1

By the Office of Compliance Inspections and Examinations1

Volume VI, Issue 3 February 7, 2017

The Five Most Frequent Compliance Topics 

Identified in OCIE Examinations of Investment Advisers

I. Introduction

The Office of Compliance Inspections and Examinations (“OCIE”) is providing a 

list of the five compliance topics most frequently identified in deficiency letters

that were sent to SEC-registered investment advisers (“advisers”).

2 Within each of 

these topics, a few examples of typical deficiencies are discussed to highlight the 

risks and issues that examiners commonly identified. The five compliance topics

addressed in this Risk Alert are deficiencies or weaknesses involving: (1) Rule 

206(4)-7 (the “Compliance Rule”) under the Investment Advisers Act of 1940 (the 

“Advisers Act”); (2) required regulatory filings; (3) Rule 206(4)-2 under the 

Advisers Act (the “Custody Rule”); (4) Rule 204A-1 under the Advisers Act (the 

“Code of Ethics Rule”); and (5) Rule 204-2 under the Advisers Act (the “Books 

and Records Rule”).

3

 This information is intended to assist advisers during their 

compliance reviews.

II. Five Most Frequent Compliance Topics

Compliance Rule

The Compliance Rule makes it unlawful for an adviser to provide investment advice to clients unless the 

adviser: (1) adopts and implements written policies and procedures reasonably designed to prevent 

violation, by the adviser and its supervised persons, of the Advisers Act and the rules that the 

Commission has adopted under the Advisers Act; (2) reviews, no less frequently than annually, the 

adequacy of its policies and procedures and the effectiveness of their implementation; and (3) designates

 

1

The views expressed herein are those of the staff of OCIE. The Securities and Exchange Commission (the 

“SEC” or the “Commission”) has expressed no view on the contents of this Risk Alert. This document was 

prepared by SEC staff and is not legal advice.

2 This Risk Alert reflects issues addressed in deficiency letters from over 1,000 investment adviser examinations

that were completed during the past two years. Generalizations in this Risk Alert refer to observations within 

this sample of examinations. 

3

 This Risk Alert does not discuss other types of deficiencies or weaknesses that are cited less frequently in 

examinations but may result in significant harm to investors.

In this Alert: 

Topic: The five most 

frequent compliance 

topics identified in 

deficiency letters sent 

to SEC-registered 

investment advisers.

Key Takeaways:

Advisers should 

review their 

compliance 

programs and 

practices in light of 

the topics noted in 

this Risk Alert.
2

a chief compliance officer responsible for administering the compliance policies and procedures that the 

adviser adopts.4

Below are typical examples of deficiencies or weaknesses in connection with the Compliance Rule 

identified by the staff:

5

 

● Compliance manuals are not reasonably tailored to the adviser’s business practices. The staff 

noted that certain compliance programs did not take into account important individualized

business practices such as the adviser’s particular investment strategies, types of clients, trading 

practices, valuation procedures and advisory fees. Moreover, examiners continue to observe that 

some advisers use “off-the-shelf” compliance manuals that have not been tailored to the adviser’s 

individual business practices.

● Annual reviews are not performed or did not address the adequacy of the adviser’s policies and 

procedures. The staff observed that certain advisers did not conduct annual reviews of their

compliance policies and procedures, as required by the Compliance Rule. In addition, the staff 

identified advisers that conducted annual reviews that did not address the adequacy of the 

advisers’ policies and procedures and the effectiveness of their implementation. Staff also 

observed that advisers did not address or correct problems identified in their annual reviews.

● Adviser does not follow compliance policies and procedures. The staff observed that certain 

advisers appeared to not be following their compliance policies and procedures, as required by the 

Compliance Rule. Examples include advisers that do not perform certain internal reviews of their

practices required by their compliance manual and advisers that do not adhere to certain practices 

relating to marketing, expenses or employee behavior required by their compliance manual.

● Compliance manuals are not current. The staff noted that certain compliance manuals contained 

information or policies that are no longer current, such as investment strategies that were no longer 

pursued or personnel no longer associated with the adviser and stale information about the firm.

Regulatory Filings

Advisers are obligated to accurately complete and timely file certain regulatory filings with the 

Commission. Among other filing requirements, Rule 204-1 under the Advisers Act requires advisers to 

amend their Form ADV at least annually, within 90 days of the end of their fiscal year and more 

frequently, if required by the instructions to Form ADV. Rule 204(b)-1 under the Advisers Act requires 

advisers to one or more private funds with private fund assets of at least $150 million to complete and file 

a report on Form PF. In addition, Rule 503 under Regulation D of the Securities Act of 1933 generally 

requires issuers to file Form Ds. Advisers typically file Form Ds on behalf of their private fund clients. 

Generally, Form D is required to be filed no later than 15 calendar days after the first sale of securities in 

the offering of a private fund.

Below are typical examples of deficiencies or weaknesses with respect to adviser regulatory filing 

obligations identified by the staff: 

 

4 Advisers Act Rule 206(4)-7. See Compliance Programs of Investment Companies and Investment Advisers,

Advisers Act Rel. No. IA-2204 (Dec. 17, 2003).

5 The examples in this Risk Alert are illustrative only and do not reflect all types of deficiencies or weaknesses.
3

● Inaccurate disclosures. The staff observed that certain advisers made inaccurate disclosures on 

Form ADV Part 1A or in Form ADV Part 2A brochures, such as inaccurately reporting custody 

information, regulatory assets under management, disciplinary history, types of clients and

conflicts.

● Untimely amendments to Form ADVs. The staff observed that certain advisers did not promptly 

amend their Form ADVs when certain information became inaccurate or timely file their annual 

updating amendments. 

● Incorrect and untimely Form PF filings. The staff observed that certain advisers with an 

obligation to file Form PF did not complete the form accurately or completely.

● Incorrect and untimely Form D filings. The staff observed that certain advisers did not accurately 

complete and timely file Form Ds on behalf of their private fund clients.

Custody Rule

Advisers with custody of client cash or securities must comply with the Custody Rule.6 An adviser has 

custody if it or its related person holds, directly or indirectly, client funds or securities or has any 

authority to obtain possession of them.7 For example, an adviser that serves as the general partner, 

managing member or other comparable position of a pooled investment vehicle (“PIV”) generally has 

custody of client assets because the position typically gives legal ownership or access to client funds and 

securities.8 An adviser also has custody if it has an arrangement under which it is authorized or permitted 

to withdraw client funds or securities.9 The Custody Rule prescribes a number of requirements designed 

to enhance the safety of client assets by protecting them from unlawful activities or financial problems of 

the adviser.10 

Below are typical examples of deficiencies or weaknesses with respect to the Custody Rule identified by 

the staff: 

● Advisers did not recognize that they may have custody due to online access to client accounts. An 

adviser’s online access to client accounts may meet the definition of custody when such access 

provides the adviser with the ability to withdraw funds and securities from the client accounts.

The staff observed that certain advisers may not have properly identified custody as a result of 

them having access to online accounts using clients’ personal usernames and passwords. 

● Advisers with custody obtained surprise examinations that do not meet the requirements of the 

Custody Rule. The staff observed that certain advisers did not provide independent public 

 

6 Advisers Act Rule 206(4)-2. See Custody of Funds or Securities by Investment Advisers, Advisers Act Rel. 

No. 2968 (Dec. 30, 2009).

7 Advisers Act Rule 206(4)-2(d)(2). 

8 Advisers Act Rule 206(4)-2(d)(2)(iii). 

9 Advisers Act Rule 206(4)-2(d)(2)(ii).

10 Advisers Act Rule 206(4)-2. For more information regarding Custody Rule issues that have been observed 

during OCIE examinations in the past, please see Significant Deficiencies Involving Custody and Safety of 

Client Assets, OCIE Risk Alert (March 4, 2013).
4

accountants performing surprise examinations with a complete list of accounts over which the 

adviser has custody or otherwise provide information to accountants to permit the accountants to 

timely file accurate Form ADV-Es. In addition, staff observed indications suggesting that 

surprise examinations may not have been conducted on a “surprise” basis (e.g., exams were 

conducted at the same time each year).

● Advisers did not recognize that they may have custody as a result of certain authority over client 

accounts. The staff observed that certain advisers did not appear to recognize that they may have 

custody over client accounts as a result of having (or related persons having) powers of attorney 

authorizing them to withdraw client cash and securities. Other examples of custody that appeared 

unrecognized include when advisers or their related persons served as trustees of clients’ trusts or 

general partners of client PIVs.

Code of Ethics Rule

The Code of Ethics Rule requires an adviser to adopt and maintain a code of ethics.11 The Code of Ethics 

Rule sets forth a number of requirements, including that each adviser’s code of ethics must: (1) establish a 

standard of business conduct that the adviser requires of all its supervised persons; (2) require an adviser’s 

“access persons” to periodically report their personal securities transactions and holdings to the adviser’s 

chief compliance officer or other designated persons; and (3) require that access persons obtain the 

adviser’s pre-approval before investing in an initial public offering or private placement. In addition, an 

adviser must provide each supervised person with a copy of the code of ethics and any amendments, and 

require their supervised persons to provide the adviser with a written acknowledgement of their 

receipt. An adviser also must describe its code of ethics in its Form ADV Part 2A brochure and indicate 

that the code of ethics is available to any client or prospective client upon request.

12

Below are typical examples of deficiencies or weaknesses with respect to the Code of Ethics Rule 

identified by the staff: 

● Access persons not identified. The staff observed that certain advisers did not identify all of their 

access persons (e.g., certain employees, partners or directors) for purposes of reviewing personal 

securities transactions. 

● Codes of ethics missing required information. The staff observed that certain advisers’ codes of 

ethics did not specify review of the holdings and transactions reports, or did not identify the 

specific submission timeframes, as required by the Code of Ethics Rule.

● Untimely submission of transactions and holdings. The staff observed that certain access persons 

submitted transactions and holdings less frequently than required by the Code of Ethics Rule. 

● No description of code of ethics in Form ADVs. The staff observed that certain advisers did not 

describe their codes of ethics in their Part 2A of Form ADVs and did not indicate that their codes 

of ethics are available to any client or prospective client upon request.

 

11 Advisers Act Rule 204A-1. See Investment Adviser Code of Ethics, Advisers Act Rel. No. IA-2256 (July 2, 

2004).

12 See Item 11A of Form ADV, Part 2A.
5

Books and Records Rule

The Books and Records Rule requires advisers to make and keep certain books and records relating to 

their investment advisory business, including typical accounting and other business records as required by 

the Commission.

13

Below are typical examples of deficiencies or weaknesses with respect to the Books and Records Rule 

identified by the staff: 

● Did not maintain all required records. The staff observed that certain advisers may not have 

maintained all the books and records required by the Books and Records Rule, such as trade 

records, advisory agreements and general ledgers.

● Books and records are inaccurate or not updated. The staff observed that certain advisers had 

errors and omissions in their books and records, such as inaccurate fee schedules and client 

records or stale client lists.

● Inconsistent recordkeeping. The staff observed that certain advisers maintained contradictory 

information in separate sets of records.

III. Conclusion 

The examinations within the scope of this review resulted in a range of actions. Advisers took remedial 

measures such as enhancing written compliance procedures, policies or processes, changing business 

practices or devoting more resources or attention to the area of compliance. In addition, where 

appropriate, the staff referred examinations to the Division of Enforcement for further action. 

In sharing the information in this Risk Alert, OCIE hopes to encourage advisers to reflect upon their own 

practices, policies and procedures in these areas and to promote improvements in investment adviser 

compliance programs.

 

13

 Advisers Act Rule 204-2.

This Risk Alert is intended to highlight for firms risks and issues that the staff has identified. In addition, this Risk Alert 

describes risks that firms may consider to (i) assess their supervisory, compliance, and/or other risk management 

systems related to these risks, and (ii) make any changes, as may be appropriate, to address or strengthen such systems. 

Other risks besides those described in this Risk Alert may be appropriate to consider, and some may not be applicable to

a particular firm’s business. The adequacy of supervisory, compliance and other risk management systems can be 

determined only with reference to the profile of each specific firm and other facts and circumstances.