Outsourced CCO: when a small RIA should hire one

The rule is one sentence long on this point. A registered adviser must designate an individual, that individual must be a supervised person of the firm, and the job is to administer the written policies the firm adopts under paragraph (a). The rule does not say employee, full-time, in-house or on-site. That silence is the whole reason an outsourced CCO is possible, and it is also why the arrangement has to be built with care.

An outside consultant is not your partner, officer or employee, so the question is whether the engagement puts them under your “supervision and control” in the sense the definition uses. Firms that sell the role answer it in their engagement letters. Read that clause first, and have your compliance counsel read it too.

The adopting release adds what the Commission expects of the person. The CCO “should be competent and knowledgeable regarding the Advisers Act and should be empowered with full responsibility and authority to develop and enforce appropriate policies and procedures for the firm,” with “a position of sufficient seniority and authority within the organization to compel others to adhere to the compliance policies and procedures.” It also says the rule “does not require advisers to hire an additional executive to serve as compliance officer, but rather to designate an individual as the adviser's chief compliance officer.” The full rule, duty by duty, is in our guide to Rule 206(4)-7.

Small advisers fill the seat in one of three ways. An in-house CCO is a principal or employee, often the owner. An outsourced CCO is a named person at a consulting firm who holds the title and runs the program. In the consultant-assisted model the title stays inside and a consultant is hired for set pieces of work: the manual, the testing behind the annual review, a mock exam. The table puts the three side by side.

Two rows matter most. Knowledge of the business is what an outside officer has to rebuild on every visit, and authority is what an outsider has only if the owners give it to them in writing and then back it. Neither is a reason to rule outsourcing out. Both are things to put in the contract.

Card 02

Outsourcing moves the work and the title. It does not move the duty. The SEC's exam staff said so plainly when they reported on firms that had outsourced the role.

In practice that means the owners stay close to the program. They sit in on the annual review, read its findings, and act on them. They keep the books and records in the firm's own systems, so the program does not leave when the consultant does. The annual compliance review planner lays the review out in steps a non-specialist owner can follow.

No rule picks a model for you, and no survey can say which one suits your firm. What follows is reasoning: signals a small adviser can see in its own office, the model each points toward, and why. Most firms will see more than one signal. Where they disagree, the knowledge and authority rows of the table above break the tie.

A newly registered firm meets most of these at once, which is why starting an RIA is the moment many owners first consider an outside officer. If you keep the seat in-house, the RIA compliance checklist is the list your CCO works from, and RIA compliance software can carry the calendar and the evidence.

In 2015 the SEC's exam staff published what they saw at advisers and funds that outsource the CCO. They also saw outsourced CCOs who were “generally effective”, and they tied that to “regular, often in-person, communication”, sufficient access to documents, and the CCO's knowledge of both the rules and the business. The weaknesses they found are a checklist for any engagement letter.

The Risk Alert is staff guidance, not a rule, and it says the Commission expressed no view on it. It is still the most direct thing the SEC has published about this arrangement. Read it in full on sec.gov.

Every question below comes from the rule, the release or a staff finding, and the source sits under each one. Ask them before you sign, and keep the answers with the engagement letter. They are the first papers an examiner will ask about if the arrangement is questioned.

We read six RIA compliance consultants' own pages on October 22, 2026 for our RIA compliance consultants comparison. Four state an outsourced CCO service: Joot, Core Compliance, ACA Group and InnReg. Quadrant and Comply do not name one on the pages we read. The status words below are the same ones that comparison uses, and they reflect each firm's own pages, not a test of the service.

A stated service is where the questions start, not where they end. None of these pages tells you who the named person would be, how many firms they serve, or how often they would visit. That is what the questions above are for. The full cards, with what each page leaves unverified, are in the comparison.

A dual registrant has two CCO seats to think about, and the FINRA one is narrower.

On the broker-dealer side the CCO is a principal named on Form BD, so an outside person has to be registered with your firm to hold the role. The chief executive also certifies each year, and confirms meeting the chief compliance officer “in the preceding 12 months to discuss such processes.” A consultant can prepare that meeting; the CEO still holds it and signs. The rest of that side is in FINRA compliance for broker-dealers.

The FINRA compliance consultants comparison reads each of these firms for the rest of a member firm's year. Ask any of them how the person would be registered with you, and check the arrangement with your compliance counsel.

This guide explains the rule and what exam staff have said about it; it is not legal advice. Check any outsourcing arrangement with your compliance counsel against the text of Rule 206(4)-7 on eCFR. The wider adviser program is mapped in RIA compliance.