Compliance Rule
Rule 206(4)-7 · 17 CFR 275.206(4)-7
Compliance procedures and practices
Read the current text at the source ↗Guide: Solo Adviser Compliance from A to Z
Guide: What Is MNPI? Material Non-Public Information for Investment Advisers
Guide: How to Register as an RIA: SEC or State Registration, Form ADV and Timeline
Guide: The RIA Chief Compliance Officer: Duties, Authority and Liability
Guide: AI Compliance for Investment Advisers: AI Washing, Marketing Claims, Records and Vendors
Guide: Off-Channel Communications for Investment Advisers: Texting, WhatsApp and Recordkeeping
Guide: Code of Ethics Requirements for RIAs: Rule 204A-1 Explained
Guide: Gifts and Entertainment Policy for Investment Advisers
Guide: Outside Business Activities for Investment Adviser Representatives
Guide: The Fiduciary Duty of Investment Advisers: Care, Loyalty and Disclosure
Guide: The SEC Pay-to-Play Rule for Investment Advisers: Rule 206(4)-5
Guide: Books and Records Requirements for Investment Advisers (Rule 204-2)
Guide: Annual Compliance Review Checklist for Investment Advisers
Guide: Cybersecurity for RIAs: What the SEC Expects of Investment Advisers
Guide: How to Respond to an SEC Deficiency Letter
- Applies to
- SEC-registered investment adviser
- Effective
- February 5, 2004
- Compliance date
- October 5, 2004
- Last amended
- November 19, 2024
About that amendment date
The November 2024 amendment removed a requirement rather than adding one. The Private Fund Advisers rulemaking (88 FR 63386, 14 September 2023) had amended paragraph (b) to require that the annual review be documented in writing. The Fifth Circuit vacated that rulemaking in full on 5 June 2024, and the Commission adopted technical amendments at 89 FR 91252 (Release IA-6773, effective 19 November 2024) restoring paragraph (b) to its original wording and removing the private fund rules it had added, including rules 206(4)-9 and 206(4)-10. So there is no standalone requirement to document the annual review in writing. Rule 204-2(a)(17)(ii) still requires an adviser to keep any records that do document the review, which is a retention obligation on records made, not an obligation to make them.
What the rule says
A description of the source text.
Three obligations in one short rule. An adviser must adopt and implement written policies and procedures reasonably designed to prevent violation of the Act by the adviser and its supervised persons; review their adequacy and the effectiveness of their implementation no less frequently than annually; and designate a supervised person as chief compliance officer to administer them. Adopted at 68 FR 74730 (24 December 2003).
What it requires
Luna's plain-English reading, not the Commission's words.
- 01Written policies and procedures, reasonably designed for this adviser's actual conflicts and business, not a template.
- 02A review at least once every twelve months covering both whether the policies are adequate and whether they were followed.
- 03A designated chief compliance officer who is a supervised person and has the authority to administer the program.
What examiners find
Luna's observations, not a Commission publication.
- An annual review that happened but left no record of what was tested or what was found.
- Policies describing a business the adviser no longer runs, or conflicts it no longer has.
- A CCO title given to someone without the seniority or time to administer the program.
Topics
Source last checked against the regulator's copy on October 14, 2026. That date is written by an automated check, not by hand.
Luna Compliance is software, not a law firm. This page is not legal advice and reading it creates no attorney-client relationship. Where this page and the regulator's copy differ, the regulator's governs.