1 

 National Examination Risk Alert

By the Office of Compliance Inspections and Examinations1

Volume II, Issue 1 January 4, 2012 

Investment Adviser Use of Social 

Media 

I. Introduction

Social media2 is landscape-shifting. It converts the 

traditional two-party, adviser-to-client communication into an 

interactive, multi-party dialogue among advisers, clients, and 

prospects, within an open architecture accessible to third-party 

observers. It also converts a static medium, such as a website, 

where viewers passively receive content, into a medium where 

users actively create content. 

 The use of social media by the financial services industry 

is rapidly accelerating. In growing numbers, registered 

investment advisers (“RIAs” or “firms”) are using social media 

to communicate with existing and potential clients, promote 

services, educate investors and recruit new employees. Pursuant 

to Advisers Act Rule 206(4)-7,3

 1

 The Securities and Exchange Commission (“SEC”), as a matter of policy, disclaims responsibility

for any private publication or statement by any of its employees. The views expressed herein are 

those of the staff of the Office of Compliance Inspections and Examinations, in coordination with 

other SEC staff, including in the Division of Enforcement’s Asset Management Unit and the 

Division of Investment Management, and do not necessarily reflect the views of the Commission or 

the other staff members of the SEC. The staff of the Financial Industry Regulatory Authority 

(“FINRA”) was also consulted in the preparation of this Risk Alert. This document was prepared by 

the SEC staff and is not legal advice.

 firms using social media should 

adopt, and periodically review the effectiveness of, policies and 

2

 “Social media” is an umbrella term that encompasses various activities that integrate technology, 

social interaction and content creation. Social media may use many technologies, including, but not 

limited to, blogs, microblogs, wikis, photos and video sharing, podcasts, social networking, and 

virtual worlds. The terms “social media,” “social media sites,” “sites” and “social networking sites” 

are used interchangeably in this communication. 3

 17 C.F.R. §206(4)-7. 

In this Alert: 

Topic: Observations related to the use 

of social media by registered 

investment advisers. 

Key Takeaways: 

Investment advisers that use or permit 

the use of social media by their 

representatives, solicitors and/or third 

parties should consider periodically 

evaluating the effectiveness of their 

compliance program as it relates to 

social media. Factors that might be 

considered include usage guidelines, 

content standards, sufficient 

monitoring, approval of content, 

training, etc. Particular attention 

should be paid to third party content 

(if permitted) and recordkeeping 

responsibilities.
2 

procedures regarding social media in the face of rapidly changing technology.4 

Firms’ use of social media must comply with various provisions of the federal securities 

laws, including, but not limited to, the antifraud provisions,5

 compliance provisions,6 and 

recordkeeping provisions.7

RIAs’ use of social media has been a matter of interest to the staff, which recently identified 

registered investment advisers of varying sizes and strategies that were using social media to 

evaluate whether their use complied with the federal securities laws.

 

8

II. Staff Observations

 Below are some 

observations from that review, as well as factors that the staff believes a firm that permits the use 

of social media may want to consider in complying with its obligations under the federal 

securities laws. 

A. Compliance Program Related to the Use of Social Media

Many firms have policies and procedures within their compliance programs that 

specifically apply to the use of social media by the firm and its IARs; however, the staff 

observed variation in the form and substance of the policies and procedures. The staff noted that 

many firms have multiple overlapping procedures that apply to advertisements, client 

communications or electronic communications generally, which may or may not specifically 

include social media use. Such lack of specificity may cause confusion as to what procedures or 

standards apply to social media use. Many procedures were also not specific as to which types 

of social networking activity are permitted or prohibited by the firm and many did not address

the use of social media by solicitors. 

 4

 This Alert is not intended as a comprehensive summary of all compliance matters pertaining to the 

use of social media by RIAs. Rather, it discusses measures that may assist RIAs in designing 

reasonable procedures designed to prevent violations of the Advisers Act and other federal securities 

laws with respect to firm, investment advisory representative (“IAR”) and solicitor (employees or 

third parties that solicit or “find” new advisory clients) use of social media. 5

 See, e.g., Section 17(a) of the Securities Act of 1933 (“Securities Act”), 15 U.S.C. §77q(a), Section 

10(b) of the Securities Exchange Act of 1934 (“Exchange Act”), 15 U.S.C. §78j(b), and Rule 10b-5 

thereunder, 17 C.F.R. §240.10b-5, and Sections 206(1), 206(2), and 206(4) of the Advisers Act, 15 

U.S.C. §§806-6(2), 806-6(4), and Rule 206(4)-1 thereunder, 17 C.F.R. §206(4)-1. 6

 See, e.g., Section 206(4) of the Advisers Act, 15 U.S.C. § 806-6(4), and Rule 206(4)-7 thereunder, 

17 C.F.R. §206(4)-7. 7

 See, e.g., Section 204 of the Advisers Act, 15 U.S.C. § 804, and Rule 204(2) thereunder, 17 C.F.R. 

§204(2). 8

 To the extent that a firm provides both brokerage and investment advisory services (“dual 

registrant”), it is required to adhere to both the federal securities laws and FINRA applicable rules, 

including but not limited to, depending on the circumstances, Rule 17a-4(b) (recordkeeping) under 

the Exchange Act, 17 C.F.R §240.17a-4(b), and NASD Rules 2210 and 3010. FINRA has issued 

guidance regarding the application of the federal securities laws and its rules to the use of social 

media by broker-dealers or their representatives. See FINRA Regulatory Notice 11-39 (Aug. 2011); 

FINRA Regulatory Notice 10-06 (Jan. 2010).
3 

When evaluating its controls and compliance program, a firm should first identify conflicts 

and other compliance factors currently creating risk exposure for the firm and its clients in light 

of the firm's particular operations, and then test whether its existing policies and procedures 

effectively address those risks.9 

Below is a non-exhaustive list of factors10 that an investment adviser11

• Usage Guidelines. A firm may consider whether to create firm usage guidelines that 

provide guidance to IARs and solicitors on the appropriate and inappropriate use of 

social media. A firm may also consider addressing appropriate restrictions and 

prohibitions regarding the use of social media sites based on the firm’s analysis of the 

risk to the firm and its clients. For example, a firm may choose to provide an 

exclusive list of approved social media networking sites for IARs’ use or prohibit the 

use of specific functionalities on a site.

may want to consider 

when evaluating the effectiveness of its compliance program with respect to firm, IAR or 

solicitor use of social media:

• Content Standards. A firm may consider the risks that content created by the firm 

or its IARs or solicitors implicates its fiduciary duty or other regulatory issues (e.g., 

such as content that contains investment recommendations, information on specific 

investment services or investment performance). A firm may also consider whether 

to articulate clear guidelines with respect to such content, and whether to prohibit 

specific content or impose other content restrictions.

12 

• Monitoring. A firm may consider how to effectively monitor the firm’s social media 

sites or firm use of third-party sites, taking into account that many third-party sites 

may not provide complete access to a supervisor or compliance personnel. 

• Frequency of Monitoring. A firm may consider the frequency with which it

monitors IAR or solicitor activity on a social media site. For example, using a riskbased approach, a firm may conclude that periodic, daily or real-time monitoring of 

the postings on a site is appropriate. This determination could depend on the volume 

and pace of communications posted on a site or the nature of, and the probability to 

 9

 See Rule 206(4)-7. See generally Compliance Programs of Investment Companies and Investment 

Advisers, 68 FR 74714, 74716 (Dec. 24, 2003)(“Compliance Release”). 10 Firms are encouraged to consider the factors described herein in assessing the effectiveness of their 

compliance program and implementing improvements that will best protect their clients. Firms are 

cautioned that these factors and suggestions are neither exhaustive nor will they constitute a safe 

harbor nor a “checklist” for SEC examiners. Other factors besides those highlighted here may also 

be appropriate. While some of the factors discussed herein reflect existing regulatory requirements, 

the adequacy of a compliance program can be determined only with reference to the profile of the 

specific firm and the specific facts and circumstances. 11 Dual registrants may also want to consider these factors, although they do not modify or displace 

firms’ obligations under the federal securities laws, FINRA or other rules relevant to social media, or 

FINRA guidance in this area, as referenced in footnote 7 supra. 12 A majority of the advisers we observed prohibited the posting of recommendations or information on 

specific products or services on their social media sites. 
4 

mislead contained in, the subject matter discussed in particular conversation streams. 

The after-the fact review of violative content days after it was posted on a firm’s 

social networking site, depending on the circumstances, may not be reasonable, 

particularly where social media content can be rapidly and broadly disseminated to 

investors and the markets.

• Approval of Content. A firm may want to consider the appropriateness of preapproval requirements (as opposed to after-the-fact review, as discussed above).13

• Firm Resources. A firm may consider whether it has dedicated sufficient 

compliance resources to adequately monitor IAR or solicitor activity on social media 

sites, including the ability to monitor the activity of numerous IARs or solicitors. A 

firm may also consider employing conversation monitoring or similar services from 

outside vendors, if, for example, the firm has many IARs or solicitors who use social 

media sites. A firm may consider using sampling, spot checking, or lexicon-based or 

other search methodologies, or a combination of methodologies, to monitor social 

media use and content.14 

• Criteria for Approving Participation. In analyzing the risk exposure for a firm and 

its clients due to the use of a social networking site, the firm’s compliance procedures 

may consider, without limitation, the reputation of the site, the site’s privacy policy, 

the ability to remove third-party posts, controls on anonymous posting and the 

advertising practices of any social media site that the firm, or its IARs or solicitors 

use to conduct business. 

• Training. In establishing or reviewing any training requirements for its IARs, a firm 

may consider implementing training related to social media that seeks to promote 

compliance and to prevent potential violations of the federal securities laws and the 

firm’s internal policies. 

• Certification. A firm may consider whether to require a certification by IARs and 

advisory solicitors confirming that those individuals understand and are complying 

with the firm’s social media policies and procedures. 

 

• Functionality. A firm may consider the functionality of each social media site 

approved for use, including the continuing obligation to address any upgrades or 

modifications to the functionality that affect the risk exposure for the firm or its 

clients. Such consideration is particularly significant given the rapidly evolving 

nature of this new media. For example, a firm that chooses to host social media on a 

site that includes a functionality or engages in a practice that exposes a client-user’s 

 13 The pre-approval of postings on a social media site is presently only required for broker-dealers in 

certain circumstances. See NASD Rule 2210. 14 While the firm may use third-party services for this purpose, the firm is ultimately responsible for its 

IARs’ or solicitors’ use of social media. 
5 

privacy, which practice or policy cannot be disabled or modified, may need to 

consider whether the firm’s participation is appropriate.

• Personal/Professional Sites. A firm may consider whether to adopt policies and 

procedures to address an IAR or solicitor conducting firm business on personal (nonbusiness) or third-party social media sites. For example, a firm may choose to specify 

what types of firm communications or content are permitted on a site that is not 

operated, supervised or sponsored by the firm. While a firm may determine that it is 

appropriate to permit business card information on a specific personal site or thirdparty site, it may choose to prohibit conducting firm business on that site. 

• Information Security. A firm may consider whether permitting its IARs to have 

access to social media sites poses any information security risks. Protecting 

information and information systems from unauthorized access, use, disclosure, 

disruption, modification, perusal, inspection, recording or destruction is an important 

risk faced by all firms. Although hacking and other breaches of information security 

can be posed in multiple ways, use of social media, especially third party social media 

sites, may pose elevated risks. Firms may consider adopting compliance policies and 

procedures to create appropriate firewalls between sensitive customer information, as 

well as the firm’s own proprietary information, and any social media site to the extent 

that the firm permits access to such sites by its IARs. 

• Enterprise Wide Sites. An RIA that is part of a larger financial services or other 

corporate enterprise may consider whether to create usage guidelines reasonably 

designed to prevent the advertising practices of a firm-wide social media site from

violations of the Advisers Act 

B. Third-Party Content

Most firms allow third parties to make postings on their social media sites, but the 

policies and procedures governing such third-party postings vary in what types of postings are 

permissible. Some firms allow third parties to post messages, forward links, and post articles on 

the firms’ social media sites, while other firms have explicit policies limiting third-party use to 

“one way postings,” where the firms’ IARs or solicitors post on the firms’ social media sites but 

do not interact with third parties or respond to third-party postings. More conservatively, some 

firms limit third-party postings to authorized users and prohibit postings by the general public. 

Many firms post disclaimers directly on their site stating that they do not approve or endorse any 

third-party communications posted on their site in an attempt to avoid having a third-party 

posting attributed to the firm. 

Firms that allow for third-party postings on their social media sites may consider having 

policies and procedures concerning third-party postings, including the posting of testimonials 

about the firm or its IARs as well as reasonable safeguards in place to avoid any violation of the 

federal securities laws. 
6 

• Testimonials. Whether a third-party statement is a testimonial15 depends upon all of 

the facts and circumstances relating to the statement. The term “testimonial” is not 

defined in Rule 206(4)-1(a)(1), but SEC staff consistently interprets that term to 

include a statement of a client's experience with, or endorsement of, an investment 

adviser. Therefore, the staff believes that, depending on the facts and circumstances, 

the use of “social plug-ins” such as the “like” button could be a testimonial under the 

Advisers Act.16

C. Recordkeeping Responsibilities

 Third-party use of the “like” feature on an investment adviser’s 

social media site could be deemed to be a testimonial if it is an explicit or implicit 

statement of a client's or clients' experience with an investment adviser or IAR. If, for 

example, the public is invited to “like” an IAR’s biography posted on a social media 

site, that election could be viewed as a type of testimonial prohibited by rule 206(4)-

1(a)(1). 

The Advisers Act sets forth the recordkeeping obligations of registered investment 

advisers.17 The recordkeeping obligation does not differentiate between various media, including 

paper and electronic communications, such as e-mails, instant messages and other Internet 

communications that relate to the advisers’ recommendations or advice. RIAs that communicate 

through social media must retain records of those communications if they contain information 

that satisfies an investment adviser’s recordkeeping obligations under the Advisers Act.

18 In the 

staff’s view the content of the communication is determinative. A firm that intends to 

communicate, or permit its IARs to communicate, through social media sites may wish to

determine that it can retain all required records related to social media communications and make 

them available for inspection.

Social media offers multiple ways to communicate with existing or potential clients from 

status updates, discussion boards, emails, texting, direct messaging or chat rooms. RIAs should 

consider reviewing their document retention policies to ensure that any required records

generated by social media communications are retained in compliance with the federal securities 

laws, including in a manner that is easily accessible for a period not less than five years. RIAs

 15 Rule 206(4)-1(a)(1) states that:

 [i]t shall constitute a fraudulent, deceptive, or manipulative act, practice, or course of business ... 

for any investment adviser registered or required to be registered under [the Advisers Act], directly 

or indirectly, to publish, circulate, or distribute any advertisement which refers, directly or 

indirectly, to any testimonial of any kind concerning the investment adviser or concerning any 

advice, analysis, report or other service rendered by such investment adviser.

 

16 Some social media sites do not permit an investment adviser to disable the “like” or similar feature, 

which may require an investment adviser to develop a system to monitor and, if necessary, remove 

third-party postings. 17 Rule 204-2 requires investment advisers to make certain books and records relating to their advisory 

business (“required records”) and to keep them for a specified period of time. In addition, the rule 

requires investment advisers that keep required records in an electronic format to keep them in a 

manner that allows the records to be arranged and indexed. See Section 204 of the Advisers Act and 

Rule 204-2 thereunder. 18 See Rule 204-2.
7 

should consider whether their retention policies account for the volume of communication and 

unique communication channels available to each particular social media site. Investment 

advisers may consider adopting compliance policies and procedures that address (if relevant) the 

following factors, among others, relating to the recordkeeping and production requirements of 

required records generated by social media communications: 

• Determining, among other things, (1) whether each social media communication used 

is a required record, and, if so, (2) the applicable retention period, and (3) the 

accessibility of the records. 

• Maintaining social media communications in electronic or paper format (e.g., screen 

print or pdf of social media page, if practicable). 

• Conducting employee training programs to educate advisory personnel about 

recordkeeping provisions. 

• Arranging and indexing social media communications that are required records and 

kept in an electronic format to promote easy location, access and retrieval of a 

particular record.

• Periodic test checking (using key word searches or otherwise) to ascertain whether 

employees are complying with the compliance policies and procedures (e.g., whether 

employees are improperly destroying required records). 

• Using third parties to keep records consistent with the recordkeeping requirements.

IV. Conclusion 

While many RIAs are eager to leverage social media to market and communicate with 

existing clients, and to promote general visibility, RIAs should ensure that they are in 

compliance with all of the regulatory requirements and be aware of the risks associated with 

using various forms of social media. The staff hopes that sharing observations from its recent 

review of RIAs’ use of social media as well as its suggestions regarding factors that firms may 

wish to consider is helpful to firms in strengthening their compliance and risk management 

programs. The staff also welcomes comments and suggestions about how the Commission’s 

examination program can better fulfill its mission to promote compliance, prevent fraud, monitor 

risk, and inform SEC policy. If you suspect or observe activity that may violate the federal 

securities laws or otherwise operates to harm investors, please notify us at 

http://www.sec.gov/complaint/info_tipscomplaint.shtml.