RIA and FINRA compliance checklist
The RIA compliance requirements and the FINRA compliance requirements a small firm runs on, in one place: an RIA compliance checklist for SEC-registered advisers, a FINRA compliance checklist for broker-dealers, and both for a dual registrant. Filter by ongoing, quarterly or annual, tick each duty as it is met and put a name against it. Every item cites the rule that names it, and the count shows how far the firm has got. Print it for the compliance file or copy it into your own tracker.
Compliance checklist: the tool
Compliance checklistadviserdeck.com
Pre-filled with an example: a small SEC-registered adviser with its program, CCO and code of ethics in place. Pick your firm type, tick what is done and name an owner; your ticks stay in this browser until you press Reset.
Progress
3 of 23 done
- Ongoing3 of 18
- Quarterly0 of 1
- Annual0 of 4
The checklist
Tick an item once the firm meets it. The rule paragraph sits under each one.
Ongoing
3 of 18 doneIn place at all times, or due when the event happens.
17 CFR 275.206(4)-7(a)
Read: RIA compliance manual template, Rule 206(4)-7: the compliance program rule
Owner: ________________
17 CFR 275.206(4)-7(c)
Read: Outsourced CCO: when a small RIA should hire one, Best RIA compliance consultants for small advisers
Owner: ________________
17 CFR 275.204A-1(a)(1)-(5)
Owner: ________________
When: No later than 10 days after the person becomes an access person, current as of a date no more than 45 days before that day
A firm whose only access person is its owner need not report to itself if it keeps records of all holdings and transactions (204A-1(d)).
17 CFR 275.204A-1(b)(1)(ii)(A)
Owner: ________________
17 CFR 275.204A-1(a)(3)
Owner: ________________
When: Before the access person acquires the security
17 CFR 275.204A-1(c); 275.204-2(a)(13)(iii)
Owner: ________________
Owner: ________________
17 CFR 275.204-2(e)(1)
Read: Books and records retention calculator, Books and records checklist generator
Owner: ________________
Rule 204-2(g) does not require WORM storage or a third-party undertaking; those are broker-dealer conditions under Rule 17a-4(f).
17 CFR 275.204-2(g)(1)-(3)
Owner: ________________
17 CFR 275.206(4)-1(a); 275.204-2(a)(11)
Read: Marketing Rule ad review checklist, The SEC Marketing Rule for small advisers, Best advertising review software for advisers
Owner: ________________
Unpaid testimonials and endorsements, and those paid only de minimis compensation, skip the written-agreement and disqualification conditions.
17 CFR 275.206(4)-1(b)(1)-(4)
Owner: ________________
When: Brochure before or at the time of the advisory contract; supplement before or when that person begins to advise the client
17 CFR 275.204-3(b)(1), (b)(3)
Owner: ________________
Owner: ________________
When: Before or at the time of the advisory contract with that retail investor
A firm with no retail investors to whom it must deliver one is not required to prepare or file a relationship summary.
17 CFR 275.204-5(b)(1), (b)(3)
Read: Form CRS builder
Owner: ________________
When: File within 30 days; communicate within 60 days after the update is required
A current Form CRS goes to any retail investor who asks, within 30 days of the request (204-5(b)(5); 17a-14(c)(5)).
Form CRS General Instruction 8; 17 CFR 275.204-5(b)(4); 240.17a-14(c)(4)
Read: Form CRS builder
Owner: ________________
17 CFR 248.30(a)(1), (b)(2)
Owner: ________________
When: Notice as soon as practicable, but not later than 30 days after becoming aware of the access
No notice is required where a reasonable investigation finds the sensitive information has not been, and is not reasonably likely to be, used to cause substantial harm or inconvenience.
17 CFR 248.30(a)(3), (a)(4)
Owner: ________________
When: Service provider's notice as soon as possible, but no later than 72 hours after it becomes aware
17 CFR 248.30(a)(5)
Owner: ________________
Quarterly
0 of 1 doneDue after each calendar quarter.
When: No later than 30 days after the end of each calendar quarter
Not needed where it would duplicate broker confirmations or statements the firm holds, received no later than 30 days after quarter end (204A-1(b)(3)(iii)).
17 CFR 275.204A-1(b)(2)(ii)
Owner: CCO
Annual
0 of 4 doneDue once a year, or on the cycle the rule sets.
When: No less frequently than annually
17 CFR 275.206(4)-7(b); 275.204-2(a)(17)(ii)
Read: RIA annual compliance review planner, Best RIA compliance software for small firms
Owner: CCO
When: Within 90 days of the end of the fiscal year
17 CFR 275.204-1(a)(1)(i), (b)(1)
Read: Form ADV annual amendment date planner, What is Form ADV?
Owner: CCO
When: Within 120 days after the end of the fiscal year
17 CFR 275.204-3(b)(2)
Owner: CCO
When: At least once each 12-month period on a date the firm selects, current as of a date no more than 45 days before submission
17 CFR 275.204A-1(b)(1)(ii)(B)
Owner: ________________
Deadlines the rules stateCard 01
- Form ADV annual updating amendment, after fiscal year end90 days17 CFR 275.204-1(a)(1)(i)
- Brochure or summary of material changes to clients, after fiscal year end120 days17 CFR 275.204-3(b)(2)
- Access-person transaction report, after each calendar quarter30 days17 CFR 275.204A-1(b)(2)(ii)
- Initial holdings report, after becoming an access person10 days17 CFR 275.204A-1(b)(1)(ii)(A)
- Form CRS update, after information becomes materially inaccurate30 daysForm CRS General Instruction 8.A
- Regulation S-P notice to affected individuals, at the latest30 days17 CFR 248.30(a)(4)(iii)
- FINRA reportable events, at the latest30 daysFINRA Rule 4530(a)
- FINRA complaint statistics, day of the month after each quarter15thFINRA Rule 4530(d)
- Adviser review of policies and proceduresAnnual17 CFR 275.206(4)-7(b)
- FINRA review of the businesses, calendar yearAnnualFINRA Rule 3110(c)(1)
What it computes
One list of the duties the rules name for your firm type, sorted by when they come round, with a running count of how many are done. Every item is a duty the rule text states, with the paragraph to cite beneath it. A “When” line appears only where the rule itself sets the timing; where a rule says “periodically” or names no date, the checklist names none either.
- SEC-registered investment adviser23 items
- Small broker-dealer (FINRA member)31 items
- Dual registrant (adviser and broker-dealer)51 items
An SEC-registered adviser gets the Advisers Act duties: the compliance program under Rule 206(4)-7, the code of ethics, Rule 204-2 records, the Marketing Rule, Form ADV and the brochure. A small broker-dealer gets FINRA’s supervision, communications, reporting, AML and continuity rules plus the Exchange Act record rules. Both get Form CRS and Regulation S-P. The two guides behind the lists are RIA compliance for a small adviser and FINRA compliance for small broker-dealers.
A dual registrant gets both lists in full, 51 items, because the two rulebooks never merge. One record can still serve both: Rule 204-2(h)(1) treats a record kept under Rules 17a-3 and 17a-4 that is “substantially the same” as the adviser record as kept in compliance with 204-2. Which records qualify is a question for your compliance counsel. To list the records your firm must make in the first place, pair this page with the books and records checklist generator.
Worked example
Take the tool’s own default: a small SEC-registered adviser that has adopted its written policies, named its chief compliance officer and collected code-of-ethics acknowledgments. That is three of the adviser list’s ongoing items, so the count reads 3 of 23 done. Now say the firm also runs a broker-dealer. Switch the firm type to dual registrant and the three ticks carry over while the list grows to 51: the count reads 3 of 51 done, and the Annual and Quarterly views show what the calendar holds.
With a December 31 fiscal year end, the dated items for the first half of 2027 fall as below. The dates are counted from the rule’s own words; the Form ADV annual amendment planner and the code of ethics reporting calendar work them out for any year end.
A dual registrant's dated items, December 31 year end
| Item | The rule says | Firm type | Due, by our reading |
|---|---|---|---|
| Access-person transaction reports, Q4 2026 (204A-1(b)(2)(ii)) | 30 days after the quarter ends | Adviser | Jan 30, 2027 |
| Complaint statistics to FINRA, Q4 2026 (4530(d)) | 15th day of the following month | Broker-dealer | Jan 15, 2027 |
| Form ADV annual updating amendment (204-1(a)(1)(i)) | Within 90 days of fiscal year end | Adviser | Mar 31, 2027 |
| Complaint statistics to FINRA, Q1 2027 (4530(d)) | 15th day of the following month | Broker-dealer | Apr 15, 2027 |
| Brochure or summary of material changes (204-3(b)(2)) | Within 120 days of fiscal year end | Adviser | Apr 30, 2027 |
| Access-person transaction reports, Q1 2027 (204A-1(b)(2)(ii)) | 30 days after the quarter ends | Adviser | Apr 30, 2027 |
| Review of the businesses (3110(c)(1)) | At least annually, calendar-year basis | Broker-dealer | In calendar 2027 |
| AML independent test (3310(c)) | Annual, calendar-year basis | Broker-dealer | In calendar 2027 |
17 CFR 275.204-1(a), 275.204-3(b)(2), 275.204A-1(b)(2)(ii); FINRA Rules 3110(c)(1), 3310(c), 4530(d)
One of those dates lands on a weekend: January 30, 2027 is a Saturday, and the rules read here do not say whether a due date moves off a weekend or a holiday. Plan to the business day before and confirm the practice with your compliance counsel. The two calendar-year items have no fixed day at all; the rule asks only that each falls within the year.
The rule text
Three sentences set the rhythm of the whole checklist. The first two are the adviser’s yearly fixtures; the third is FINRA’s.
Read the first and the third side by side. The adviser’s review runs “no less frequently than annually” and its records go in the file under Rule 204-2(a)(17)(ii); the rule’s text does not itself demand a written report, though the records of the review must exist. FINRA’s review is tied to the calendar year. The annual compliance review planner turns the adviser’s review into areas, owners and dates, and the guide to Rule 206(4)-7 covers what the review should test. None of this is legal advice; check how a duty applies to your firm with your compliance counsel.
Where the rule says so
Each rule the checklist draws on, what it covers here and how many items cite it (an item that cites two rules counts under both). The links go to the rule text: the eCFR for SEC rules and FINRA’s rulebook for FINRA rules. The Form ADV and Form CRS instructions are on sec.gov as Form ADV General Instructions and the Form CRS instructions.
The rules behind the items
| Rule | Covers | Items |
|---|---|---|
| Rule 206(4)-7 | Compliance program, CCO, annual review | 0 |
| Rule 204A-1 | Code of ethics and access-person reports | 6 |
| Rule 204-2 | Adviser books and records | 6 |
| Rule 206(4)-1 | Marketing Rule | 0 |
| Rules 204-1 and 204-3 | Form ADV amendments, brochure delivery | 4 |
| Rule 204-5 and Rule 17a-14 | Form CRS delivery and updates | 4 |
| Regulation S-P, Rule 248.30 | Safeguards, incident response, service providers | 3 |
| Rules 17a-3 and 17a-4 | Broker-dealer records, storage, production | 4 |
| Rule 15l-1 (Regulation Best Interest) | Retail recommendations | 1 |
| FINRA Rule 3110 | Supervision, reviews, inspections | 10 |
| FINRA Rules 3120 and 3130 | Supervisory controls, CCO, CEO certification | 3 |
| FINRA Rule 2210 | Communications with the public | 2 |
| FINRA Rules 2111, 4511 and 4512 | Suitability, records, account records | 3 |
| FINRA Rule 4530 | Reporting events and complaints | 2 |
| FINRA Rule 3310 | Anti-money laundering program | 3 |
| FINRA Rule 4370 | Business continuity | 2 |
Rule text read October 22, 2026: eCFR (up to date as of October 20, 2026) and FINRA's rulebook
When it is time to choose software for these duties, the comparisons read vendors against the same rules: the RIA compliance software comparison for the adviser side and the broker-dealer compliance software comparison for FINRA members. The complaint items connect to FINRA Rule 4530 reporting, where the quarterly statistics and the 30-day events are covered in full.