SEC compliance is not one rulebook. The rules that apply depend on what the firm is registered as, what it does, who its clients are, which products it offers and where its conflicts of interest sit. A registered investment adviser, a private fund adviser, a broker-dealer and a registered fund each work under a different combination of federal securities laws, SEC rules, FINRA rules and filing duties.
The SEC Division of Examinations published its 2026 Examination Priorities on 17 November 2025. For advisers they centre on fiduciary duty, the effectiveness of compliance programmes including annual reviews, higher-risk products such as private credit and complex funds, and advisers that have never been examined. For broker-dealers they centre on financial responsibility, trading practices and Regulation Best Interest. Across all registrants they cover cybersecurity, operational resilience, Regulation S-P, Regulation S-ID, artificial intelligence and anti-money laundering. Examiners test whether controls match the actual business, not whether a manual exists.
This guide concentrates on SEC-registered investment advisers, private fund advisers and broker-dealers. Buckingham Capital Consulting is a compliance consultancy, not a US law firm; formal opinions on US securities law come from qualified US counsel, with whom the firm works where a matter requires it.
| Firm type or area | Core requirements |
|---|---|
| SEC-registered investment advisers | Rule 206(4)-7 compliance programme and chief compliance officer, fiduciary duty, Form ADV, Marketing Rule, Custody Rule, Code of Ethics, books and records |
| Private fund advisers | Adviser rules plus fund disclosures, valuation, expense allocation, conflicts, custody through audited financial statements, Form PF where thresholds are met |
| Broker-dealers | Exchange Act, net capital and customer protection rules, Regulation Best Interest and Form CRS, books and records, supervision, AML and FINRA rules |
| Registered investment companies | Rule 38a-1 compliance programme, board governance, disclosures, fund rules and oversight of service providers |
| Regulation S-P | Customer information safeguards, written incident response programme, notification within 30 days, service provider oversight |
| Cybersecurity and technology | Governance, access management, incident response, vendor risk, resilience and accurate statements about AI use |
| SEC examinations | Document production, interviews, testing, deficiency letters and evidenced remediation |
| Regulatory filings | Form ADV, Form PF, Form BD, FOCUS reports and other filings by registrant type |
The starting point is the firm's registration status, because it decides which rules apply. The main thresholds for advisers are set in the Investment Advisers Act and the SEC's rules under it.
| Position | Registration |
|---|---|
| Adviser with $110 million or more in regulatory assets under management | Must register with the SEC |
| Adviser with $100 million to $110 million | May register with the SEC |
| Adviser below $100 million | Generally registers with its home state |
| Adviser solely to private funds with less than $150 million in US regulatory assets | Exempt reporting adviser: files parts of Form ADV, no full registration |
| Non-US adviser with no US place of business, fewer than 15 US clients and investors and less than $25 million from them | Foreign private adviser exemption |
| Firm effecting securities transactions for others | Broker-dealer registration on Form BD and FINRA membership |
UK and European managers that raise money from US investors often begin as exempt reporting advisers and register in full as US assets grow. The same firms usually hold an FCA permission at home, covered in the firm's guide to UK investment firm authorisation and its 30 FAQs on the FCA investment services licence. Running the two regimes as one compliance programme, with a local section for each regulator, avoids duplicated policies and conflicting records.
Rule 206(4)-7 requires every SEC-registered adviser to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act, to review them at least annually for adequacy and effectiveness, and to designate a chief compliance officer to administer them. The SEC's 2003 adopting release remains the core reference on what the rule expects.
The rule is risk-based, not a template. A programme should reflect the adviser's actual activities, conflicts, clients, trading, custody arrangements, valuation, marketing and operations. A policy library copied from another firm, without tailoring, leaves gaps between what the firm says it does and what it does, and examiners look for exactly those gaps.
Examiners sample transactions, compare policies with practice, review monitoring evidence and check how issues were remediated. The practical test is whether each material risk links to a control, an owner, a source of evidence and a review cycle.
The annual review is more than updating the date on a manual. The 2026 priorities name annual reviews as part of how examiners assess adviser programmes, so the review itself is evidence. It should consider:
Findings should identify root causes and the control changes made, not only list exceptions. The record should show what was reviewed, what evidence was used, what issues were found and how management responded, so the review can be produced to examiners as it stands.
Advisers owe their clients a federal fiduciary duty made up of a duty of care and a duty of loyalty. Firms identify their conflicts, give full and fair disclosure where disclosure is enough, and eliminate or mitigate conflicts that disclosure alone cannot address consistently with the duty.
In June 2026 the Division of Examinations published a risk alert on advisers' economic conflicts of interest, which signals close attention to financial incentives. The areas to review include:
Disclosure must be specific enough for a client to understand the nature and significance of each conflict. Monitoring should compare the firm's real economic incentives with what Form ADV and client agreements say.
Form ADV is a continuing disclosure, not a one-off filing. Advisers file an annual updating amendment within 90 days of the end of their fiscal year and promptly amend specified items when they become inaccurate. Part 1 covers the business, ownership, assets under management and disciplinary history; Part 2 brochures and supplements give clients the material information about services, fees, conflicts and personnel.
Brochures should be reviewed whenever products, fees, conflicts or key personnel change, not only at the annual amendment. Marketing material and client agreements should say the same thing as Form ADV, because examiners compare filings with internal documents and observed practice. A Form ADV impact check inside the firm's change process, before a new product or fee structure launches, keeps disclosure and practice aligned.
The Marketing Rule, Rule 206(4)-1, governs advertisements, testimonials, endorsements and third-party ratings by registered advisers. It contains a general prohibition on materially misleading statements and detailed conditions for performance presentation, testimonials, endorsements and ratings. The Division of Examinations has issued several risk alerts on its observations under the rule.
The Custody Rule, Rule 206(4)-2, applies where an adviser has custody of client funds or securities as the rule defines it. Custody can arise from authority over client accounts, from related persons or from the fund structure, without the adviser physically holding any assets. Depending on the structure, the rule requires a qualified custodian, account statements sent directly to clients, an annual surprise examination, or audited financial statements for pooled vehicles.
Private fund advisers commonly rely on the audit approach: the fund is audited annually by an independent accountant registered with the PCAOB and the audited statements are distributed to investors within 120 days of the fiscal year end, or 180 days for a fund of funds. The custody conclusion should be documented, and revisited whenever administrators, custodians, account authority or fund structures change.
Rule 204A-1 requires a Code of Ethics setting standards of conduct and requiring access persons to report their personal securities holdings and transactions. It supports the fiduciary duty by managing conflicts between staff activity and client interests.
The SEC adopted amendments to Regulation S-P on 16 May 2024. Larger entities, including advisers with $1.5 billion or more in assets under management, had to comply from 3 December 2025, and smaller entities from 3 June 2026. Both dates have passed, so every covered adviser and broker-dealer should now be operating the amended requirements and able to evidence them.
Privacy and cybersecurity should be governed together rather than through separate policies. Readiness is shown by tested procedures, vendor contracts with notification terms and records of exercises, not by a written programme alone.
In June 2025 the SEC withdrew a group of rule proposals, including the proposed cybersecurity risk management rule for advisers. Cyber risk remains an examination priority under existing duties: Regulation S-P, Regulation S-ID on identity theft, the fiduciary duty, books and records, and supervision. The 2026 priorities highlight ransomware, AI-enabled threats, access controls, incident recovery and oversight of third-party vendors.
Programmes should cover access management, incident response, vendor risk, backups, vulnerability management, phishing and protection of sensitive information, sized to the firm's technology and client exposure. Moving systems to cloud providers does not move regulatory accountability.
Examiners also review artificial intelligence: whether automated advice tools match investor profiles, whether the firm's statements about its AI use are accurate, and how AI is used in fraud detection, AML and trading. FINRA's 2026 Annual Regulatory Oversight Report added generative AI as a new topic for broker-dealers. The firm's guide to AI governance for financial services sets out the inventory, ownership and testing examiners expect to see.
Record-keeping duties differ by registrant. Advisers keep records under Rule 204-2 covering client communications, transactions, marketing, personal trading, policies and filings; broker-dealers keep records under Exchange Act Rules 17a-3 and 17a-4. Retention should follow the applicable rule, not a generic policy.
Electronic communications remain the most frequent record-keeping issue. Business conducted on personal messaging apps or unapproved channels escapes retention and supervision. Firms combine a clear policy, approved tools that capture messages, attestations and monitoring. The aim is that evidence can be found quickly: a process that took place but cannot be shown is, for an examiner, a process that did not take place.
Private fund advisers apply the Advisers Act framework together with fund-specific conflicts: allocation of investment opportunities, fees and expenses, valuation, side letters, co-investment and transactions with affiliates. Governing documents, Form ADV disclosures and operational practice should be reviewed together, because examiners test them against each other.
| Item | Position |
|---|---|
| Who files | SEC-registered advisers with at least $150 million in private fund assets |
| 2024 joint SEC and CFTC amendments | Compliance date further extended to 1 July 2027 (Release IA-6992, 31 August 2026) |
| Further amendments proposed | Release IA-6959, 20 April 2026; comment period closed 23 June 2026 |
Firms should distinguish the adopted but delayed 2024 amendments from the April 2026 proposal, which may change the requirements before 1 July 2027. Data preparation should start well before the first filing under any new form, with clear ownership and validation of data from each administrator and source.
Broker-dealers work under the Securities Exchange Act, SEC rules and FINRA rules rather than the Advisers Act. A broker-dealer programme should be built for the broker-dealer, not adapted from an adviser's manual.
Firms should test whether registered representatives follow the firm's recommendation process, and examine compensation and product incentives that could influence recommendations.
Broker-dealers run AML programmes under the Bank Secrecy Act and FINRA Rule 3310: customer identification, beneficial ownership checks, suspicious activity reporting, independent testing and a named AML officer. Programmes should reflect the firm's customer types, products, funding methods and geographic exposure, with transaction surveillance calibrated to those risks and enhanced review for higher-risk customers. Sanctions screening against OFAC lists sits in onboarding and transaction processing, with trained investigation of potential matches.
For investment advisers, FinCEN's rule bringing registered and exempt reporting advisers within the Bank Secrecy Act was postponed on 31 December 2025 from 1 January 2026 to 1 January 2028, and FinCEN has said it intends to review its scope. Advisers should still screen for sanctions, which apply to all US persons, and many already run AML controls because their custodians and fund administrators require them. The firm's financial crime practice supports AML programme design and independent testing.
An examination begins with a document request and continues with interviews, testing, follow-up questions and, where the staff find issues, a deficiency letter to which the firm responds in writing. The 2026 priorities state that the Division will prioritise advisers that have never been examined, with emphasis on recently registered firms.
A firm with good ongoing compliance can answer accurately without reconstructing years of activity under time pressure. A mock examination or focused readiness review is valuable where the firm has not been examined recently, has grown quickly or has changed its business model. It should test the current priority areas and the firm's own specific risks, and the firm should remediate before the staff arrive.
During an examination, responses should be accurate, complete and coordinated: departments describe processes consistently and documents are version-controlled. Remediation should address root causes and be evidenced, because the next examination will check it.
Firms meet these obligations through one of three models, and many move between them as they grow. The rule is the same in each: the chief compliance officer must be competent, knowledgeable about the Advisers Act and empowered with full responsibility and authority to develop and enforce the programme.
| Model | When it fits |
|---|---|
| In-house CCO with targeted outside support | Established advisers and broker-dealers with a full-time compliance function that need specialist help for annual reviews, mock examinations, Form PF or new products |
| Outsourced CCO | Smaller or newly registered advisers, and non-US managers registering with the SEC, where a full-time hire is not yet proportionate |
| Project support | Registration, remediation after a deficiency letter, a change of business model, or implementation of a new rule such as Regulation S-P |
Where the CCO is outsourced, the SEC expects the firm to show that the person has sufficient knowledge of the business, enough time and seniority to administer the programme, and access to the information needed. Firms should document how the outsourced CCO receives information, attends senior meetings and escalates issues, because examiners ask for that evidence.
The strongest programmes are not the longest manuals. They start from how the firm earns money, where staff or affiliates could benefit at clients' expense, which processes could harm clients and which rules apply. When the firm launches a new fund, product, distribution arrangement, platform or compensation structure, the change process should check Form ADV, marketing, custody, privacy, books and records and other effects before launch.
Senior management should receive concise reporting on risks and remediation. Compliance should challenge decisions where needed while understanding the commercial model well enough to propose controls that work in practice.
The firm's regulatory compliance service supports SEC-regulated businesses with programme design, annual review preparation, policies, conflict mapping, filing governance, marketing controls, examination readiness and cross-border operating models for groups regulated in both the US and the UK.
Typically the Rule 206(4)-7 programme and annual review, Form ADV, Marketing Rule controls, custody analysis, Code of Ethics, books and records, conflicts, Regulation S-P and examination readiness. Private fund advisers add fund conflicts and Form PF.
Yes. Rule 206(4)-7 requires a review at least annually of the adequacy of the policies and the effectiveness of their implementation, and the review should be documented.
Published on 17 November 2025, they cover fiduciary duty, compliance programme effectiveness and never-examined advisers, broker-dealer financial responsibility and Regulation Best Interest, and cross-market risks including cybersecurity, Regulation S-P, AI and AML.
3 June 2026. Larger entities, including advisers with $1.5 billion or more in assets under management, had to comply from 3 December 2025.
The compliance date for the 2024 amendments is now 1 July 2027, after a further extension adopted on 31 August 2026. Further amendments proposed in April 2026 may change the requirements before then.
FinCEN's rule requiring one has been postponed to 1 January 2028. Advisers must still comply with US sanctions, and many run AML controls because custodians and administrators require them.
Generally at $110 million or more in regulatory assets under management; advisers between $100 million and $110 million may register. Smaller advisers usually register with their home state.
Buckingham Capital Consulting has supported regulated financial firms on authorisation, compliance frameworks and regulator engagement since 2013, across the UK, the EU and the US. It works with investment advisers, fund managers and broker-dealers on SEC compliance programmes, annual reviews and examination readiness, alongside qualified US counsel where a legal opinion is needed.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.