Every SEC-registered investment adviser must review its compliance policies and procedures at least once a year, checking both whether they are adequate and whether they work in practice. This free checklist is for chief compliance officers and compliance consultants at registered investment advisers (RIAs). It runs the annual review from planning to a signed report: fiduciary and operations testing, the code of ethics, marketing, books and records, cybersecurity under the amended Regulation S-P, custody, and the Form ADV annual updating amendment. Three scope questions decide what you see: SEC or state registration, whether the firm has custody, and whether it has retail clients who receive Form CRS.
Rule 206(4)-7 under the Investment Advisers Act, often called the compliance programme rule, has three parts. An SEC-registered adviser must adopt written policies and procedures reasonably designed to prevent violations, review them no less often than annually, and designate a chief compliance officer to run them. The rule does not prescribe a format for the review. The SEC’s adopting release expects it to consider compliance matters that arose during the year, changes in the business and changes in the law.
Two neighbouring jobs are often confused with it. The Form ADV annual updating amendment is a filing with its own deadline. A regulatory exam is the SEC testing your programme from the outside. A good annual review feeds both: it finds the disclosure changes the ADV needs and produces the document examiners ask for first.
When: at least once every year, plus interim reviews when something changes.
Work: test whether each policy is adequate and effective, find gaps, assign fixes.
Output: a written report and remediation plan.
When: within 90 days of the fiscal year end.
Work: update Part 1A and the Part 2 brochure, then deliver within 120 days.
Output: an accepted IARD filing and delivery records.
When: on the regulator’s schedule, usually with a short request deadline.
Work: produce records, including the last annual review, and answer questions.
Output: a closing letter or deficiency findings to remediate.
Six phases run on every review. The custody phase appears only when the firm has custody, and tasks inside the cybersecurity and Form ADV phases switch with the registration and retail client answers.
Assigned to the CCO. The scope answers recorded here decide which later phases and tasks appear.
SEC-registered advisers test against amended Regulation S-P. For state-registered advisers the task list switches to the FTC Safeguards Rule and state rules.
Shown only when the firm has custody of client funds or securities. State-registered advisers follow their state’s custody rule, which can differ.
Due dates offset from the fiscal year end. The Form CRS task shows for SEC-registered firms with retail clients; the state task shows for state-registered firms.
The CCO signs the report. Senior management approval is a separate task assigned to a named principal, and the checklist stops until it is answered.
The table maps each part of the checklist to its main SEC rule. State-registered advisers are not subject to Rule 206(4)-7 or Form CRS, but their state may impose similar duties, so treat the table as a starting point, not legal advice.
| Requirement | Rule | Frequency or deadline | Phase |
|---|---|---|---|
| Written policies, annual review, CCO | Rule 206(4)-7 | Review at least annually | 1, 7 |
| Books and records | Rule 204-2 | Generally 5 years from the end of the fiscal year of the last entry, the first 2 in an appropriate office | 3, 7 |
| Code of ethics and personal trading | Rule 204A-1 | Holdings within 10 days of becoming an access person and yearly; transactions within 30 days of quarter end | 3 |
| Marketing | Rule 206(4)-1 | In force since the 4 November 2022 compliance date | 3 |
| Privacy and incident response | Regulation S-P, as amended in 2024 | Compliance from 3 December 2025 ($1.5 billion AUM or more) and 3 June 2026 (smaller advisers) | 4 |
| Custody | Rule 206(4)-2 | Surprise exam yearly; audited pooled vehicle financials within 120 days | 5 |
| Form ADV annual updating amendment | Rule 204-1 | Within 90 days of fiscal year end | 6 |
| Brochure delivery | Rule 204-3 | Within 120 days of fiscal year end | 6 |
| Form CRS | Rule 204-5 and Form ADV Part 3 | Amend within 30 days of a material inaccuracy; communicate within 60 days | 6 |
Several things are moving. FinCEN has postponed its anti-money laundering rule for investment advisers to 1 January 2028 and says it will revisit the rule’s scope. The compliance date for the 2024 Form PF amendments has moved to 1 July 2027 while the SEC and CFTC consider an April 2026 proposal to scale them back. In June 2025 the SEC withdrew several pending proposals, including the safeguarding rule and the adviser cybersecurity risk management rule. On 1 October 2026 it voted to propose new custody amendments covering crypto assets; at the time of writing that is a proposal, not a final rule. SEC staff also added marketing rule FAQs in March 2025 and January 2026.
The Division of Examinations’ fiscal year 2026 priorities name adviser compliance programmes, including how firms carry out annual reviews, alongside fiduciary duty, recently adopted rules such as the Regulation S-P amendments, and information security.
Start the review on an annual recurring schedule keyed to your fiscal year end. Due-date offsets put the ADV filing at day 90 and brochure delivery at day 120, and quarterly testing can run as its own recurring checklist.
Conditional logic reads the scope answers. A state-registered adviser without custody never sees the custody phase or Form CRS, and an SEC-registered firm with retail clients gets both without anyone remembering to add them.
Test samples, holdings reports and the signed report attach to the task they support. Senior management approval is an approval task for a named person, and the timestamped activity trail exports for your records.
CheckFlow is not a compliance management platform, a personal trading surveillance tool or an IARD filing service, and it does not test trades for you. It runs the review workflow around those systems: who tests each area, what they found, who fixed it and who signed off. The asset management overview shows other adviser workflows run the same way, and CheckFlow’s compliance checklist software covers the rest of the compliance calendar.
When an exam letter arrives, the Regulatory Examination Preparation Checklist picks up where this review leaves off. Annual code of ethics attestations can run through the Employee Compliance Certification Tracking Checklist, and advisers preparing for FinCEN’s 2028 date can model their programme on the AML Compliance Programme Review Checklist. Client-facing reviews are covered by the Financial Adviser Annual Client Review Checklist.
It requires every SEC-registered investment adviser to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act, to review their adequacy and the effectiveness of their implementation at least annually, and to designate a chief compliance officer responsible for administering them. Records documenting the annual review must be kept under Rule 204-2.
At least once a year. The SEC also expects interim reviews when circumstances call for them, such as a compliance incident, a new business line, a merger or a change in the rules. Many firms spread testing across the year and use the annual review to pull the results together.
Within 90 days of the end of the adviser’s fiscal year, so 31 March for a firm with a 31 December year end in most years. The updated brochure, or a summary of material changes with an offer of the brochure, must reach clients within 120 days of the year end. Some information must also be updated promptly during the year when it becomes inaccurate.
Rule 206(4)-7 applies to SEC-registered advisers. State-registered advisers follow their state’s rules, and many states have adopted rules based on NASAA model rules covering areas such as business continuity and information security. A yearly review is good practice either way, which is why the checklist keeps the core phases and switches the SEC-only tasks off for state firms.
The 2024 amendments require a written incident response programme, notice to affected individuals within 30 days of becoming aware of unauthorised access to sensitive customer information, oversight of service providers including notice to the firm within 72 hours of a breach, and new records. Advisers with $1.5 billion or more in assets under management had to comply from 3 December 2025 and smaller advisers from 3 June 2026, so this is the first annual review cycle in which every SEC-registered adviser is covered.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
