RIA Compliance Requirements: A Practical Checklist for Investment Advisers

RIA compliance means keeping an advisory firm’s registration, disclosures, business practices, and internal controls aligned with the rules that apply to it. The work includes assigning responsibility, maintaining appropriate policies, supervising activities, preserving records, and checking that the program works in practice.

The exact requirements depend on whether the firm is SEC- or state-registered, where it operates, and what it does for clients. Use this checklist to organize the work and identify the official guidance you need for your firm’s circumstances.

What does RIA compliance involve?

A useful compliance checklist connects each area of responsibility to a practical action and a source for checking the requirements. The areas below are a starting point; individual obligations depend on the firm’s registration and activities.

To make the checklist usable, add three fields to each task: who owns it, what evidence shows it was completed, and when it needs attention again. These are organizational practices, not a substitute for determining the underlying requirements.

Which rules apply to your advisory firm?

Start by separating three questions:

• How is the firm registered? SEC and state registration are different regulatory pathways. Regulatory assets under management are part of the eligibility analysis, but exceptions and the firm’s circumstances also matter.
• What do the individuals need? The advisory firm and its investment adviser representatives, or IARs, have distinct registration and qualification considerations. A solo practice may need to address both.
• Where does the firm operate? An SEC-registered adviser can still have state notice-filing and individual-registration obligations. Serving clients in another state can introduce additional questions.

Use NASAA’s registration FAQs to understand the framework, then confirm the details with the relevant regulator. Check the current eligibility rules and exceptions rather than relying on a single asset threshold or another firm’s registration status.

Also identify business features that deserve separate analysis: custody of client assets, discretionary authority, advance fees, private funds, affiliated businesses, and referral arrangements. A checklist designed for a straightforward advisory practice may not address those activities adequately.

Assign responsibility and maintain written policies

For advisers registered or required to register with the SEC, Rule 206(4)-7 requires written compliance policies and procedures and an individual designated to administer them as chief compliance officer, or CCO. The SEC’s compliance-program adopting release explains why the policies should reflect the firm’s actual operations and risks. State-registered advisers should confirm their applicable program and supervision requirements with their state regulator.

For each recurring task, define who performs it, who reviews exceptions, and who has authority to resolve problems. Give the responsible people access to the records, systems, and management decisions they need. A policy that assigns a review to someone who never receives the relevant information will be difficult to carry out.

Employee controls need their own attention. For SEC advisers, the code-of-ethics rule addresses standards of conduct, personal securities reporting by access persons, reporting violations, and acknowledgments of the code. Determine which people and activities fall within those requirements rather than applying the same reporting process to everyone by assumption.

Align client disclosures, fees, and advisory practices

The SEC’s fiduciary-duty interpretation describes an investment adviser’s duties of care and loyalty. A practical way to assess those duties is to compare what clients are told with what happens in their accounts.

For example, review whether:

• The advisory agreement, disclosure brochure, and billing system describe the same fee arrangement.
• Services and monitoring match the agreed scope of the relationship.
• Disclosures explain material conflicts in terms clients can understand.
• Trading, allocation, and broker-selection practices reflect the firm’s responsibilities and disclosures.
• Changes to services, compensation, or affiliations are reflected in the relevant documents and controls.

Form ADV is part of this work, not the whole program. The SEC’s filing guide explains its parts and the difference between filing information and delivering disclosures to clients.

Assess custody separately. Holding or having access to client assets can raise obligations beyond ordinary portfolio management. State-registered advisers should review the custody discussion in NASAA’s investment adviser guide and their own state’s requirements; a third-party custodian does not remove the need to analyze the firm’s authority and arrangements.

Maintain records and protect client information

Preserve the records your activities require

Identify the records generated by advice, trading, agreements, billing, employee oversight, marketing, and regulatory filings. Then establish how required records are captured, retained, protected, and retrieved. Relevant business communications need to be considered across the channels the firm permits people to use.

Do not assume that every record has the same retention period or storage requirements. Consult the applicable recordkeeping rule and state requirements. The SEC’s published rule text for adviser books and records provides a reference for specific record categories; use the current rules when setting the firm’s retention schedule.

Protect information and prepare for disruption

For SEC-registered advisers covered by Regulation S-P, information protection includes applicable safeguards, incident-response, service-provider oversight, and notification requirements. The SEC’s Regulation S-P resources link to the rule and compliance guide. State-registered advisers should identify the federal and state privacy and security obligations that apply to them.

Useful operational checks include reviewing who can access client information, how sensitive files are shared, how access changes when someone leaves, and how staff report a suspected incident. These checks support the program; they are not a complete regulatory checklist.

Include business disruption in the planning. Consider how the firm would communicate with clients, access essential records, and continue critical work if its office, a key person, or an important vendor became unavailable.

Review marketing and public communications

The SEC Marketing Rule guide covers advertisements by advisers registered or required to register with the SEC. It addresses misleading communications and conditions affecting testimonials, endorsements, ratings, and performance presentations. State-registered firms need to check their applicable advertising and solicitation rules.

Build review into the publishing process. Before material goes live, ask whether factual claims can be supported, qualifications and disclosures are appropriate, and the necessary records will be retained. Review the communication as a whole, including headlines, charts, captions, and linked material.

Apply the same care to AI-assisted content. Check the output’s claims and sources, and make sure it describes the firm’s services accurately before using it publicly. An AI tool’s confident wording is not evidence for a claim.

For more detail, see our guides to RIA marketing compliance under the SEC Marketing Rule and using AI in RIA marketing.

Test the program and maintain a compliance calendar

For SEC advisers, Rule 206(4)-7 calls for a review at least annually of the adequacy of policies and procedures and the effectiveness of their implementation. The SEC’s published compliance-rule text states that obligation. Check the corresponding requirements for a state-registered firm.

Testing should look beyond whether a document exists. As practical examples, compare a sample of invoices with the relevant agreements, check whether marketing approvals can be retrieved, or confirm that an employee’s system access was removed after departure. Select tests that address the firm’s risks, record useful findings, assign corrective work, and follow up. These are examples of how to organize a review, not a mandated testing method.

Maintain a calendar that distinguishes:

• Scheduled work: applicable reviews, filings, renewals, training, and disclosure delivery.
• Event-driven work: changes in ownership, personnel, services, locations, or other facts that require action.
• Follow-up work: open findings, client issues, and corrective actions with named owners.

Use current official filing instructions for deadlines. Revisit the calendar when the business changes rather than treating last year’s task list as proof that this year’s work is covered.

RIA compliance FAQs

Does a small RIA need a compliance program?

An SEC adviser’s compliance-program obligations do not disappear because the firm is small. Its procedures can be proportionate to its operations and risks. A state-registered firm must check its own jurisdiction’s requirements; a solo practice should not assume that having no employees removes its obligations.

Can an RIA outsource compliance?

An RIA can engage outside help, including an outsourced CCO where appropriate, but the firm retains responsibility for its compliance program. The SEC’s outsourced CCO risk alert discusses that responsibility. Define the provider’s work, internal responsibilities, access to information, and escalation process. Our guide to choosing a compliance firm offers questions to ask before engaging one.

Does registration mean a regulator has approved the firm’s advice?

No. SEC registration is not government endorsement of an adviser’s abilities, services, or investment recommendations. The Investment Advisers Act’s restrictions on claims of government approval make that distinction explicit. Describe registration accurately without suggesting that it guarantees quality or investment results.

To put the checklist to work, choose one activity—such as billing, marketing review, or onboarding—and trace it from the applicable requirement through the firm’s written procedure to the evidence that the work happened. Use any gaps to set the next concrete task and assign an owner.