Rule 206(4)-7: the compliance program rule

Rule 206(4)-7 is one sentence with three paragraphs hanging from it. An SEC-registered adviser may not give advice unless it has written policies, reviews them at least once a year, and names one person to run them. The rule lists no topics, no forms and no report. Everything else a small adviser hears about “the compliance program” is either guidance from the SEC's adopting release or practice built on top of those three paragraphs.

Each paragraph leaves a paper trail under the books and records rule, and that trail is what an examiner reads. A firm with good habits and no record of them has, on paper, no program. The wider picture of what a small adviser runs, from Form ADV to the code of ethics, is in RIA compliance: what a small adviser must run.

The rule opens with its own scope: it applies to “an investment adviser registered or required to be registered under section 203” of the Advisers Act, which is to say an SEC-registered adviser. For such a firm, falling short of any of the three duties makes it “unlawful within the meaning of section 206 of the Act … for you to provide investment advice to clients”. The adopting release adds that “failure to comply with its terms will result in a violation of section 206(4) of the Act.”

A state-registered adviser answers to its own state's rules, which this guide does not cover; ask your state securities regulator or your counsel what your state requires. By our reading of the scope words, a new SEC registrant needs the policies and a named CCO from its first day as one, which is why starting an RIA puts the policies and the CCO ahead of the first client.

A firm that is also a broker-dealer keeps one set of policies if it wishes. The release says advisers “who are also registered as broker-dealers are not required to segregate their investment adviser compliance policies and procedures from their broker-dealer compliance policies and procedures.” The broker-dealer side still runs under FINRA's rules, starting with Rule 3110 supervision.

Card 02

Two verbs, two tests. Adopting means the policies exist in writing. Implementing means the firm does what they say, and the annual review later asks both questions. “Reasonably designed” is the standard, which is why the SEC declined to write a small-firm exemption: commenters asked for one, and the release answered that “the flexibility of the rules obviates the need for this exception.”

The release also gives the order of work. Each adviser “should first identify conflicts and other compliance factors creating risk exposure for the firm and its clients in light of the firm's particular operations, and then design policies and procedures that address those risks.” Then it lists the issues it expects policies, “at a minimum,” to address “to the extent that they are relevant to that adviser.”

The list is a floor for the firms it fits, not a table of contents every firm must copy. The release expects “smaller advisory firms without conflicting business interests to require much simpler policies and procedures than larger firms”, and adds that “even small advisers may have arrangements, such as soft dollar agreements, that create conflicts.” A firm that never places trades has little to say about block allocation; a firm whose advisers text clients has a great deal to say about records, which is where off-channel communications come in.

The full release, Compliance Programs of Investment Companies and Investment Advisers, is on the Federal Register, and the current rule text is on eCFR.

The release expected small firms to buy or borrow a model and adapt it, noting that small firms “typically engage in a limited number and range of transactions and have one or two employees” and would turn to “outlines and model programs that these firms can tailor to fit their own situations.” The tailoring is the work. A purchased manual that describes a trading desk the firm does not have fails the first question of the annual review: does the firm do what its policies say?

In practice the program for a firm of two to ten people is a short inventory of what can go wrong, one policy for each item, a named owner, and the record that proves the policy ran. The example below is an invented four-person adviser that manages accounts with discretion, deducts fees from client accounts, has a website and a LinkedIn page, and whose advisers text clients.

Read across a row and the policy writes itself; read down the last column and you have most of the annual review's evidence list. Our RIA compliance manual template starts from the same firm facts, and the RIA compliance checklist covers the filings and records around the program.

The review asks two separate questions. Adequacy: do the policies still cover the risks the firm has? And effectiveness: did people actually follow them? A firm can pass one and fail the other. Policies that are perfect on paper but were never tested fail the second question; a diligent team working from a manual that misses its new texting habit fails the first.

The release names three things the review “should consider”:

“Annually” is a floor. The release says advisers “should consider the need for interim reviews in response to significant compliance events, changes in business arrangements, and regulatory developments.” A new custodian, a new adviser who texts, or an exam letter are all reasons not to wait for the year's review.

Our annual compliance review planner turns the area list into a dated plan with owners and evidence for your firm. The Form ADV deadline that sits in the first quarter is worked out in the Form ADV amendment planner.

The rule asks for a person, not a department and not a new hire. The release is plain about it: “The rule does not require advisers to hire an additional executive to serve as compliance officer, but rather to designate an individual as the adviser's chief compliance officer.” In a two-person firm the CCO is one of the two, and that is what the rule expects.

What the release does expect is fitness for the job. The CCO “should be competent and knowledgeable regarding the Advisers Act and should be empowered with full responsibility and authority to develop and enforce appropriate policies and procedures for the firm.” It goes on: “the compliance officer should have a position of sufficient seniority and authority within the organization to compel others to adhere to the compliance policies and procedures.” A junior assistant given the title without the authority does not meet that description, whatever the org chart says.

The title alone does not make the CCO everyone's supervisor. The release notes that having the title “does not, in and of itself, carry supervisory responsibilities.” The same release amended Form ADV so that each adviser identifies “a single compliance officer”; how that item reads today is covered in what is Form ADV.

Can the CCO be someone outside the firm?

The rule's one condition is that the person be “a supervised person”. The release quotes the Advisers Act definition: “any partner, officer, director (or other person occupying a similar status or performing similar functions), or employee of an investment adviser, or other person who provides investment advice on behalf of the investment adviser and is subject to the supervision and control of the investment adviser.” How an outside consultant fits that definition is the heart of the outsourced-CCO question, set out in our guide to an outsourced chief compliance officer. Firms that offer the role are compared in RIA compliance consultants. Settle the arrangement with your counsel before you sign it.

The program rule has no record paragraph of its own; the books and records rule carries it. Two items, added by the same 2003 release, are the program's paper trail.

The release adds a practical point for firms that update the manual a section at a time: they “may comply with the recordkeeping requirements by keeping the current policies and procedures and retaining the superseded section(s) for the requisite period of time, so long as the firm can indicate … the version of compliance policies and procedures that were in effect as of a given date.” A version line and an effective date on each section do that job.

Rule 204-2(e)(1) sets that general period, “not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser”, and lists (a)(17)(i) among the records with periods of their own. Our retention calculator runs the dates, and the Rule 204-2 guide covers the rest of the list.

A small adviser can run the program on a binder, a shared drive and a calendar. Software earns its place when the evidence gets scattered: code of ethics reports in one inbox, ad approvals in another, review notes in a third. Outside help earns its place when nobody inside has the time or the knowledge the release expects of a CCO. These four pages pick up where this guide stops.

If the code of ethics reports are the scattered part, those tools are compared in personal trading compliance software. This guide explains the rule. It is not legal advice, and your compliance counsel should check your program against the full rule text.