1

November 9, 2021

Observations from Examinations of Advisers that

Provide Electronic Investment Advice* 

I. Introduction

Advisers have been providing automated digital investment advisory services to retirement plan 

participants and retail investors for more than two decades; however, the Division of Examinations 

(“Division”) has recently observed a significant increase in the number of investment advisers 

choosing to provide automated digital investment advisory services to their clients. These advisers 

either exclusively provide online services or supplement their traditional investment advisory 

services by using proprietary software, third party software, or a combination thereof. Millions of 

investors, individually and through their employer-sponsored retirement plans, now entrust their 

savings to advisers that provide their investment advisory services online, via mobile applications, 

or both (also known as robo-advisers). 

The use of automated digital investment advisory services (“robo-advisory services”) can have 

important investor protection implications. On the one hand, automation can offer significant 

benefits, including providing convenient, accessible, and lower cost services for investors and 

enhancing operational efficiency for advisers. When robo-advisers fail to comply with their 

regulatory obligations, however, investors may experience poor outcomes. If, for example, a roboadviser’s client survey process does not appropriately capture a client’s risk tolerance, it could result 

in advice to invest in securities that are not aligned with the client’s best interest. Similarly, if a 

robo-adviser is programmed to act on conflicts of interest that raise the costs or decrease the quality 

of the services provided, the client may be harmed as a result of the adviser’s putting its own 

interests ahead of its clients.

The Division conducted a series of examinations to assess the practices of advisers providing roboadvisory services.

1 Under its Electronic Investment Advice Initiative (the “Initiative” or “eIA 

 * The views expressed herein are those of the staff of the Division of Examinations, formerly known as the Office of Compliance

Inspections and Examinations or OCIE (the “Division”). This Risk Alert is not a rule, regulation, or statement of the Securities and 

Exchange Commission (the “SEC” or the “Commission”). The Commission has neither approved nor disapproved the content of this 

Risk Alert. This Risk Alert has no legal force or effect: it does not alter or amend applicable law, and it creates no new or additional 

obligations for any person. This document was prepared by Division staff and is not legal advice.

1 The Division previously focused on examining advisers that provide advisory services through the Internet, including prior to the 

adoption of the exemption from the prohibition on Commission registration for Internet advisers pursuant to Advisers Act Rule 203A2(e) (the “Internet adviser exemption”) (See Exemption for Certain Investment Advisers Operating Through the Internet, Advisers 

Act Rel. No. 2091 (Dec. 12, 2002) (“IA-2091”)). There is no standard industry nomenclature to describe advisers that provide 

electronic advisory services. The term “Internet adviser” herein refers to robo-advisers that registered with the Commission in 

reliance on this exemption. In addition, the Division’s observations from multiple robo-adviser examinations were considered when 

drafting the guidance published by the SEC’s Division of Investment Management (“Investment Management”) on robo-advisers and 

informed the development of the Initiative’s scope (See Investment Management, Guidance Update: Robo-Advisers (Feb. 23, 2017) 
2

Initiative”), the staff sought to obtain a better understanding of how robo-advisers were operating 

their firms, providing advisory services to retail and institutional clients, and satisfying their 

regulatory obligations under the Investment Advisers Act of 1940 (“Advisers Act”). In particular, 

the staff focused on how robo-advisers were upholding their fiduciary duty to: (1) provide clear and 

adequate disclosure regarding the nature of the advisers’ services and performance history; and 

(2) act in their clients’ best interests.

The purpose of this Risk Alert is to raise awareness of certain compliance issues the Division

observed while conducting examinations of advisers providing, or claiming to provide, roboadvisory services, including advisers that operate, recommend, or sponsor discretionary investment 

advisory programs.

2

In order to gain a broad understanding of the industry, the Division selected advisers to examine 

under the eIA Initiative that had different business models, client types, investment practices, assets 

under management, and bases for SEC-registration. The examined advisers: (1) provided roboadvisory services to employer-sponsored retirement plans (“retirement plans”) and/or retail 

investors, including retirement plan participants; (2) sold, licensed, or otherwise granted interactive, 

digital platform access to third parties, such as advisers, broker-dealers, and banks; and/or 

(3) provided advisory or sub-advisory services to an interactive, digital investment platform.

II. Examination Focus and Relevant Regulations

A. Provision of Electronic Investment Advice

Examinations focused on the advisers’ robo-advisory practices in several areas. In addition to a 

broader review of these advisers’ adherence to their fiduciary duty,3 the staff specifically examined 

the advisers’:

• Compliance programs to assess whether compliance policies and procedures, particularly those 

related to the provision of robo-advisory services, were adopted, implemented, reasonably 

designed, and tested at least annually.4

 (“Guidance”) for additional information). The eIA Initiative included Internet advisers as well as other advisers that provided 

electronic investment advice either exclusively or in addition to traditional investment advisory services (together, “advisers”).

2 Discretionary investment advisory programs may raise implications under the Investment Company Act of 1940 (“Company Act”). 

See Final Rule: Status of Investment Advisory Programs under the Investment Company Act of 1940 (“Adopting Release”), 

Company Act Release No. 22579 (Mar. 24, 1997) (although investment advisory programs are typically sponsored by investment 

advisers, Rule 3a-4 is available to any investment advisory program, regardless of whether the sponsor, for example, is excepted from 

the definition of investment adviser, such as a bank, or is required or permitted to be registered under the Advisers Act). For this Risk 

Alert, the use of “operate” or “operating” includes advisers that operate a discretionary investment advisory program, recommend 

such a program, or both.

3 See, e.g., Commission Interpretation Regarding Standard of Conduct for Investment Advisers, Advisers Act Rel. No. 5248 (Jun. 

5, 2019) (“Fiduciary Release”) (“[T]he duty of care requires an investment adviser to provide investment advice in the best 

interest of its client, based on the client’s objectives... The duty of loyalty requires that an adviser not subordinate its clients’ 

interests to its own. In other words, an... adviser must not place its own interest ahead of its client’s interests.”). The 

Commission has recently brought an action against a robo-adviser that did not uphold its duties of loyalty and care. See In re

SoFi Wealth, LLC, Advisers Act Rel. No. 5826 (Aug. 19, 2021) (settled) (alleging that the adviser harmed clients by investing 

in certain affiliated securities and lacked written policies and procedures designed to prevent such harm).

4 Advisers Act Rule 206(4)-7 (“the Compliance Rule”) requires SEC-registered advisers to adopt, implement, and annually 

review written policies and procedures that are reasonably designed to prevent violations of the Advisers Act and rules 

thereunder by advisers and their supervised persons. See also Compliance Programs of Investment Companies and Investment 
3

• Formulation of investment advice to evaluate whether advisers gathered sufficient information 

from clients to form a reasonable belief that clients were receiving investment advice that was in 

their best interest based on each client’s financial situation and investment objectives.

5

 Where 

applicable, the staff also reviewed conflicts of interest disclosures and “customization” 

representations for adequacy and accuracy.6

• Marketing and performance advertising practices for compliance with the “Advertising Rule.”7

Also, if relevant, the staff reviewed whether the advertised securities selection and portfolio 

management techniques were used when managing client accounts.

• Data protection practices to understand the firms’ policies and procedures regarding client data 

protection, including cybersecurity practices.8

• Registration information to determine whether the advisers were eligible for SEC registration as 

investment advisers.

B. Use of Discretionary Investment Advisory Programs

Advisers that provide electronic investment advice may also sponsor or operate investment advisory 

programs, including for example, wrap fee programs and asset allocation programs that allocate 

client assets among mutual funds or exchange-traded funds. These programs are designed to 

provide the same or substantially similar professional portfolio management services to a large 

number of individual clients (“retail clients”) and are commonly used to manage retail clients’ 

 Advisers, Advisers Act Rel. No. 2204 (Dec. 17, 2003) (“IA-2204”) (“Where appropriate, advisers’ policies and procedures 

should employ, among other methods of detection, compliance tests that analyze information over time in order to identify 

unusual patterns.”). In the context of this Initiative, staff reviewed advisers’ practices, policies, and procedures addressing, 

among other things, advisers’ fiduciary duty to: (1) act in their clients’ best interest; (2) not place their interests ahead of their 

clients’ interests; and (3) make adequate and accurate disclosures.

5 See Advisers Act Section 206 (anti-fraud provision that imposes a fiduciary duty on advisers). See also supra Fiduciary Release

at note 3 (“[I]n order to avoid liability under this antifraud provision, an investment adviser should have sufficient information 

about the prospective client and its objectives to form a reasonable basis for advice before providing any advice about these 

matters.”). 

6 See supra Guidance at note 1 (information must be presented in a manner that clients are likely to read, if in writing, and understand).

7 Advisers Act Rule 206(4)-1 (“Advertising Rule”) prohibits any adviser that is registered or required to be registered under the 

Advisers Act from, among other things, using any advertisement that contains any untrue statement of material fact or that is 

otherwise false or misleading. The Commission recently adopted amendments to the Advertisements Rule, creating a merged 

rule (the “Marketing Rule”) that will replace the existing Advertising Rule and Rule 206(4)-3 (addresses cash solicitations). The 

Marketing Rule became effective on May 4, 2021, and has a compliance date of November 4, 2022. The staff anticipates that 

some advisers may seek to comply with the new marketing rule in advance of the compliance date. In conjunction with these 

amendments, the Commission adopted amendments to Form ADV, to provide the Commission with additional information 

about advisers’ marketing practices, and Rule 204-2 (requires advisers to make and keep certain books and records). See

Investment Adviser Marketing, Advisers Act Rel. No. 5653 (Dec. 22, 2020) (“IA-5653”). 

8 See Privacy of Consumer Financial Information (Regulation S-P), Advisers Act Rel. No. 1883 (Jun. 22, 2000) (adopting rules 

implementing the privacy provisions of Subtitle A of Title V of the Gramm-Leach-Bliley Act with respect to financial 

institutions regulated by the SEC) (“Regulation S-P Release”) and Identity Theft Red Flags Rules, Advisers Act Rel. No. 3582 

(Apr. 10, 2013) (“Regulation S-ID Release”) (adopting rules and guidelines to require certain regulated entities to establish 

programs to address risks of identity theft). See also Division (published as OCIE) Report on Cybersecurity and Resiliency 

Observations (Jan. 27, 2020).
4

individual accounts and retirement plans (e.g., 401(k) plans) on a discretionary or nondiscretionary 

basis.

Certain discretionary investment advisory programs may meet the definition of an “investment 

company” under the Company Act.

9

 To address this concern, the Commission adopted Company Act 

Rule 3a-4 as a nonexclusive safe harbor.10 An investment adviser that sponsors or operates a

discretionary investment advisory program should consider the program’s status under the Company 

Act. Furthermore, if the program intends to rely on the Rule 3a-4 safe harbor, then the program’s 

sponsor or operating adviser should consider whether the program is in compliance with the Rule’s 

conditions.11 

Where advisers recommended discretionary investment advisory programs, the staff reviewed whether 

such programs could be considered investment companies pursuant to the Company Act. More 

specifically, the staff inquired as to whether the advisers were aware of how these programs were 

organized and whether they were being operated in accordance with the nonexclusive safe harbor 

provided by Rule 3a-4.

III. Staff Observations

Nearly all of the examined advisers received a deficiency letter, with observations most often noted 

in the areas of: (1) compliance programs, including policies, procedures, and testing; (2) portfolio 

management, including, but not limited to, an adviser’s fiduciary obligation to provide advice that is 

in each client’s best interest; and (3) marketing/performance advertising, including misleading 

statements and missing or inadequate disclosure. The staff also observed, among other things, 

 9 The Commission has indicated that discretionary investment advisory programs that provide each client with individualized treatment 

and the ability to maintain indicia of ownership of the securities in their accounts are not investment companies. See Request for 

Information and Comments on Broker-Dealer and Investment Adviser Digital Engagement Practices, Related Tools and Methods, 

and Regulatory Considerations and Potential Approaches; Information and Comments on Investment Adviser Use of Technology to 

Develop and Provide Investment Advice, Advisers Act Rel. No. 5833 (Aug. 27, 2021). See also supra Guidance at note 1 (“[R]oboadvisers should consider whether the organization and operation of their programs raise any issues under the other federal securities 

laws... in particular Rule 3a-4 under the... Company Act”). Company Act Section 3(a)(1) defines the term investment company 

generally to include any “issuer” that is engaged primarily in the business of investing, reinvesting, or trading in securities. The 

definition of “issuer” includes any organized group of persons, whether or not incorporated, that issues or proposes to issue any 

security. For a detailed discussion of why a discretionary investment advisory program may meet the definition of investment 

company and may be deemed to be issuing securities, see Status of Investment Advisory Programs under the Investment Company 

Act of 1940, Company Act Rel. No. 21260 (Jul. 27, 1995) (revised proposal of Rule 3a-4).

10 Rule 3a-4 only applies to discretionary investment advisory programs. See supra Adopting Release at note 2. (“A 

nondiscretionary program (i.e., one in which the investor has the authority to accept or reject each recommendation to purchase 

or sell a security made by the portfolio manager, and exercises judgment with respect to such recommendations), generally will 

not meet the definition of investment company under the Investment Company Act or issue securities that are required to be 

registered under Section 5 of the Securities Act, regardless of whether the program is operated in accordance with the provisions 

of [R]ule 3a-4.”).

11 See supra Adopting Release at note 2 (“Whether a program that operates outside of [R]ule 3a-4 is an investment company is a 

factual determination and depends on whether the program is an issuer of securities under the... Company Act and the Securities 

Act [of 1933]... [Rule 3a-4] is not intended... to create any presumption about a program that is not organized and operated in 

the manner contemplated by the [Rule]... Investment advisers under the Advisers Act owe their clients the duty to provide only 

suitable investment advice, whether or not the advice is provided to clients through an investment advisory program.”). Rule 3a4 is designed to address only the status of the program under the Company Act, not the obligations of any investment adviser 

under the Advisers Act. Accordingly, the steps required to meet the conditions to Rule 3a-4 may not satisfy an adviser’s 

obligations under the Advisers Act, including its fiduciary obligations to clients participating in an investment advisory 

program. See supra Fiduciary Release at note 3.
5

advisers that were relying on, but not acting in accordance with, the Internet adviser exemption and 

Company Act Rule 3a-4. Additional details regarding these observations are described below.

A. Electronic Investment Advice

• Compliance programs. Most advisers had inadequate compliance programs, typically as a 

result of either a lack of written policies and procedures or having ones that were insufficient for 

their operations, unimplemented, or untested.12 Specifically, the staff observed advisers that did 

not: 

o Include elements in their policies and procedures specific to their use of an online platform 

and/or other digital tools for the provision of investment advice, such as assessing whether 

the advisers’: (1) algorithms were performing as intended; (2) asset allocation and/or 

rebalancing services were occurring as disclosed; and/or (3) data aggregation services did 

not impair the safety of clients’ assets as a result of the adviser having direct or indirect 

access to clients’ credentials (e.g., pins and passwords).13 Additionally, advisers using 

business-to-business platforms (e.g., “white-label platforms”) lacked policies and procedures

that addressed the platform providers’ attention to these matters.

o Undertake a sufficient review of their policies and procedures at least annually to determine 

their adequacy, the effectiveness of their implementation, or both. For example, in addition 

to not addressing the above practices, many advisers did not detect inadequacies or noncompliance with their marketing and performance advertising practices, and several failed to

recognize that certain practices constituted custody, causing the adviser to violate the 

“Custody Rule.”14

o Comply with the “Code of Ethics Rule.”15 For example, some advisers did not: (1) receive 

the required holdings and/or transaction reports from all access persons, typically because 

not all access persons had been identified; (2) obtain or maintain the required written 

acknowledgements from all supervised persons confirming receipt of the advisers’ codes; 

and/or (3) include in their codes all required provisions.

 12 See supra IA-2204 at note 4 (“[A]n adviser should identify... factors creating risk exposure for the firm and its clients in light of 

the firm’s particular operations, and then design policies and procedures that address those risks.”) See also supra Guidance at 

note 1 (“In developing its compliance program, a robo-adviser should be mindful of the unique aspects of its business model.”).

13 Some robo-advisers offer data aggregation services, through which a client can view all or a portion of their personal financial 

information on the adviser’s platform, such as outside bank and brokerage account information (e.g., assets, debt, transaction activity). 

14 Advisers Act Rule 206(4)-2 requires advisers that are registered or required to be registered under the Advisers Act, and that 

have custody of their clients’ funds or securities, to take several steps that are designed to safeguard those clients’ assets against 

theft, loss, misappropriation, or financial reverses of the adviser. Advisers have custody if they hold, directly or indirectly, client 

funds or securities, or have the authority to obtain possession of them. Examples of an adviser that has indirect access or the 

authority to obtain possession of clients’ funds or securities include a firm that has access to a client’s log-in credentials, has 

personnel who serve as a trustee to a firm client, or accepts client checks for investment that are made payable to the adviser. 

15 Advisers Act Rule 204A-1 requires any adviser that is registered or required to be registered under the Advisers Act to establish, 

maintain and enforce a code of ethics that, at a minimum, includes certain provisions. Among these are provisions requiring the 

adviser’s access persons to: (1) report, and the adviser to review, their personal securities holdings and transactions; and (2) 

obtain pre-approval of certain investments from the adviser.
6

• Portfolio management – oversight.

16 Many advisers were not testing the investment advice 

generated by their platforms to clients’ stated or platform-determined investment objectives or 

otherwise satisfying their duty of care. The staff observed advisers that: 

o Either lacked written policies and procedures that would allow the firms to develop a 

reasonable belief that the investment advice being provided to clients was in each client’s 

best interest based on the client’s objective, or adopted policies and procedures that were 

inadequate or not followed. A review of practices revealed that, while advisers commonly 

used questionnaires to collect client data, some firms relied on just a few data points to 

formulate investment advice. This raised the concern that the questions did not elicit 

sufficient information to allow the adviser to conclude that its initial and ongoing advice

were suitable and appropriate for that client based on the client’s financial situation and 

investment objectives.

17 In addition, many advisers did not periodically evaluate whether 

accounts were still being managed in accordance with the clients’ needs, such as by 

inquiring about any changes in their financial situation or investment objectives or having 

clients update or retake their questionnaires.18

o Lacked written policies and procedures related to the operation and supervision of their 

automated platforms, increasing the risk of algorithms producing unintended and 

inconsistent results (e.g., due to coding errors or coding insufficient to address unforeseen or 

unusual market conditions, such as those caused by geo-political events, substantial oil price 

movements, or interest rate changes). The staff observed, among other things, rebalancing 

errors and other trade errors at firms that lacked adequate oversight of their automated 

platforms.

o Lacked written policies and procedures to prevent violations of legal requirements related to 

their duty to seek best execution. For example, some advisers did not conduct, or document 

the details of, a best execution review, while others did not appear to be aware of their best 

execution obligations at all.

• Portfolio management – disclosures and conflicts.

19 The staff observed inaccurate or 

incomplete disclosures in many advisers’ Form ADV filings, including those related to conflicts 

 16 See supra Fiduciary Release at note 3 (stating that an adviser has a fiduciary duty to: (1) provide advice that is in the best interest 

of its client, which requires the adviser to make a reasonable inquiry into the client’s investment objectives and have a 

reasonable belief that the advice is in the client’s best interest; (2) seek best execution; and (3) provide advice and monitoring at 

a frequency that is in the best interest of the client, taking into account the scope of the agreed relationship). See also supra IA2204 at note 4 (“The [Compliance Rule] requires advisers to consider their fiduciary and regulatory obligations under the 

Advisers Act and to formalize policies and procedures to address them.”).

17 See supra Guidance at note 1 (suggesting written policies and procedures a robo-adviser should consider adopting and 

implementing). 

18 While the duty of care applies to all advisers, this observation generally was noted in the context of advisers operating 

investment advisory programs. See Section III.B. of this Risk Alert for additional information regarding sponsor and operator 

reliance on Rule 3a-4. 19 See supra Fiduciary Release at note 3 (“[t]o meet its duty of loyalty, an adviser must make full and fair disclosure to its clients of 

all material facts relating to the advisory relationship... In addition, an adviser must eliminate or at least expose through full and 

fair disclosure all conflicts of interest which might incline an investment adviser-consciously or unconsciously-to render advice 

which was not disinterested... In order for disclosure to be full and fair, it should be sufficiently specific so that a client is able to 

understand the material fact or conflict of interest and make an informed decision whether to provide consent... Whether the

disclosure is full and fair will depend upon, among other things, the nature of the client, the scope of the services, and the 
7

of interest, advisory fees, investment practices, and ownership structure. In addition, more than 

half of the advisers included hedge clauses and/or other exculpatory language in their advisory 

agreements, “terms of use and conditions,” or other documents that may not align with their 

fiduciary duty.

20 Examples of omitted, inaccurate, or incomplete disclosures include instances 

where the advisers:

o Had purported third-parties recommend the advisers or provide execution services for 

advisory clients, but did not disclose that these parties were, in fact, affiliated with, and 

received compensation from, the advisers for the referrals, trades executed, or both.

o Omitted or had insufficient disclosure regarding how the adviser collects and uses 

information gathered from a client to generate a recommended portfolio, or how and when 

rebalancing occurs.21

o Omitted disclosures regarding processes for addressing profits and losses from trade errors.

o Provided inconsistent disclosures in various documents regarding advisory fee calculations.

• Performance advertising and marketing. More than one-half of the advisers had advertisementrelated deficiencies.22 For example, the staff observed advisers that:

o Made misleading or prohibited statements on their websites, such as: (1) using vague or 

unsubstantiated claims that could cause an untrue or misleading implication or inference to 

be drawn regarding the advisory services provided, investment options available, 

performance expectations, and costs incurred in investing (e.g., a comparative analysis of 

adviser-offered versus other products and services); (2) misrepresenting SIPC protections by 

implying that client accounts would be protected from market declines;23 (3) using press 

logos (e.g., ABC, CNN, Forbes) without links or disclosure that would explain their 

relevance; and (4) referring to, or providing links to, positive third party commentary, 

without disclosing the relevance, any conflict of interest (e.g., adviser compensation), or 

both.

24

 material fact or conflict”). See also supra IA-2204 at note 4 (“Each adviser, in designing its policies and procedures, should first 

identify conflicts and other compliance factors creating risk exposure for the firm and its clients in light of the firm’s particular 

operations, and then design policies and procedures that address those risks.”).

20 Id (stating the Commission’s view an adviser’s federal fiduciary duty may not be waived, though its application may be shaped 

by the agreed-upon scope of its advisory relationship, and, “[a] contract provision purporting to waive the adviser’s federal 

fiduciary duty generally, such as (i) a statement that the adviser will not act as a fiduciary, (ii) a blanket waiver of all conflicts of 

interest, or (iii) a waiver of any specific obligation under the Advisers Act, would be inconsistent with the Advisers Act...”).

21 See supra Guidance at note 1 (providing examples of information a robo-adviser should consider disclosing). 

22 The Commission has brought actions against advisers that provided electronic investment advice and made false or misleading 

statements in their advertisements. See, e.g., In re Hedgeable, Inc., Advisers Act Rel. No. 5087 (Dec. 21, 2018) (settled) 

(alleging that the adviser disseminated false and misleading marketing materials and performance data) and In re Wealthfront, 

LLC, Advisers Act Rel. No. 5086 (Dec. 21, 2018) (“Wealthfront”) (settled) (alleging that the adviser falsely stated that it 

monitored client accounts to avoid making wash sale transactions). 23 SIPC does not protect against investment losses. SIPC protects the custody function of a broker-dealer in the event the brokerdealer should fail. The limit of its protection is $500,000, which includes a $250,000 limit for cash.

24 The Commission has brought actions against advisers that published advertisements that omitted material information, including 

robo-advisers. See supra Wealthfront at note 22 (adviser allegedly selectively republished certain social media posts that made 
8

o Used materially misleading performance advertisements on their websites, including 

hypothetical performance results of an investment model applied retroactively without 

including disclosures that would make the presentation not misleading.25

o Provided inadequate or insufficient disclosure about “human” services (e.g., whether 

interactions with live individuals are available, mandatory, or restricted; whether they cost 

extra; or whether the client is assigned a financial professional).26

• Cybersecurity and protection of client information. The staff observed that while all of the 

advisers had business continuity plans, and the vast majority had implemented written policies 

and procedures regarding identifying and recovering from cybersecurity events, fewer advisers 

had policies and procedures that addressed protecting the firm’s systems and responding to such 

events. The staff also observed advisers that were not in compliance with Regulation S-ID, 

Regulation S-P, or both because they: (1) had “covered accounts,” but lacked written policies 

and procedures designed to detect, prevent, and mitigate identity theft; (2) lacked or did not 

implement written policies and procedures addressing compliance with certain elements of 

Regulation S-P; and/or (3) did not deliver initial and/or annual privacy notices to all clients

when required to do so.

27

• Registration matters. Nearly half of the advisers claiming reliance on the Internet adviser 

exemption were ineligible to rely on the exemption, and many were not otherwise eligible for 

SEC-registration. This has been a common finding for many years.28 The staff observed 

advisers that: (1) did not have an interactive website; or (2) provided advisory personnel who 

could expand upon the investment advice provided by the adviser’s interactive website or 

otherwise provide investment advice to clients, such as financial planning.29 The staff also 

 positive statements about its services, including ones made by individuals that it knew or should have known had an economic 

interest in promoting the adviser, without disclosing this conflict of interest).

25 Newly adopted amendments to Rule 206(4)-1 generally limit an adviser’s use of hypothetical performance in advertisements

provided to investors who have access to the resources to independently analyze such information and have the financial 

expertise to understand the risks and limitations of such performance presentations. See supra IA-5653 at note 7.

26 Advisers that provide electronic investment advice should disclose their use of algorithms and explain the degree of human 

involvement in the oversight and management of individual client accounts. See supra Guidance at note 1.

27 See supra Regulation S-P Release and Regulation S-ID Release at note 8. See also Division (published as OCIE), Risk Alert: 

Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P - Privacy Notices and Safeguard Policies

(Apr. 16, 2019) (highlighting the requirements of Regulation S-P and common areas of non-compliance observed by the staff).

28 The Commission has cancelled the registration of advisers claiming reliance on the Internet adviser exemption for not satisfying 

the requisite conditions and also brought actions against them. See, e.g., Ajenifuja Investments, LLC; Order Cancelling 

Registration Pursuant to Section 203(h) of the Investment Advisers Act of 1940, Advisers Act Rel. No. 5110 (Feb. 12, 2019) 

(finding that adviser was registered as an Internet adviser for over three years and in that time period did not have an interactive 

website and did not demonstrate any other basis for registration eligibility). See also In re RetireHub, Inc., Advisers Act Rel. 

No. 3337 (Dec. 15, 2011) (settled) (alleging that the adviser was never an Internet adviser because, over the course of its 

registration, it did not provide investment advice exclusively through an interactive website, advised more clients than permitted 

through personal contact, or both).

29 See supra IA-2091 at note 1 and Advisers Act Rule 203A-2(e)(1)(i) (stating that the Internet adviser exemption is available only 

to an adviser that provides investment advice to clients exclusively through an “interactive website,” except as permitted by the 

de minimis exception). The de minimis exception permits an adviser relying on the rule to advise clients through means other 

than its interactive website, so long as the adviser had fewer than 15 of these non-Internet-based clients during the preceding 12 

months. Thus, an adviser relying on this exemption for SEC registration generally cannot offer non-interactive website based 

services to its clients.
9

observed that some advisers’ affiliates were operating as unregistered investment advisers 

because they were operationally integrated with the respective advisers. Such affiliates could 

not rely on the Internet adviser’s registration as a basis for their own registration, as such 

reliance is prohibited under Advisers Act Rule 203A-2(e)(iii).

30

B. Discretionary Investment Advisory Programs

The staff reviewed the use of discretionary investment advisory programs (“programs”) by more 

than two dozen advisers under the eIA Initiative. During these examinations, the staff assessed 

whether the programs provided each retail client with individualized treatment and enabled clients 

to maintain certain indicia of ownership of the securities in their accounts as required for reliance on 

Company Act Rule 3a-4. Where compliance with Rule 3a-4 was not specified or observed, the staff 

reviewed whether alternative measures that addressed their status under the Company Act were 

being employed. The staff also examined whether advisers had adequate disclosures about the 

programs that addressed implications under the Company Act and had adopted and implemented

effective written policies and procedures to address the provisions of Rule 3a-4 or any alternative 

measures employed to address Company Act status questions.

• Reliance on the nonexclusive safe harbor provisions of Rule 3a-4. Advisers recommending 

programs commonly provided the same or similar investment advice on a discretionary basis to 

a large number of their advisory clients, frequently using asset allocation portfolios that they, an 

affiliate, or a third-party created. Often, these advisers:

o Were unaware that the programs they sponsored or operated may be unregistered investment 

companies. Many had clients with similar investment objectives that received the exact 

same investment advice, were placed in the same model portfolio, and invested identically 

as other clients. Some advisers recognized these issues and claimed reliance on Rule 3a-4, 

but others neither specifically claimed reliance on Rule 3a-4 nor claimed to be employing 

any alternative measures.31

o Claimed that programs they sponsored or operated were relying on Rule 3a-4, but the 

programs or adviser did not comply with all of the provisions of the safe harbor. Many

advisers had compliance policies and procedures that were inadequate in addressing 

adherence with Rule 3a-4, were not implemented, or both. Advisers that sponsor or operate 

discretionary investment advisory programs that are relying on the safe harbor afforded 

under Rule 3a-4 should adopt compliance policies and procedures that are reasonably 

designed to validate that such programs are, in fact, consistent with the Rule’s provisions.32

 30 See Investment Management No-Action Letter to Richard Ellis, Inc. (Mar. 18, 1981) and Exemptions for Advisers to Venture 

Capital Funds, Private Fund Advisers With Less Than $150 Million in Assets Under Management, and Foreign Private 

Advisers, Advisers Act Rel. No. 3222 (Jun. 22, 2011) (discussing principles of adviser integration and applicability of Advisers 

Act Section 208(d)). See also supra IA-2091 at note 1 (Internet advisers cannot rely on the Internet adviser exemption as their 

basis for registration with the Commission if another adviser in a control relationship with them relies on the Internet adviser’s 

Internet adviser registration as the basis for its own registration under Advisers Act Rule 203A-2(b), the “related adviser” 

exemption).

31 See supra Adopting Release at note 2 (Rule 3a-4 does not create any presumption about a program that does not meet the rule’s 

provisions).

32 See supra Adopting Release at note 2 (“Each person relying on [R]ule 3a-4 is responsible for demonstrating its compliance with 

the [R]ules’ provisions... The Commission... strongly recommends that a sponsor of an advisory program seeking to rely on 
10

• Establishing client accounts. To rely on Rule 3a-4, sponsors or another person designated by a 

sponsor (e.g., the adviser recommending the program) must obtain information from each client 

regarding the client’s financial situation and investment objectives and inquire as to whether the 

client wishes to impose any reasonable restrictions on the management of the client’s account. 

This information must be obtained at the opening of the account and updated periodically 

thereafter. Advisers observed not complying with these provisions: 

o Used questionnaires to gather information pertinent to providing individualized advice that

included a very limited number of data points, potentially increasing the risk of not 

providing clients with individualized advice or acting in their clients’ best interests.33

o Did not allow clients to impose reasonable restrictions, or placed obstacles impeding their 

ability to do so. Many advisers engaged in practices that were inconsistent with this Rule 

3a-4 requirement, which allows clients to designate particular securities or types of 

securities that should not be purchased or that should be sold if held. Some advisers 

expressly prohibited the imposition of any restrictions, while others appeared to impede 

clients from imposing reasonable restrictions. Examples include advisers that:

 Required the selection of a different model portfolio if any restrictions were requested, 

established unduly restrictive requirements (e.g., investment thresholds that very few 

clients likely would attain, or only allowed specific securities), or warned of negative 

consequences that may result from applying restrictions (without further explanation). 

 Did not disclose to clients, or did not disclose adequately, that they could impose 

reasonable restrictions on the management of their accounts or provided inaccurate or 

insufficient information regarding the client’s ability to impose such restrictions. 

• Ongoing communications. An adviser relying on the safe harbor must contact each client at 

least annually to: (1) update the client’s financial situation or investment objectives; and 

(2) determine if the client wishes to impose any reasonable restrictions on the management of 

the client’s account or reasonably modify existing restrictions. In addition, at least quarterly, an 

adviser must provide its clients with written notification to contact the adviser with any changes 

to such information. The adviser (or sponsor) also is required to make a person sufficiently 

knowledgeable about the account and its management reasonably available to the client for 

consultation. The staff observed issues with advisers meeting these requirements, including 

instances where advisers:

o Did not request with the required frequency information regarding clients’ financial 

situations and investment objectives. Many advisers did not satisfy the Rule’s quarterly 

notification provision, as they contacted clients only once or twice per year. Nevertheless, 

 [R]ule 3a-4 establish and implement written policies and procedures, and a system for applying such procedures, that are 

reasonably designed to ensure that the program operates in the manner contemplated by the rule.”).

33 Questionnaires varied greatly in the quantity and quality of information requested. Such advisers generally offered a very small 

set of responses from which a client could choose. Commonly requested investment profile data points include items such as 

age, income, retirement status, and investment goals. See also Section III.A. Portfolio management – oversight observations.
11

most of the communications were in writing and indicated how clients should convey 

changes to the adviser.

o Did not communicate with clients about their ability to impose new, or modify existing, 

reasonable restrictions. Many advisers did not provide written notice to their clients at least 

quarterly, or contact their clients at least annually, regarding the client’s ability to add or 

change reasonable restrictions on their accounts.34 

o Provided clients with limited or no access to advisory personnel knowledgeable about the 

account and its management. Advisers sometimes limited client communication to technical 

support (e.g., navigating the adviser’s website) and general customer service support (e.g., 

directing investors to educational materials). At firms where advisers made advisory 

personnel available to clients to address this Rule provision, there generally were access 

limitations or restrictions. For example, only clients who met certain account size thresholds 

were eligible for these services.

• Account statements. Rule 3a-4 requires the sponsor of a discretionary investment advisory 

program, or a person designated by the sponsor, to provide each client with a statement, at least 

quarterly, that contains certain information. The staff observed general compliance with this 

provision.

• Client rights. Rule 3a-4 provides for the retention by clients of certain indicia of ownership, to 

the same extent as if the clients held the securities and funds outside of the discretionary 

investment advisory program. However, the staff observed advisers that:

o Restricted their clients’ ability to withdraw cash or securities from their accounts. For 

example, some advisers limited the types of permitted withdrawals (e.g., cash-only). 

o Did not allow clients to vote proxies or to delegate that right to a third-party for any or all 

securities, or required clients to request this right. 

o Appeared not to ensure that clients were being sent legally required documents (e.g., trade 

confirmations and prospectuses). 

o Did not allow clients to have the legal right to proceed, directly as a security holder, against 

the issuer of any security in the client’s account, as prescribed in Rule 3a-4.

III. Staff Observations on Ways to Improve Compliance 

Due to the assorted advisers included in the eIA Initiative, the staff observed a wide range of 

compliance practices. As a result, while not all of the practices noted below may be universally 

applicable, they may assist advisers in developing and maintaining adequate and effective policies 

and procedures under the Compliance Rule. 

• Adopting, implementing, and following written policies and procedures that are tailored to the 

adviser’s practices. Advisers cited for compliance program-related deficiencies often had 

 34 Compliant advisers contacted clients and also indicated how clients should convey their requests to the adviser.
12

multiple deficiencies across more than one category (e.g., disclosure, marketing, or portfolio 

management). Conversely, advisers with compliance programs that appeared to be adequate 

and effective were not cited for deficiencies related to: (1) portfolio management (e.g., best 

interest advice, best execution, and practices being inconsistent with disclosures); (2) custody;

and (3) books and records. Such advisers also rarely had deficiencies related to marketing,

performance advertising, or billing practices.

• Testing algorithms periodically to ensure that they are operating as expected. At advisers 

where algorithm-related testing was performed at least quarterly, the staff observed the 

following practices:

o Testing frequently was performed by the advisers’ algorithm designers/software developers, 

but rarely in isolation. Most included one or more other groups in their testing process, such 

as portfolio management, compliance, internal audit, and information technology (“IT”) 

staff.

o Where compliance was included in the process, compliance staff performed independent 

testing and also relied on work performed by others. 

o Exception reports or other reporting mechanisms commonly were used and frequently 

involved a combination of high-level and account-specific results. Reports often were 

reviewed by algorithm designers/software developers and compliance staff, but many firms 

also had portfolio management staff and/or IT staff review them.

• Safeguarding algorithms. Most advisers employed safeguards to prevent unauthorized 

algorithm changes, such as exclusively limiting code access to certain persons and providing 

compliance staff with advance notice of substantive algorithm changes or overrides (usually 

during the development process). Advisers using white-label platforms generally could not 

modify the platform’s underlying code but reported that platform providers would notify them 

of changes.

IV. Conclusion

The examinations conducted within the scope of this review resulted in a range of actions. In 

response to the staff’s observations, some advisers elected to amend disclosures and marketing 

materials, modify or eliminate performance advertisements, revise compliance policies and 

procedures, improve data protection practices, and/or change other practices.

The Division encourages advisers providing electronic investment advice to review their portfolio 

management practices and related disclosures; performance advertising and marketing materials; 

and written policies and procedures, including the implementation and testing of those policies and 

procedures, to ensure that they are consistent with the Advisers Act and the rules thereunder, as well 

as other federal securities laws, as applicable. Advisers relying on the Internet adviser exemption 

also are encouraged to review their registration eligibility.

The Division encourages advisers that recommend discretionary investment advisory programs to 

assess whether clients are being provided with individualized advice and whether sufficient policies, 
13

procedures, and practices are being employed to prevent such programs from being deemed 

unregistered investment companies and securities.

This Risk Alert is intended to highlight for firms risks and issues that the Division’s staff has identified. In 

addition, this Risk Alert describes risks that firms may consider to (1) assess their supervisory, compliance, 

and/or other risk management systems related to these risks, and (2) make any changes, as may be 

appropriate, to address or strengthen such systems. Other risks besides those described in this Risk Alert 

may be appropriate to consider, and some issues discussed in this Risk Alert may not be relevant to a 

particular firm’s business. The adequacy of supervisory, compliance and other risk management systems 

can be determined only with reference to the profile of each specific firm and other facts and circumstances.