to contact Reymann Law Group, P.A. at office@reymannlawgroup.com should you have any questions or wish to have a review of any of your own materials that are addressed above.  

Sources:

The Division’s 2022 Priorities report may be viewed by following this link: https://www.sec.gov/files/2022-exam-priorities.pdf

On August 30, 2021, the Securities and Exchange Commission (“SEC”) issued findings and imposed remedial sanctions in three different matters involving violations of cybersecurity policies and procedures, which resulted in the exposure of customer records and information, including personal investment information.  

Applicable Rules:

The Safeguards Rule of Regulation S-P. Every broker-dealer and investment adviser registered with the Commission is required to adopt written policies and procedures reasonably designed to:

a) Insure the security and confidentiality to customer records and information;

b) Protect against any anticipated threatens or hazards to security or integrity of customer records and information; and

c) Protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer. 

Section 206(4) and Rule 206(4)-7. Every registered investment adviser or investment adviser that is required to register is required to adopt and implement written procedures reasonably designed to prevent violations, by the adviser or its supervised persons, of the Advisers Act, and the rules adopted by the Commission.

Highlights:

In related matters, the SEC found that the respondents’ financial advisers had email accounts that were accessed by unauthorized third parties which resulted in the exposure of customer records and other information. In many of the instances, emails containing personally identifiable information (“PII”) were forward to unauthorized email addresses after receiving a “phishing email”.  In each matter, the respondent eventually amended written policies and procedures that required use of a multi-factor authentication (“MFA”), however, urgency appears to be lacking in enacting the amendments. Lastly, the SEC found that when the Cetera respondents notified clients of the breach of their PII, such notice was not completely forthcoming when it referred to the incidents as “recent.” For example, the notice informed the client that it had been only “two” months since they had learned of the breach when it was at least six months since they had learned of the breach. And, by not informing the clients when the respondents actually learned of the breach, customers did not have the knowledge or ability to guard against potential misuse of their PII that may have occurred more than two months prior to receiving the respondent’s notice.  

So What Did We Learn?

Phishing happens. There is not a strict liability on being hacked, but after such an event it is expected that breach notifications are provided promptly and accurately, and any shortfalls in the written policies and procedures and in corporate training be remedied in a timely manner. Discovering account takeovers in 2018, due largely to a failure of use MFA, and then not implementing a MFA for the email accounts of representatives until 2021, resulted in a violation of the Safeguards Rule for Cambridge.   

MFA is the standard that is expected in cybersecurity policies and procedures.  This is obvious. 

Overall, the SEC’s makes it clear from the three orders that it requires (1) good oversight especially over independent contractor representatives’ and offshore contractors’ email accounts; (2) reasonable measures to be taken to create policies and procedures that ensure timely mitigation should a breach occurs; (3) accuracy of client notification regarding the timing of when the actual breach occurred; and (4) utilization of all available safeguards (i.e. MFA). 

In each of the matters, the SEC found that the respondents were in violation of the Safeguards Rule and Section 206(4) of the Advisers Act and Rule 206(4)-7 and ordered that each respondent undertake remedial efforts and pay a civil money penalty ranging from $200,000.00 to $300,000.00. 

In order to prevent a similar situation, we suggest that you immediately review your relevant polices and procedure and to use all MFA in a manner to ensure maximum protection of customer PII. Should you need our assistance, please do not hesitate to call. 

This article does not in any way create an attorney-client relationship. This article should not be seen as legal advice. You should consult with an attorney before you rely on this information.

Recently the SEC’s Division of Examinations (the “DOE” or the ”Staff” ) published a Risk Alert covering wrap fee program sponsored or offered by investment advisers. Wrap fee programs require advisory clients to pay a consolidated fee for investment service and other costs, including commissions, trading fees and administrative costs. As noted in the Risk Alert, the Division focused on wrap fee programs given the continued growth of investor assets participating in these programs. 

The Focus

According to the DOE, over 100 examinations of advisers associated with wrap fee programs were conducted, including advisers that served as a portfolio manager in, or a sponsor of, the wrap fee program, and advisers that used unaffiliated third-party wrap fee programs. 

As expected, the Staff reviewed whether advisers had fulfilled their fiduciary duty by having a reasonable basis to believe wrap fee programs were in the best interest of their client – both initially and on-going.  The Staff also looked into whether there were undisclosed transaction charges. 

The Staff also assessed whether advisers provided full and fair disclosures of all material facts to their clients, such as fees, expenses, conflicts of interests, and the entities involved. Lastly, the staff assessed the effectiveness of the adviser’s compliance and procedures.

Staff Observations

The first observation was that advisers generally did not adequately monitor the trading activity in clients’ accounts. Noted as the most common issue was the adviser’s failure to monitor trading away and the additional costs of such trading away practices. 

As suspected, the Staff also noted that, while initially okay, some advisers did not have a reasonable basis to believe that the wrap fee program were in the client’s best interest on an on-going basis. Thus, continuous assessments should be taken to ensure it is reasonable for the adviser to offer the wrap fee program to its clients. 

The Staff also noticed that disclosures were often inconsistent. Examples include variance in describing the wrap fee programs and its fees in the firm brochure, the wrap fee program brochure, advisory agreement and other wrap fee documents. The Staff also stated that many advisers had not adopted compliance policies and procedures that require initial and on-going reviews of wrap fee programs.  

Recommendations

Based on what the DOE observed, the following recommendations were made: 

1. Best Interest Reviews. Review of wrap fee programs should be conducted to assess whether the programs recommended to client are in their best interest, based on their financial situation, risk tolerances and investment objectives. This review needs to take place initially, and on an on-going basis to ensure that the program is in the client’s best interest. The on-going review should take place during the annual account or client review. 

2. Update Client Financial Situation. Periodically remind clients after conducting a best interest review to report any changes to their personal situations. 

3. Disclosure on Conflicts of Interest. Provide the client with disclosure regarding the advisers’ conflicts of interest related to transaction executed within the wrap fee programs. 

4. Wrap Fee Program Disclosure. Provide clear disclosure when recommending a wrap fee program, regarding services and expenses that are not included in the wrap fee. 

5. Adequate Policies and Procedures. Compliance policies and procedures of the adviser should include factors to be used when assessing whether investment recommendations favoring a wrap account is in the best interest of the client, and continues to be in his or her best interest on an on-going basis.  These procedures should also monitor how the adviser is seeking best execution on client transactions. 

Summary

In many ways, this is a low-hanging fruit. The SEC, as they demonstrated with mutual fund share classes, will always assume that the lower cost option that provides the same services as other higher cost options to be the fiduciary choice.  Despite this, there are many practical reasons to use wrap fee accounts – clients don’t necessarily want to be “nickeled and dimed” and often prefer the certainty of the wrap fee cost for convenience reasons.  

Notwithstanding the reasons that favor a wrap fee program, the SEC has made it clear that this is an area that will be examined, and therefore it is prudent to develop a process that requires a best interest review at the initial set-up of the wrap fee program and thereafter on an on-going basis. In addition, advisers need to disclose the fees and costs of the program, the adviser conflicts on recommending the program, and document its processes in a well written and fully descriptive compliance manual. Please contact us at 813-497-1400 if you have any questions regarding this Risk Alert and how you can mitigate any compliance issue associated with your wrap fee accounts. 

This article does not in any way create an attorney-client relationship. This article should not be seen as legal advice. You should consult with an attorney before you rely on this information.

On December 22, 2020, the Securities and Exchange Commission (“SEC”) announced that it had modernized the rules that govern investment adviser advertisements and payments to solicitors. The amendments create a single rule that replaces the current advertising rules. As noted by the SEC, the technology used for communications has evolved, and therefore the marketing rules need to recognize the changes. We are happy to report that the new “Marketing Rule” is beneficial to the industry. 

Highlights:

Marketing Rule Under the Act 

1. Definition of Advertisement. The amended definition of “advertisement” contains two prongs: one that captures communications traditionally covered by the advertising rule and another that governs solicitation activities previously covered by the cash solicitation rule. 

• First, the definition includes any direct or indirect communication an investment adviser makes that: (i) offers the investment adviser’s investment advisory services with regard to securities to prospective clients or private fund investors, or (ii) offers new investment advisory services with regard to securities to      current clients or private fund investors. The first prong of the definition excludes most one-on-one communications and contains certain other exclusions.
• Second, the definition generally includes any endorsement or testimonial for which an adviser provides cash and non-cash compensation directly or indirectly (e.g., directed brokerage, awards or other prizes, and reduced advisory fees).

2. General Prohibitions. The marketing rule will prohibit the following advertising practices:

• making an untrue statement of a material fact, or omitting a material fact necessary to make the statement made, in light of the circumstances under which it was made, not misleading;
• making a material statement of fact that the adviser does not have a reasonable basis for believing it will be able to substantiate upon demand by the Commission;
• including information that would reasonably be likely to cause an untrue or misleading implication or inference to be drawn concerning a material fact relating to the adviser;
• discussing any potential benefits without providing fair and balanced treatment of any associated material risks or limitations;
• referencing specific investment advice provided by the adviser that is not presented in a fair and balanced manner;
• including or excluding performance results, or presenting performance time periods, in a manner that is not fair and balanced; and
• including information that is otherwise materially misleading.

3. Testimonials and Endorsements. The marketing rule prohibits the use of testimonials and endorsements in an advertisement, unless the adviser satisfies certain disclosure, oversight, and disqualification provisions:

• Disclosure. Advertisements must clearly and prominently disclose whether the person giving the testimonial or endorsement (the “promoter”) is a client and whether the promoter is compensated. Additional disclosures are required regarding compensation and conflicts of interest. There are exceptions from the disclosure requirements for SEC-registered broker-dealers under certain circumstances. The rule will eliminate the current rule’s requirement that the adviser obtain from each investor acknowledgements of receipt of the disclosures.
• Oversight and Written Agreement. An adviser that uses testimonials or endorsements in an advertisement must oversee compliance with the marketing rule. An adviser also must enter into a written agreement with promoters, except where the promoter is an affiliate of the adviser or the promoter receives de minimis compensation (i.e., $1,000 or less, or the equivalent value in non-cash compensation, during the preceding twelve months).
• Disqualification. The rule prohibits certain “bad actors” from acting as promoters, subject to exceptions where other disqualification provisions apply. 

4. Third-Party Ratings. The rule prohibits the use of third-party ratings in an advertisement, unless the adviser provides disclosures and satisfies certain criteria pertaining to the preparation of the rating.

5. Performance Information Generally.  The rule prohibits including in any advertisement:

• gross performance, unless the advertisement also presents net performance;
• any performance results, unless they are provided for specific time periods in most circumstances;
• any statement that the Commission has approved or reviewed any calculation or presentation of performance results;
• performance results from fewer than all portfolios with substantially similar investment policies, objectives, and strategies as those being offered in the advertisement, with limited exceptions;
• performance results of a subset of investments extracted from a portfolio, unless the advertisement provides, or offers to provide promptly, the performance results of the total portfolio;
• hypothetical performance (which does not include performance generated by interactive analysis tools), unless the adviser adopts and implements policies and procedures reasonably designed to ensure that the performance is relevant to the likely financial situation and investment objectives of the intended      audience and the adviser provides certain information underlying the hypothetical performance; and
• predecessor performance, unless there is appropriate similarity with regard to the personnel and accounts at the predecessor adviser and the personnel and accounts at the advertising adviser. In addition, the advertising adviser must include all relevant disclosures clearly and prominently in the advertisement. 

Amendments to the Books and Records Rule and Form ADV

In connection with the marketing rule amendments and merger of the current advertising and cash solicitation rules, the Commission also adopted amendments to the books and records rule. In addition, the Commission amended Form ADV to require advisers to provide additional information regarding their marketing practices to help facilitate the Commission’s inspection and enforcement capabilities.

Withdrawal of Staff Guidance 

The staff of the Division of Investment Management will withdraw no-action letters and other guidance addressing the application of the advertising and cash solicitation rules as those positions are either incorporated into the final rule or will no longer apply. A list of the letters will be available on the Commission’s website.

How RLG Can Assist?

While the Marketing Rule reflects current best practices in marketing, it will likely result in practice changes for advisers, including private fund advisers. If you are not sure where to start, RLG can review your current policies and procedures and suggest changes that will ensure your compliance. Investment advisers have until November 4, 2022 to comply with the Marketing Rule, the Amended Books and Records Rule, and Form ADV. 

Sources:

The Marketing Rule is cited as Rule 206(4)-1, under the Investment Advisers Act of 1940, as amended:  https://www.sec.gov/rules/final/2020/ia-5653.pdf

Books and Records Rule (Rule 204-2) and Form ADV: https://www.sec.gov/rules/final/ia-2176.htm 

SEC Press Release: https://www.sec.gov/news/press-release/2020-334

Under the Advisers Act, Rule 206(4)-7 requires each registered investment adviser (RIA) to conduct an annual review of its policies and procedures to determine their adequacy and the effectiveness of their implementation. The SEC recommends that the review “consider any compliance matters that arose during the previous year, any changes in the business activities of the adviser or its affiliates, and any changes in the Advisers Act or applicable regulations that might suggest a need to revise the policies or procedures.” (It is recommended that state-registered investment advisers conduct a similar annual review, as well.)

“Rule 206(4)-7 – Compliance procedures and practices” reads as follows:

If you are an investment adviser registered or required to be registered under section 203 of the Investment Advisers Act of 1940 (15 U.S.C. 80b-3), it shall be unlawful within the meaning of section 206 of the Act (15 U.S.C. 80b-6) for you to provide investment advice to clients unless you:

(a) Policies and procedures. Adopt and implement written policies and procedures reasonably designed to prevent violations, by you and your supervised persons, of the Act and the rules that the Commission has adopted under the Act;

(b) Annual review. Review, no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation; and

(c) Chief compliance officer. Designate an individual (who is a supervised person) responsible for administering the policies and procedures that you adopt under paragraph (a) of this section.

The Chief Compliance Officer (“CCO”) is expected to be knowledgeable regarding applicable securities laws, and should have sufficient seniority and authority to compel others within the firm to adhere to its compliance policies and procedures.  If the CCO has other organizational functions or another role, the firm should be prepared to be asked whether it has identified and managed any potential conflicts of interest. While the CCO is expected to be in charge of the compliance review, the CCO may engage others (such as members of a management committee, internal audit, or an independent audit or consulting firm) to assist with review process. 

In various SEC guidance, SEC staff has recommended that the annual review be an active ongoing process throughout the year. The annual review of the firm’s compliance policies and procedures is be designed to prevent violations of the Advisors Act from occurring, detect violations that have occurred; and promptly correct any violations that have occurred. The intent of an RIA’s overall compliance program should be to identify the firm’s regulatory obligations, mitigate conflicts of interest that could result in harm to clients, and address risks to the firm and its clients. 

In its adopting release of Rule 206(4)-7, the SEC provided a list of “critical areas” (i.e., areas of risk) that the RIA’s compliance manual should address: 

1. Portfolio management processes, including allocation of investment opportunities among clients and consistency of portfolios with clients’ investment objectives, disclosures by the adviser, and applicable regulatory restrictions;

2. Trading practices, including best execution, soft dollar arrangements, and trade allocation;

3. Proprietary trading of the adviser and personal trading activities of its employees and access persons;

4. The accuracy of disclosures made to investors, clients, and regulators, including account statements and advertisements;

5. Safeguarding of client assets from conversion or inappropriate use by advisory personnel;

6. The accurate creation of required records and their maintenance in a manner that secures them from unauthorized alteration or use and protects them from untimely destruction;

7. Marketing advisory services, including the use of solicitors;

8. Processes to value client holdings and assess fees based on those valuations;

9. Safeguards for the privacy protection of client records and information; and

10. The adoption of a business continuity plan.

In addition, pursuant to the SEC’s OCIE Risk Alert guidance, RIAs should implement cybersecurity policies and procedures. Policies and procedures must be tailored to the RIA’s own business, so while a boiler-plate compliance manual may be used by a new RIA as a starting point, it should be customized to address all of the RIA’s business risks. As changes are made, it is important to retain documentation of the revisions to the firm’s policies and procedures. During an examination by the SEC OCIE staff, examiners will typically assess whether the current policies and procedures are designed to detect breaches of the federal securities laws and will determine whether the firm’s policies and procedures have been implemented effectively. Failure to have adequate policies and procedures in place would result in a violation under Section 206(4), independent of any other securities law violation.

There are several steps to determining the adequacy of a firm’s policies and procedures that include:

1. Conducting periodic risk assessments (no less than annually) to identify the firm’s key risks and the controls that are in place to mitigate those risks (be sure to retain an inventory of these risks and to document of any changes, such as new compliance risks identified); 

2. Reviewing the report of the last annual review (e.g., were recommendations from the previous year’s report implemented?);

3. Reviewing the report from the last regulatory examination, and verifying that past deficiencies were properly addressed;

4. Reviewing any significant compliance issues that occurred over the past year, or any business activity or organizational changes to the firm;

5. Conducting transactional testing in higher risk areas of the firm, as well as areas where deficiencies were previously observed; and

6. Ensuring the firm’s policies and procedures address new laws and regulations applicable to the firm’s business, or new areas of focus by the SEC (or by other appropriate regulatory agencies).

A formal written report should be drafted at the conclusion of the annual review, which should include:

• A description of the firm’s business, its services, clients and AUM (as persons outside the firm may read this report); 
• Who conducted the review, and the extent to which business line staff (operations and management personnel) were involved;
• What was reviewed (i.e., listings of the policies, procedures, business functions, transactions, materials, etc.), and why (e.g., based on the annual risk assessment);
• How the review was conducted (e.g., interviews with staff, exception reports, transaction testing, ongoing monitoring, and confirmation of reviews of policies and procedures by business line managers);
• When the reviews were conducted, including the activity timeframe;
• The results/findings from the reviews (and the status of any corrective action taken or to be taken), particularly highlights of any significant exceptions or trends identified; and
• A conclusion on whether the firm’s compliance policies and procedures are adequate and effective, along with any recommendations for senior management.

If the firm has a governing board, it is a best practice to present the final report at a board meeting, as well. Lastly, it is important to remember that records documenting the annual review need to be retained for five years.

This article does not in any way create an attorney-client relationship. This article should not be seen as legal advice. You should consult with an attorney before you rely on this information.