Annual compliance review checklist for investment advisers

Rule 206(4)-7(b) requires every SEC-registered investment adviser to review, no less frequently than annually, the adequacy of its compliance policies and procedures and the effectiveness of their implementation. The review has to ask two questions: are the policies right for the business the firm actually runs, and did people follow them?

The rule is one sentence long, and it does not say how to run the review. What it should consider comes from the Commission's adopting release, and what examiners are finding comes from a Division of Examinations Risk Alert published on 14 September 2026. This guide covers both, explains what records to keep, and ends with a checklist.

What the rule says

Rule 206(4)-7 was adopted in December 2003 (Release IA-2204, 68 FR 74714), became effective on 5 February 2004, and had a compliance date of 5 October 2004. It makes it unlawful for an adviser registered, or required to be registered, with the SEC to provide investment advice unless it does three things:

• (a) Policies and procedures. Adopt and implement written policies and procedures reasonably designed to prevent violation of the Advisers Act and its rules by the adviser and its supervised persons.
• (b) Annual review. Review, no less frequently than annually, the adequacy of those policies and procedures and the effectiveness of their implementation.
• (c) Chief compliance officer. Designate an individual, who is a supervised person, responsible for administering the policies and procedures.

The annual review is not a separate program. It is how the firm tests that the other two obligations are being met.

Who it applies to

The rule applies to advisers registered or required to be registered with the SEC under Section 203, a solo adviser included. It does not apply to state-registered advisers, which should check their state's own rules, or to exempt reporting advisers, which are not registered with the SEC.

The 2023 amendment that no longer exists

In August 2023 the Commission's private fund adviser rulemaking amended paragraph (b) to require every adviser to document the annual review in writing. The Fifth Circuit vacated that rulemaking on 5 June 2024 (National Association of Private Fund Managers v. SEC). The Commission then adopted technical amendments (Release IA-6773, 89 FR 91252, effective 19 November 2024) restoring paragraph (b) to its original wording.

So there is no standalone rule requiring a written annual review report. That does not make an undocumented review a good idea, for the reasons in the records section below.

What the review should consider

The adopting release says the review "should consider any compliance matters that arose during the previous year, any changes in the business activities of the adviser or its affiliates, and any changes in the Advisers Act or applicable regulations that might suggest a need to revise the policies or procedures." That gives three inputs:

1. Compliance matters from the year. Violations, exceptions, errors, complaints, trade errors, late filings, and anything raised by an examination or a deficiency letter.
2. Changes in the business. New products, strategies, client types, custodians, service providers, offices, people, affiliates or compensation arrangements. The release's own example is an adviser acquired by a broker-dealer, which needs to look again at the conflicts of executing trades through its new affiliate.
3. Changes in the law. New or amended rules, compliance dates that passed during the year, and new staff guidance.

The release also says advisers "should consider the need for interim reviews in response to significant compliance events, changes in business arrangements, and regulatory developments." An annual review does not stop a firm from looking at a policy sooner when something changes.

The areas the policies should address

The adopting release lists the issues an adviser's policies should address at a minimum, to the extent they are relevant to the adviser. This is the spine of most annual review scopes:

• portfolio management, including allocation of investment opportunities and consistency of portfolios with clients' objectives, disclosures and restrictions
• trading practices, including best execution, soft dollar arrangements and allocation of aggregated trades
• proprietary trading of the adviser and personal trading by supervised persons
• the accuracy of disclosures to investors, clients and regulators, including account statements and advertisements
• safeguarding of client assets from conversion or inappropriate use
• the accurate creation of required records and their protection from unauthorized alteration or untimely destruction
• marketing advisory services
• processes to value client holdings and assess fees based on those valuations
• privacy protection of client records and information
• business continuity plans

The release also says each adviser should "first identify conflicts and other compliance factors creating risk exposure for the firm and its clients in light of the firm's particular operations." A review that walks through a generic list without asking where this firm's risks actually are misses the point of the rule.

Adequacy and effectiveness are different tests

The rule asks for both, and many reviews only do one.

• Adequacy asks whether the written policy is right: does it address the firm's real risks, does it reflect current law, does it describe how the firm actually operates today?
• Effectiveness of implementation asks whether the policy was followed: pick a sample, trace it through, and see whether the procedure was applied and evidenced.

Reading the compliance manual and confirming it still sounds right is an adequacy review at best. Testing is what shows effectiveness.

What the 2026 Risk Alert found

On 14 September 2026 the Division of Examinations published Examinations Observations Regarding Investment Adviser Annual Compliance Review. It is staff observation, not a rule, but it says plainly what examiners have been finding. The staff grouped its observations into five areas.

Timeliness. Advisers that skipped a year (for example, reviewing 2021 and 2023 but not 2022), ran reviews over periods longer than 12 months, including after a CCO departure, or treated staff training or annual attestations as if they were the review. Some had already received a deficiency letter for not doing reviews and still had not corrected it. The alert notes that the 18-month window for a first review in the adopting release applied only to the rule's original compliance date; every review since then is due at least annually.

Incomplete procedures for the review itself. Policies that required testing and documentation without saying how to test, what factors to weigh, or what documentation to keep. Policies that said a topic (identity theft was the example) must be tested annually, where the review procedures then left it out.

Reviews that did not follow the firm's own procedures. Reviews that did not cover the defined period or scope, did not use the specified workpapers, or assessed superseded versions of the policies.

Policies out of line with practice. Reviews that missed fee billing that departed from the advisory agreement and Form ADV (different calculation methods, no proration for large deposits, missed breakpoints, no refunds on termination), proxy voting policies saying the firm voted when it disclosed and practiced that it did not, custody procedures that did not make sure the surprise examination accountant was told about every account in custody, marketing policies never updated for the Marketing Rule, and filing procedures that did not include Form CRS. Others did not say how delegated functions would be overseen, or did not record known incidents of non-compliance from the year.

Documentation and follow-through. Firms that made testing records and did not keep them, policies requiring a written report where none was prepared, and recommendations from one year's review that were never implemented, in some cases where the report said they had been.

What records to keep

Two paragraphs of the books and records rule apply:

• Rule 204-2(a)(17)(i): a copy of the compliance policies and procedures in effect, or in effect at any time in the past five years. Keep superseded versions, and be able to show which version was in force on a given date.
• Rule 204-2(a)(17)(ii): any records documenting the annual review. Under Rule 204-2(e)(1) these are kept for at least five years from the end of the fiscal year in which the last entry was made, the first two years in an appropriate office of the adviser.

Paragraph (a)(17)(ii) covers records the firm makes; it does not by itself require a report. In practice an examiner asks for the annual review, and a firm with nothing to hand over cannot show it happened. The Risk Alert's documentation findings are about firms that made records and lost them, or promised records and never made them. If your policy says you will write a report, write it.

The checklist

1. Calendar it. Set the review period and a completion date no more than 12 months after the last one. Plan for CCO changes so the review does not slip.
2. Write the review procedure. Scope, period, who does what, how each area is tested, sample sizes, the factors used to judge adequacy and effectiveness, and what workpapers are kept.
3. Collect the year's compliance matters. Violations, exceptions, complaints, errors, prior review findings and any exam correspondence.
4. Inventory business changes. Ask the business, in writing, what changed: products, strategies, clients, vendors, custodians, people, systems, affiliates.
5. Inventory regulatory changes. Rules and amendments adopted or with compliance dates during the year, and relevant staff guidance and Risk Alerts.
6. Reassess risk. Update the firm's list of conflicts and risks, and map each one to a policy. Add policies where a significant risk has none.
7. Cross-check the manual. Every topic a policy says will be tested annually should appear in the review scope.
8. Test fee billing against advisory agreements and Form ADV: method, proration, breakpoints and refunds.
9. Test custody, including that every account in custody was identified to the surprise examination accountant where an examination is required.
10. Test marketing against the Marketing Rule, and the records behind performance and testimonials.
11. Test the code of ethics: holdings and transaction reports received on time and actually reviewed, and preclearance where required.
12. Test disclosures and filings: Form ADV, Form CRS where the firm has retail investors, and whether practice matches what they say.
13. Test the rest of the scope that applies: trading and best execution, allocation, proxy voting, valuation, privacy and identity theft, cybersecurity, business continuity, and oversight of delegated functions and service providers.
14. Review the current version. Confirm the review assessed the policies in force during the period, not superseded ones.
15. Record findings and recommendations, with an owner and a due date for each.
16. Close the loop. Track each corrective action to completion with evidence, and check prior years' findings did not recur.
17. Keep the file. The report, workpapers, samples and evidence, under Rule 204-2(a)(17)(ii).

Common questions

How often does an RIA have to do an annual compliance review?

At least once every 12 months. Rule 206(4)-7(b) says "no less frequently than annually." The Risk Alert lists reviews covering more than 12 months as a deficiency, and the 18-month window for a first review applied only when the rule first took effect in 2004.

Does the annual review have to be in writing?

There is no standalone rule requiring a written report. The 2023 amendment that would have required one was vacated in 2024. But Rule 204-2(a)(17)(ii) requires keeping any records that document the review, and without records a firm cannot show an examiner the review happened or what it tested.

Can compliance training or annual attestations count as the review?

No. The Risk Alert specifically identifies advisers that relied on training or attestations in place of a review as not meeting the requirement. Those are controls the review should test, not the review itself.

Who should conduct the annual compliance review?

The rule does not say. The CCO administers the program and usually leads the review. Some firms bring in an outside consultant for an independent view. Either way, the firm remains responsible for the review and its findings.

Does a state-registered adviser need an annual compliance review?

Rule 206(4)-7 applies only to SEC-registered advisers. State-registered advisers are subject to their state's rules, which vary, so check with the state securities regulator.

Plan the next one now

Luna's compliance calendar schedules the review and the testing that feeds it through the year, so the annual review is not a scramble in the last month. The compliance manual template includes an annual review procedure. For the role behind it, see chief compliance officer duties, and for what to do if an exam finds problems, see responding to an SEC deficiency letter.