The written policies, annual review and chief compliance officer the compliance rule demands, which advisers it covers and how it fits with the code of ethics and records rules

Rule 206(4)-7 requires every SEC-registered investment adviser to do three things: adopt and implement written compliance policies and procedures, review them at least once a year, and designate a chief compliance officer to run the program. Together these make up what is usually called the compliance rule.

The policies must be reasonably designed to prevent the adviser and its supervised persons from violating the Investment Advisers Act of 1940 and the SEC’s rules under it. The FRC dictionary entry on SEC Rule 206(4)-7 sets out the rule in brief, and this guide explains what each requirement means in practice.

It covers who the rule applies to, the three requirements in detail, what the policies should address, the role of the chief compliance officer, the records an adviser must keep, how the rule connects with the code of ethics and the other adviser rules, worked examples, the exam traps and five practice questions.

Why the Compliance Rule Exists

Before the rule was adopted, the SEC had no general requirement for advisers to maintain a compliance program. Many firms had one, but others relied on informal practices that broke down as they grew.

The rule followed the mutual fund trading scandals of 2003, in which some fund managers allowed favored clients to trade in ways that harmed ordinary fund investors. The SEC adopted Rule 206(4)-7 for advisers, alongside Rule 38a-1 for investment companies, in December 2003, with compliance required from October 2004.

The aim was to make compliance a permanent, structured function inside every registered adviser. Rather than reacting to problems after they surfaced, firms would be expected to identify their risks in advance and put controls around them.

Where This Topic Appears on the Exams

The compliance rule is tested in the laws and regulations section of the Series 65, and it also appears on the Series 66. Questions usually ask how often the policies must be reviewed, who must be appointed to administer them, or which advisers the rule applies to.

FRC’s Series 65 Exam Preparation course covers the compliance rule alongside the other Advisers Act rules, chapter by chapter, and the Series 65 needs no sponsoring firm. The SIE Examination Preparation course introduces the regulatory framework that compliance programs are built around.

Every FRC course can be spread across interest-free monthly payments, so cost is no reason to delay. Compliance rule questions turn on a few fixed points, so they are quick marks once those points are learned.

Who the Rule Applies To

Rule 206(4)-7 applies to investment advisers registered with the SEC. It is a rule under Section 206(4) of the Advisers Act, the section that allows the SEC to define and prevent fraudulent, deceptive or manipulative practices.

State-registered advisers are not subject to Rule 206(4)-7 itself. They follow their own state’s rules, which typically include supervision, books and records, and ethical conduct requirements, and NASAA has published guidance to help smaller advisers build compliance procedures.

Exempt reporting advisers, such as advisers solely to venture capital funds, are also outside the rule because they are not registered with the SEC. FRC’s guide to what a registered investment adviser is explains which advisers register with the SEC and which register with the states.

Requirement One: Written Policies and Procedures

The adviser must adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules. Both words carry weight: a manual that sits on a shelf and is never followed does not satisfy the rule.

The policies must be tailored to the adviser’s own business. The SEC expects each firm to identify the conflicts and compliance risks created by its particular operations, and then design procedures that address those risks.

A small adviser with a handful of clients and a simple strategy will have shorter, simpler policies than a large firm running many strategies and funds. What the rule requires is that the policies fit the business, not that they reach a particular length.

What the Policies Should Cover

When it adopted the rule, the SEC listed areas that most advisers’ policies should address, to the extent they are relevant. These include portfolio management, such as making sure investments match each client’s objectives, the adviser’s disclosures and any client restrictions.

The list also includes trading practices, such as best execution, the use of client commissions to pay for research and the fair allocation of trades among clients. Proprietary trading by the adviser and personal trading by its staff are covered too.

Other areas are the accuracy of disclosures to clients and regulators, the safeguarding of client assets, recordkeeping, marketing, the valuation of client holdings and the calculation of fees, the privacy of client records, and business continuity planning. An adviser with custody, for example, needs procedures built around the custody rule, which FRC’s guide to what custody is for an investment adviser explains.

Requirement Two: The Annual Review

The adviser must review its policies and procedures at least annually to assess their adequacy and the effectiveness of their implementation. The review asks two questions: are the policies still the right ones, and are they actually being followed?

The annual review should consider any compliance issues that arose during the year, any changes in the adviser’s business, and any changes in the law. A new product line, a merger or a new SEC rule will each usually require the policies to be updated.

Annual is the minimum, not the target. The SEC expects advisers to consider interim reviews when significant events occur, rather than waiting a full year to respond to a problem.

Requirement Three: The Chief Compliance Officer

The adviser must designate a chief compliance officer, usually called the CCO, who is responsible for administering the policies and procedures. The CCO must be a supervised person of the adviser, which includes employees and, in some cases, outside individuals acting under the adviser’s supervision.

The SEC expects the CCO to be competent and knowledgeable about the Advisers Act. The CCO must also be empowered, with full responsibility and authority to develop and enforce appropriate policies, and with enough seniority to compel others in the firm to follow them.

The CCO’s name is disclosed to regulators on Form ADV. In a small firm, the CCO may also hold other roles, including owner or portfolio manager, provided they can carry out the compliance function properly.

The CCO in a Small Firm

Many small advisers appoint their founder or a senior partner as CCO. This is permitted, but it creates a conflict, because the CCO is then reviewing their own conduct.

Some small firms address this by hiring an outside compliance consultant to support the CCO or to act as the CCO. The SEC permits outsourcing, but has warned that an outsourced CCO must still be sufficiently knowledgeable about the firm, sufficiently present in its business and sufficiently empowered to do the job.

Whatever the arrangement, the responsibility for compliance remains with the adviser. Appointing a CCO does not transfer the firm’s legal obligations to that individual.

Records the Adviser Must Keep

Under the SEC’s books and records rule, Rule 204-2, an adviser must keep a copy of the compliance policies and procedures that are in effect, or were in effect at any time in the past five years. It must also keep records documenting its annual reviews.

These records are among the first documents SEC examiners request when they examine an adviser. An adviser that cannot show written policies or evidence of its annual review is likely to receive a deficiency finding straight away.

The general retention period for adviser records is five years from the end of the fiscal year in which the last entry was made, with the first two years in an easily accessible place. FRC’s guide to Form ADV covers the related filing obligations.

The Code of Ethics Rule

The compliance rule works alongside a separate requirement, Rule 204A-1, which requires SEC-registered advisers to adopt a written code of ethics. The code sets standards of business conduct and requires compliance with the federal securities laws.

The code must require access persons, the staff with access to client trading information, to report their personal securities holdings when they join and annually after that, and to report their personal transactions quarterly. Access persons must also obtain approval before buying securities in an initial public offering or a private placement.

The compliance program is what makes the code effective in practice. The CCO or a designated reviewer checks the personal trading reports against client trading to spot front-running and other conflicts.

How the Rule Connects to the Fiduciary Duty

An investment adviser owes its clients a fiduciary duty, made up of a duty of care and a duty of loyalty. The compliance program is the practical machinery that helps the adviser meet that duty every day.

Policies on best execution, trade allocation and personal trading, for example, protect the duty of loyalty by preventing the adviser from favoring itself or some clients over others. Policies on suitability and portfolio management support the duty of care.

FRC’s guide to duty of care vs duty of loyalty explains the two components in full. The guide to what conflicts of interest an investment adviser must disclose covers the disclosures the compliance program must keep accurate.

How the Rule Fits With the Other 206(4) Rules

Rule 206(4)-7 sits among a group of rules under Section 206(4), each aimed at a particular risk. These include the custody rule, Rule 206(4)-2, and the marketing rule, Rule 206(4)-1.

The compliance rule is the one that ties the others together. Each specific rule sets an obligation, and the compliance program is how the adviser makes sure it meets every one of them.

That is why a failure under another rule often leads to a charge under Rule 206(4)-7 as well. If an adviser breaches the custody rule, for example, the SEC may also find that its compliance policies were not reasonably designed or not properly implemented.

The Parallel Rule for Funds

Registered investment companies have their own version of the rule, Rule 38a-1 under the Investment Company Act of 1940. It requires each fund to adopt compliance policies covering the fund and its key service providers, including its adviser.

Under Rule 38a-1, the fund’s board, including a majority of independent directors, must approve the policies and the appointment of the fund’s chief compliance officer. The CCO reports to the board at least annually.

The exam occasionally contrasts the two rules. Rule 206(4)-7 applies to the adviser, and Rule 38a-1 applies to the fund.

The Advisers Act Rule vs FINRA Supervision

Broker-dealers have a different supervisory regime. Under FINRA Rule 3110, each member firm must maintain a supervisory system with written procedures and designated principals.

The two regimes share an idea, that a firm must have written procedures and someone responsible for enforcing them, but they come from different sources. Rule 206(4)-7 is an SEC rule for advisers, while Rule 3110 is a FINRA rule for broker-dealers.

Dual registrants must meet both. A firm that is both a broker-dealer and an investment adviser maintains a FINRA supervisory system for its brokerage business and an Advisers Act compliance program for its advisory business.

What Happens When the Program Fails

The SEC brings enforcement actions under Rule 206(4)-7 where an adviser has no written policies, where its policies do not fit its business, or where it fails to follow them. Sanctions can include censure, fines and requirements to hire an independent compliance consultant.

Chief compliance officers are rarely charged personally. Where they have been, the cases have generally involved a CCO who took part in misconduct, misled regulators or wholly failed to carry out their responsibilities.

A failed annual review is often a sign of deeper problems. Examiners treat a missing or superficial review as evidence that compliance is not being taken seriously across the firm.

Worked Example: The Growing Adviser

A small SEC-registered adviser launches a private fund alongside its separately managed accounts. Its compliance manual was written when it managed only individual accounts.

The new fund creates fresh risks, including conflicts in allocating trades between the fund and individual clients, valuation of fund holdings and custody of fund assets. The adviser must update its policies to address them, rather than waiting for its next annual review.

If the adviser kept using its old manual, its policies would no longer be reasonably designed for its business. That would be a violation of Rule 206(4)-7 even if no client had yet been harmed.

Worked Example: The Missing Review

During an examination, an SEC-registered adviser shows examiners a detailed compliance manual. When asked for records of its annual reviews, it has none for the past three years.

The adviser has met the first requirement but not the second. Without documented annual reviews, it cannot show that it assessed whether its policies were adequate and being followed.

Examiners would expect the adviser to carry out and document a review promptly, and to explain how it will hold future reviews on time. Repeated failures could lead to enforcement action.

Worked Example: The State-Registered Adviser

A small adviser with $40 million in assets under management is registered with its home state. A new employee asks whether the firm must comply with Rule 206(4)-7.

The answer is no, because the rule applies to SEC-registered advisers. The firm must instead follow its state’s rules, which will typically still require written supervisory procedures, books and records, and ethical conduct standards.

If the firm grew past the SEC registration threshold and moved to SEC registration, Rule 206(4)-7 would then apply. It would need to have its policies, annual review process and CCO in place.

The Exam Traps

The first trap is the review frequency. The rule requires a review at least annually, not quarterly or every two years.

The second trap is assuming the rule applies to state-registered advisers. Rule 206(4)-7 applies to SEC-registered advisers only.

The third trap is assuming the CCO must be a separate, full-time officer. In a small firm the CCO can hold other roles, including owner, as long as they are competent and empowered.

The fourth trap is confusing Rule 206(4)-7 with the code of ethics rule. The compliance rule requires policies, a review and a CCO, while Rule 204A-1 requires the code of ethics and personal trading reports.

FRC’s guide to Series 65 ethics and laws questions and exam traps covers more traps in this area. For the full list, see FRC’s guide to Series 65 exam traps and common mistakes.

A Memory Aid

Remember “write it, review it, appoint someone to run it.” Written policies, an annual review and a chief compliance officer are the three requirements.

To keep the related rules apart, remember “206(4)-7 is the program, 204A-1 is the code, 204-2 is the records.” Each rule answers a different question about how an adviser runs compliance.

Practice Questions

Question one: how often must an SEC-registered adviser review its compliance policies under Rule 206(4)-7? At least annually.

Question two: does Rule 206(4)-7 apply to state-registered investment advisers? No, it applies to SEC-registered advisers.

Question three: what officer must an adviser designate under Rule 206(4)-7? A chief compliance officer responsible for administering the policies and procedures.

Question four: may the owner of a small advisory firm serve as its chief compliance officer? Yes, provided they are competent, knowledgeable about the Advisers Act and empowered to enforce the policies.

Question five: for how long must an adviser keep copies of its compliance policies? Policies in effect at any time in the past five years must be kept.

Related Questions

Compliance roles are a common career path for people with a Series 65 or Series 66. FRC’s guide to investment advisor representative vs registered investment adviser explains how the individual and the firm fit together.

Get Exam-Ready

Compliance rule questions reward candidates who know the three requirements and the advisers they apply to. Once “write it, review it, appoint someone to run it” is fixed, these become some of the quickest marks on the exam.

The FRC dictionary is more than a dictionary. It is a library of explainer videos, written explanations and on-page quizzes covering the FINRA and SEC rules you are tested on, so you can open any term and go deeper whenever a question catches you out.

Study With FRC

FRC’s programs and memberships are open to everyone. Whether you are preparing for the Series 65, the Series 7, the SIE or a combination, structured exam preparation turns topics like the compliance rule into marks you can rely on.

FRC’s Professional Membership adds verified progress and a Digital Profile, so when you apply for advisory or compliance roles, hiring managers can see your exam progress and the knowledge you are building, not just read about it on a resume.

Your Next Step

Rule 206(4)-7 requires every SEC-registered investment adviser to adopt and implement written compliance policies, review them at least annually and designate a chief compliance officer to administer them. The policies must be tailored to the adviser’s business and kept, along with records of each annual review, for five years.

Remember “write it, review it, appoint someone to run it,” and you will be ready for every version of this question the exam can ask.