RIA compliance: what a small adviser must run

A small SEC-registered adviser does not run six compliance projects. It runs one program with six parts, and each part leaves a record. The compliance-program rule says the policies must exist and be reviewed. The books-and-records rule says what gets kept. The code of ethics, the Marketing Rule, the Form ADV and Form CRS filings and Regulation S-P each add duties of their own, and each of those duties shows up in the records.

This page sets out what each part asks of a firm of one to ten people and how the parts fit into one year. Each part has its own guide with the full rule text. If you want the whole program as a printable list for your firm type, the RIA and FINRA compliance checklist builds one.

The Advisers Act rules on this page apply to an adviser “registered or required to be registered under section 203” of the Act, which means registered with the SEC. The compliance-program rule says plainly what happens without it: it is unlawful “for you to provide investment advice to clients” unless the three program duties are met.

Size decides which regulator you answer to. Form ADV's instructions say “you must apply for registration with the SEC if your regulatory assets under management are $110 million or more”. Between $100 million and $110 million the rule gives a choice: “You may, but are not required to register with the Commission”, and you “need not withdraw your registration unless you have less than $90,000,000 of assets under management.” A mid-sized adviser, with “$25 million or more but less than $100 million”, registers with the SEC only if it meets one of the conditions listed in the Form ADV instructions. The startup side of that decision is in how to start an RIA.

Two other cases change the picture. An exempt reporting adviser files parts of Form ADV, but the brochure supplement (Part 2B) and the relationship summary (Part 3) “do not apply to exempt reporting advisers”. A firm that is also a broker-dealer runs a FINRA program beside the adviser's one, covered in FINRA compliance for broker-dealers. On records, Rule 204-2(h)(1) treats a record kept under the broker-dealer rules “which is substantially the same” as one the adviser rule requires as kept in compliance with it. Have counsel confirm which of your records that covers.

Card 02

The program rule is three sentences long, and everything else on this page hangs from it. It asks for policies, a yearly review and a named person. It does not list the policies a firm must have, so a small adviser writes policies for the business it really runs: the clients it takes, the custody it has or does not have, the channels its people use, and the advertising it does.

The person named under paragraph (c) must be “a supervised person”. Whether an outside chief compliance officer can fill that seat, and when a small firm should hire one, is covered in our guide to an outsourced CCO. The policies themselves can start from our RIA compliance manual template, as long as you edit it to describe your own firm.

Rule 204-2 is the list of what the firm must be able to hand over. For a small adviser the records that matter most are written communications about advice and orders, client agreements, the advertisements, the code of ethics papers, the brochures and Form CRS with their delivery dates, the compliance policies, and the records of the annual review. The full list is in the Rule 204-2 guide, and the books and records checklist generator turns it into a list for your firm.

The general period runs “not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.” By our reading of the rule, a record last written to in 2026, at a firm with a December 31 year end, is kept until at least December 31, 2031, and in the office through December 31, 2028. Several records carry their own periods (an advertisement's five years run from the end of the fiscal year in which it was last disseminated, for example). The retention calculator works each one out.

The communications record is narrower than many advisers assume. It covers written communications about “any recommendation made or proposed to be made and any advice given or proposed to be given”, about funds or securities moving, about orders, and about performance. By our reading, a text message about a client's rebalance falls in that first group whatever app carried it, which is the subject of our guide to off-channel communications.

Records may be kept on electronic storage media. The rule then asks the adviser to arrange and index them “in a way that permits easy location, access, and retrieval of any particular record”, to keep a duplicate copy separately, and to limit access to “properly authorized personnel and the Commission”. It does not require the non-rewriteable storage that the broker-dealer rule describes. Firms choosing an archive compare email archiving software or match their channels with the archiving requirements matcher.

The code of ethics has two halves. The first is a document: a standard of business conduct that reflects the firm's fiduciary duties, a requirement to follow the federal securities laws, prompt reporting of violations “to your chief compliance officer”, and a signed acknowledgment from each supervised person. The second is a reporting system for access persons, and that is where the dates are.

Who counts as an access person is wider than many small firms expect. It includes anyone with access to nonpublic information about clients' trades or holdings, or who makes or sees nonpublic recommendations, and “if providing investment advice is your primary business, all of your directors, officers and partners are presumed to be access persons.” Access persons also need the firm's approval before buying into an initial public offering or a limited offering.

That paragraph is the one-person firm's relief, and it is conditional on keeping the records. Once a second access person joins, its condition of “only one access person” no longer holds. The code of ethics reporting calendar dates each report, the code of ethics guide covers the contents and exceptions, and firms that want the reports collected for them compare personal trading compliance software.

Under the Marketing Rule an advertisement is any communication to more than one person (or to one, if it shows hypothetical performance) that offers the adviser's services to prospective clients or offers new services to current ones, plus any testimonial or endorsement the adviser pays for. By our reading, a web page, a newsletter or a social post that offers the firm's services can qualify. Extemporaneous, live, oral communications are left out.

On top of those seven, the rule sets conditions for particular content. A testimonial or endorsement needs clear and prominent disclosures, a reasonable basis for believing it complies, and, if more than de minimis compensation is paid, a written agreement. Gross performance needs net performance beside it with “at least equal prominence”. Portfolio performance outside private funds needs one-, five- and ten-year periods. And no advertisement may say the SEC approved or reviewed its performance figures.

Every advertisement is kept: a copy of each one, the working papers behind any performance it shows, and the basis for each testimonial or endorsement, for five years from the end of the fiscal year in which it was last disseminated. Run each draft through the Marketing Rule ad review checklist, read the Marketing Rule guide for the performance conditions, and see advertising review software if a review queue would help.

Form ADV is the registration form, and it is never finished. Parts 1 and 2 are amended “at least annually, within 90 days of the end of your fiscal year”, and sooner when the instructions say so. Some items of Part 1A must be amended “promptly” if they become inaccurate in any way, others if they become materially inaccurate, and the brochure promptly if it “becomes materially inaccurate”. A change in assets under management or in the fee schedule alone does not force a brochure update between annual amendments.

Amendments to Parts 1A, 2A and 3 are filed on the IARD system. Amendments to the brochure supplements (Part 2B) need not be filed with the SEC; a supplement goes to the client before or when that supervised person starts advising them. The Form ADV annual amendment date planner works out your dates from your own year end. The parts and items are set out in what is Form ADV and the Part 2A and 2B guide.

Form CRS, the relationship summary, is Part 3 of Form ADV for an adviser. It applies only to firms with retail investors: a retail investor is “a natural person, or the legal representative of such natural person, who seeks to receive or receives services primarily for personal, family or household purposes.” If you have none, the instructions say “you are not required to prepare or file one.”

The Form CRS builder drafts the required sections from your services and fee types for you to edit. Ask your compliance counsel to read the final wording before you file it.

Regulation S-P applies to an investment adviser registered with the SEC. It asks for written policies and procedures covering “administrative, technical, and physical safeguards for the protection of customer information”, and since the 2024 amendments those policies must include a program “reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures”. A written disposal policy sits beside it.

Vendors are part of it. The firm's oversight policies must be reasonably designed so that a service provider gives notice “as soon as possible, but no later than 72 hours after becoming aware” of a breach of a customer information system it maintains, and the duty to notify the clients themselves “rests with the covered institution.” For a small adviser that list can include the CRM, the email host, the archive and any outside IT support. Our CRM comparison reads each CRM against those duties.

An adviser with less than $1.5 billion in assets under management is a smaller entity, which had 24 months after publication on June 3, 2024 to comply (June 3, 2026); larger entities had 18 months (December 3, 2025). Unless the SEC changes them, both dates have passed. The notice contents, the exception for incidents unlikely to cause harm, and the records to keep are in the Regulation S-P guide.

Most of the program runs on two clocks. One is the fiscal year: the Form ADV amendment, the brochure delivery and the quarterly code of ethics reports all count from a date you can put in a diary. The other is events: a new hire, a change to Form CRS, a data incident. The first table assumes a December 31 fiscal year end. A date marked Derived is our arithmetic from the rule's words, not a date the rule prints.

The rule texts read for this page do not say what happens when a deadline falls on a weekend or holiday, so plan to file before it. A rule that gives a period but no date, like the annual review, needs a date you set and write into your policies. If your year ends on another date, the planners linked in the map above redo the arithmetic from your own year end.

A program is judged on its records. When the SEC's staff asks to see how a duty was met, the answer is a document the books-and-records rule already told you to keep, and for records kept electronically the rule asks the adviser to “provide promptly” a “legible, true, and complete copy of the record in the medium and format in which it is stored”. The table pairs each duty on this page with the record that proves it ran.

Two habits make that file easy to produce. Keep each record where the policy says it lives, and date every review, approval and acknowledgment when it happens rather than when someone asks. The books and records checklist lists the records for your firm, and Rule 17a-4 and WORM storage sets out the electronic storage conditions that apply to a firm that is also a broker-dealer.

The rules ask for outcomes, not products. A two-person firm can run the whole program from a written manual, a calendar and a shared folder, as long as each record lands where the policy says it does. Software earns its place when the attestations, the personal trading reports and the advertising reviews outgrow a folder. Outside help earns its place when nobody inside has the time or the background to run the annual review well.

• A system that holds the calendar, the attestations and the review evidenceBest RIA compliance software
• Someone to write the manual, run the annual review or act as outsourced CCOBest RIA compliance consultants
• The whole stack, from CRM to archive, read against the record rulesBest software for financial advisors
• One printable list of the program for your firm typeRIA and FINRA compliance checklist

This guide explains the SEC rules as written; it is not legal advice. Before you rely on a date or a policy, check it with your compliance counsel against the rule text on eCFR's Rule 206(4)-7 page and the Rule 204-2 page.