Best RIA compliance consultants for small advisers
Six outsourced compliance firms read against the work the Advisers Act rules put on an adviser: the annual program review, policies, the chief compliance officer, Form ADV, the code of ethics and marketing review. Each cell says what the firm's own pages state, including whether it works with state-registered advisers. No fees are shown; ask each firm to quote against the same scope, which the builder below writes.
Reviewed October 2026
Best overall for an SEC-registered RIA
Joot
Its own pages name every service in the table for an SEC adviser: a named CCO, a written summary of the annual 206(4)-7 and code of ethics review, a mock SEC exam and Form ADV filings.
Read the review of JootBest for a state-registered RIA
Quadrant Regulatory Group
It names both SEC and state-registered advisers, runs Rule 206(4)-7 annual reviews and mock audits, and its team includes former SEC and FINRA regulators.
Read the review of Quadrant Regulatory GroupBest for a firm that needs a named CCO
Core Compliance
Its Outsourced CCO package says it will serve as your designated chief compliance officer and take on the role's duties, with a Deputy CCO package beside it.
Read the review of Core Compliance
The comparison table
| Vendor | Outsourced CCO206(4)-7(c) | Annual program review206(4)-7(b) | Policies and procedures drafting206(4)-7(a) | Form ADV filing204-1(a) | Code-of-ethics administration204A-1 | Marketing review206(4)-1 | Mock exams | Serves SEC and state RIAs203A-1 | Former regulators on the team |
|---|---|---|---|---|---|---|---|---|---|
JootRIA compliance services | Meets CCO Services: a named CCO | Meets Summary of annual 206(4)-7 review | Meets Compliance manual drafted, updated | Meets Form ADV filed and amended | Meets Holdings reports, trading certifications | Meets Advertising, website, social media | Meets Mock SEC exam service | Partial SEC-registered advisers only named | Partial Former CCOs; former regulators not stated |
Quadrant Regulatory GroupRIA and BD consultants | Not stated Not named on the pages read | Meets Rule 206(4)-7 annual reviews | Meets Written policies, procedures, manual | Meets Parts 1, 2A, 2B prepared, amended | Partial Creates the code; reporting not stated | Meets Reviews marketing materials | Meets IA mock audits | Meets SEC and state advisers named | Meets Former SEC and FINRA regulators |
Core ComplianceOutsourced compliance firm | Meets Outsourced CCO and Deputy CCO | Meets Annual compliance program reviews | Meets Tailored to Rule 206(4)-7 | Meets Parts 1, 2A, 2B filed on IARD | Partial Drafts the code; sets up reporting software | Meets Advertising and marketing reviews | Partial Exam preparation; mock exam not named | Meets SEC; state-to-SEC moves named | Partial “In-house and regulatory experience” |
ACA GroupGlobal compliance consultancy | Meets Outsourced chief compliance officer | Partial Program reviews; “annual” not named | Meets Manuals, policies, procedures | Meets Form ADV among regulatory filings | Meets Code of ethics and trading support | Partial Review software; social media review | Meets Mock regulatory exams | Partial Advisers named; SEC or state not stated | Meets Founded “by five former regulators” |
ComplySoftware and consulting | Not stated Not named on the pages read | Meets Annual compliance review | Meets Compliance manuals created, amended | Meets Annual and ongoing ADV updates | Meets Initial, quarterly, annual reporting | Meets Marketing material reviews | Meets Mock SEC exams | Meets State-to-SEC moves; state rules named | Meets Former regulators and CCOs |
InnRegFintech compliance consultants | Meets Outsourced CCO service | Not stated Not stated on the RIA page | Meets Tailored policies and procedures | Meets Form ADV incl. Parts 2 and 3 | Not stated Not stated on the RIA page | Partial “Advertising” listed as a function | Partial Exam preparation; mock exam not named | Meets SEC and state requirements named | Partial 30+ experts; former regulators not stated |
What the rules ask, service by service
A compliance consultant sells hours, but the hours are spent on duties the Advisers Act rules put on the firm. Six of the services in the table below map to a rule; the mock exam is the one no rule asks for. Read it before a first call, so the scope in the engagement letter follows the rule rather than the consultant's package names.
The rule behind each service
| Service | What the rule asks | Rule |
|---|---|---|
| Policies and procedures | “Adopt and implement written policies and procedures reasonably designed to prevent violation” | 206(4)-7(a) |
| Annual program review | Review them “no less frequently than annually”, both their adequacy and “the effectiveness of their implementation” | 206(4)-7(b) |
| Chief compliance officer | “Designate an individual (who is a supervised person)” to administer them | 206(4)-7(c) |
| Form ADV | Amend Parts 1 and 2 “At least annually, within 90 days of the end of your fiscal year” | 204-1(a) |
| Code of ethics | Access persons report holdings and quarterly transactions; the adviser reviews them | 204A-1(a)-(b) |
| Marketing review | Every advertisement is held to the rule's seven general prohibitions, and a copy is kept | 206(4)-1(a); 204-2(a)(11) |
| Mock exam | No rule requires one; it tests the program before an examiner does | None |
17 CFR 275.206(4)-7, 204-1, 204A-1, 206(4)-1, 204-2
Three of those duties sit in one short rule, which is why the Rule 206(4)-7 compliance program guide is the best single read before hiring help. The records follow the work: the books and records rule keeps the policies in effect “at any time within the past five years” and “Any records documenting the investment adviser's annual review”. A consultant who runs the review should hand those records back to you.
The Marketing Rule column matters more than its size suggests. An advertisement includes “Any direct or indirect communication an investment adviser makes to more than one person” that offers its advisory services, so a website page or a newsletter can count. The Marketing Rule ad review checklist shows what a reviewer checks.
An outsourced CCO: what stays with your firm
Four of the six firms offer an outsourced CCO by name: Joot, Core Compliance, ACA Group and InnReg. Quadrant and Comply do not name one on the pages we read. The rule's only words about who may hold the role are these:
Outsourcing moves the work, not the duty. The rule makes the three duties a condition of giving advice at all: without them, “it shall be unlawful … for you to provide investment advice to clients”. So the engagement letter should say who the named person is, how often they are on site or on call, who signs the annual review records, and what happens when the consultant leaves. When an outsourced CCO makes sense for a small firm, and when a part-time employee does, is covered in when a small RIA should hire an outsourced CCO.
The work a consultant carries through the year
Most of a consultant's retainer is a calendar. For an SEC-registered adviser with a December 31 fiscal year end, the rule periods land on these dates by our reading (each rule states a period, and the dates are the arithmetic):
A December year end, by our reading of the rules
| What is due | When | Rule |
|---|---|---|
| Form ADV annual updating amendment | By March 31 (March 30 in a leap year) | 204-1(a) |
| Brochure or summary of material changes, if any | By April 30 (April 29 in a leap year) | 204-3(b)(2) |
| Access persons' quarterly transaction reports | April 30, July 30, October 30, January 30 | 204A-1(b)(2)(ii) |
| Access persons' annual holdings reports | Once each 12-month period, on a date you select | 204A-1(b)(1)(ii)(B) |
| Annual review of policies and procedures | No less frequently than annually | 206(4)-7(b) |
17 CFR 275.204-1(a), 204-3(b)(2), 204A-1(b), 206(4)-7(b)
A sole adviser with no other access persons has less to collect: the code of ethics rule says “If you have only one access person (i.e., yourself), you are not required to submit reports to yourself”, as long as the holdings and transaction records are kept. Plan your own year with the Form ADV annual amendment date planner, the code of ethics reporting calendar and the annual compliance review planner, then compare that list with what each consultant's package covers.
SEC or state registration changes the shortlist
Whether an adviser is registered with the SEC or with its state decides which rules a consultant works to, and not every consultant takes state-registered firms. The line between the two is set by assets under management.
Form ADV's instructions put the other side plainly: “you must apply for registration with the SEC if your regulatory assets under management are $110 million or more”. A state-registered adviser that crosses that line on its annual amendment “must apply for registration with the SEC within 90 days after you file that annual updating amendment.”
The compliance program, code of ethics and Marketing Rule columns in the table are SEC rules. A state-registered adviser follows its own state's rules instead, which this page does not cover, so the “Serves SEC and state RIAs” column is the first one to read. Quadrant, Core Compliance, Comply and InnReg name state advisers or state-to-SEC moves on their own pages; Joot names SEC-registered advisers, and ACA Group does not say. A firm still deciding how to register can start with how to start an RIA and what Form ADV is and who files it.
Build the scope before the first call
Consultants quote by package, and package names differ from firm to firm. Sending the same scope to every firm on your shortlist makes the answers comparable. Pick your firm type and the services you need; each line carries the rule it comes from, and the list underneath shows which of the six name all of them on their own pages. This is a starting scope, not legal advice; check the final engagement letter with your compliance counsel.
We are an SEC-registered investment adviser.
- 01Name the individual who will serve as our chief compliance officer, and how they will be a supervised person of our firm. (Rule 206(4)-7(c))
- 02Run the annual review of our policies and procedures and of their implementation, and leave us the records that document it. (Rules 206(4)-7(b), 204-2(a)(17)(ii))
- 03Prepare and file our annual updating amendment within 90 days of our fiscal year end, and other amendments when needed. (Rule 204-1(a))
- 04Collect and review access persons' holdings and quarterly transaction reports under our code of ethics. (Rule 204A-1)
Firms whose own pages name every service you picked
MeetsJoot
Read from their pages on October 22, 2026
If a consultant's reply is mostly software, compare it with the RIA compliance software comparison: some firms run the annual review themselves on a platform and buy only a mock exam. A firm with a broker-dealer affiliate should also read FINRA compliance consultants for small broker-dealers, and the full RIA and BD compliance consultants directory lists the other firms we have read.
Each consultant, read against the rules
Joot
RIA compliance services- What it is
- A compliance service offering “expert consulting services and easy-to-use technology for SEC registered investment advisers, private funds and registered funds”. Its services page sets out Standard and Full packages (Form ADV filings, a procedures manual kept current, advertising review, annual holdings reports, a “Summary of Annual 206(4)-7 and Code of Ethics Review”), CCO Services for firms that need “a named Chief Compliance Officer”, and a Mock SEC Exam service.
- Who it fits
- A small SEC-registered adviser that wants one firm to carry the whole compliance year. Its team pages list people who have served as chief compliance officer for SEC-registered advisers and registered funds. State registration is not mentioned on the pages we read.
- What the rule requires, and whether it meets it
- Outsourced CCOMeetsCCO Services: a named CCO
- Annual program reviewMeetsSummary of annual 206(4)-7 review
- Policies and procedures draftingMeetsCompliance manual drafted, updated
- Form ADV filingMeetsForm ADV filed and amended
- Code-of-ethics administrationMeetsHoldings reports, trading certifications
- Marketing reviewMeetsAdvertising, website, social media
- Mock examsMeetsMock SEC exam service
- Serves SEC and state RIAsPartialSEC-registered advisers only named
- Former regulators on the teamPartialFormer CCOs; former regulators not stated
- Not verified by us
- Which package includes the annual 206(4)-7 review summary (the package table marks it per tier), the engagement letter naming who your CCO will be, and whether it takes state-registered advisers.
Quadrant Regulatory Group
RIA and BD consultants- What it is
- A New York consultancy for broker-dealers and advisers. Its adviser page lists Form ADV maintenance, “Written Compliance Policies, Procedures and Manual”, “Creation and maintenance of IA Code of Ethics”, “Rule 206(4)-7 Annual Compliance Reviews”, “IA Mock Audits” and the review of marketing materials, on an hourly, project or ongoing basis.
- Who it fits
- A state-registered adviser, or one moving between state and SEC registration: the page says it supports “SEC and state Registered Investment Advisers”. It works with firms “with only one compliance officer”. An outsourced CCO is not offered by name on the pages we read.
- What the rule requires, and whether it meets it
- Outsourced CCONot statedNot named on the pages read
- Annual program reviewMeetsRule 206(4)-7 annual reviews
- Policies and procedures draftingMeetsWritten policies, procedures, manual
- Form ADV filingMeetsParts 1, 2A, 2B prepared, amended
- Code-of-ethics administrationPartialCreates the code; reporting not stated
- Marketing reviewMeetsReviews marketing materials
- Mock examsMeetsIA mock audits
- Serves SEC and state RIAsMeetsSEC and state advisers named
- Former regulators on the teamMeetsFormer SEC and FINRA regulators
- Not verified by us
- Whether it will act as your named CCO, and whether code-of-ethics administration (collecting and reviewing access persons' reports) is part of ongoing support or only drafting the code.
Core Compliance
Outsourced compliance firm- What it is
- A San Diego compliance firm with offices in Cedar Rapids and Detroit. Its Outsourced CCO package is “our most involved”: “as your trusted, designated Chief Compliance Officer, we will take on the full responsibility of performing all duties of the role”, including compliance manual updates, annual reviews and regulatory exam management. Its registration page drafts policies “tailored to comply with Rule 206(4)-7” and files Form ADV Parts 2A and 2B on IARD.
- Who it fits
- A firm with an empty CCO seat, or a newly registered one: the page names firms “newly registered, a firm in transition, or an established firm with a newly or soon-to-be vacant CCO seat”. It also serves firms “changing from state to federal registration”.
- What the rule requires, and whether it meets it
- Outsourced CCOMeetsOutsourced CCO and Deputy CCO
- Annual program reviewMeetsAnnual compliance program reviews
- Policies and procedures draftingMeetsTailored to Rule 206(4)-7
- Form ADV filingMeetsParts 1, 2A, 2B filed on IARD
- Code-of-ethics administrationPartialDrafts the code; sets up reporting software
- Marketing reviewMeetsAdvertising and marketing reviews
- Mock examsPartialExam preparation; mock exam not named
- Serves SEC and state RIAsMeetsSEC; state-to-SEC moves named
- Former regulators on the teamPartial“In-house and regulatory experience”
- Not verified by us
- Whether the code-of-ethics work covers reviewing access persons' reports or only setting up the reporting software, and what its mock-exam work (“Regulatory Examination Preparation”) includes.
ACA Group
Global compliance consultancy- What it is
- A global governance, risk and compliance firm (consulting, managed services and software) “founded in 2002 by five former regulators”. Its compliance advisory page lists an outsourced chief compliance officer (OCCO), compliance manuals and policies, “Compliance program and thematic reviews, mock exams, gap analysis” and regulatory filings; its home page names Form ADV among them. Hardin Compliance and Cipperman web addresses now lead to ACA.
- Who it fits
- A larger adviser, or one that also runs a broker-dealer or private funds, that wants consulting, managed services and software from one firm. Its home page says it serves asset managers “of all types and sizes”; it does not say whether that includes state-registered advisers.
- What the rule requires, and whether it meets it
- Outsourced CCOMeetsOutsourced chief compliance officer
- Annual program reviewPartialProgram reviews; “annual” not named
- Policies and procedures draftingMeetsManuals, policies, procedures
- Form ADV filingMeetsForm ADV among regulatory filings
- Code-of-ethics administrationMeetsCode of ethics and trading support
- Marketing reviewPartialReview software; social media review
- Mock examsMeetsMock regulatory exams
- Serves SEC and state RIAsPartialAdvisers named; SEC or state not stated
- Former regulators on the teamMeetsFounded “by five former regulators”
- Not verified by us
- Whether its program reviews are scoped as the annual 206(4)-7(b) review and deliver the records that review needs, and whether marketing review is a service or only its review software.
Comply
Software and consulting- What it is
- The consulting and managed-services arm of Comply, the firm behind Comply for RIA (formerly RIA in a Box) and Comply Platform. Its pages list Form ADV “annual and ongoing updates”, compliance manuals, “Mock SEC Exams”, an “Annual Compliance Review”, marketing material reviews and Code of Ethics administration covering “Initial, quarterly, and annual reporting”.
- Who it fits
- A firm already on Comply's software, or one moving from state to SEC registration: its contact form offers a “State to Sec Transition”, and its services page cites “SEC, FINRA, and state regulations”. An outsourced CCO is not offered by name on the pages we read.
- What the rule requires, and whether it meets it
- Outsourced CCONot statedNot named on the pages read
- Annual program reviewMeetsAnnual compliance review
- Policies and procedures draftingMeetsCompliance manuals created, amended
- Form ADV filingMeetsAnnual and ongoing ADV updates
- Code-of-ethics administrationMeetsInitial, quarterly, annual reporting
- Marketing reviewMeetsMarketing material reviews
- Mock examsMeetsMock SEC exams
- Serves SEC and state RIAsMeetsState-to-SEC moves; state rules named
- Former regulators on the teamMeetsFormer regulators and CCOs
- Not verified by us
- Whether it will act as your named CCO, and whether the consulting services are sold apart from its software or only with it.
InnReg
Fintech compliance consultants- What it is
- A compliance consulting and outsourcing team “serving financial services companies since 2013”, aimed at fintech firms. Its RIA page covers registration (“preparing Form ADV filings, including Part 2 (Brochures) and Part 3 (Form CRS)”), “tailored policies and procedures”, day-to-day compliance operations and an outsourced CCO service.
- Who it fits
- A technology-led adviser (a digital or robo-advisory platform) that wants help from registration through daily operations. It names “SEC and state requirements”. The annual review and code-of-ethics work are not named on its RIA page.
- What the rule requires, and whether it meets it
- Outsourced CCOMeetsOutsourced CCO service
- Annual program reviewNot statedNot stated on the RIA page
- Policies and procedures draftingMeetsTailored policies and procedures
- Form ADV filingMeetsForm ADV incl. Parts 2 and 3
- Code-of-ethics administrationNot statedNot stated on the RIA page
- Marketing reviewPartial“Advertising” listed as a function
- Mock examsPartialExam preparation; mock exam not named
- Serves SEC and state RIAsMeetsSEC and state requirements named
- Former regulators on the teamPartial30+ experts; former regulators not stated
- Not verified by us
- Whether ongoing support includes the annual 206(4)-7(b) review and code-of-ethics reporting, and which regulatory roles its consultants have held (its page says “30+ experts”).
How we read these vendors
Questions firms ask
Can an RIA outsource its chief compliance officer?
The rule asks the adviser to “Designate an individual (who is a supervised person) responsible for administering the policies and procedures”. It names a person and a relationship, not an employment contract, which is why consultants sell outsourced CCO services. Ask the consultant how the person named as your CCO becomes one of your supervised persons, and check the arrangement with your compliance counsel.
The duties stay with the firm. Without the three compliance-program duties, the rule says it is unlawful “for you to provide investment advice to clients”.
17 CFR 275.206(4)-7(c)
Does the annual review have to be written up as a report?
The rule text asks the adviser to review, “no less frequently than annually, the adequacy of the policies and procedures” and “the effectiveness of their implementation”. It does not ask for a report by name. The books and records rule does require “Any records documenting the investment adviser's annual review”, so whatever a consultant delivers should leave that record behind.
17 CFR 275.206(4)-7(b); 17 CFR 275.204-2(a)(17)(ii)
Is a mock exam required?
No rule cited on this page requires one. A mock exam is a service consultants sell to test a program before the regulator does; the duty in the rule is the annual review of the policies and their implementation. It is most useful before a first exam or after a change of CCO.
17 CFR 275.206(4)-7(b)
Do state-registered advisers follow the same rules?
Not necessarily. The compliance program, code of ethics and Marketing Rule cited here apply to advisers “registered or required to be registered” with the SEC. A state-registered adviser follows its own state's rules, which we did not read for this page; ask a consultant which states it works in. Form ADV is the shared piece: state and SEC advisers alike file the annual updating amendment “within 90 days of the end of your fiscal year”.
17 CFR 275.206(4)-7; 17 CFR 275.204-1(a); Form ADV General Instruction 4
Is there an official list of approved compliance consultants?
No. Neither the SEC nor FINRA approves consultants, and FINRA retired its Compliance Vendor Directory effective March 19, 2024. A consultant's experience is its own claim, which is why each card above names the document to ask for before you sign.
finra.org/industry/cvd