The RIA chief compliance officer: duties, authority and liability

Every SEC-registered investment adviser must designate a chief compliance officer: an individual, who is a supervised person of the firm, responsible for administering its compliance policies and procedures (Rule 206(4)-7(c)). The Commission expects that person to be competent and knowledgeable about the Advisers Act, empowered with full responsibility and authority to develop and enforce the firm's policies, and senior enough to compel others to follow them.

The rule itself is one sentence long. Most of what the role means comes from the Commission's adopting release (Release IA-2204, December 2003, effective February 5, 2004 with compliance required from October 5, 2004) and from what the Division of Examinations has said since.

What Rule 206(4)-7 requires

It is unlawful for an SEC-registered adviser to provide investment advice unless it:

1. adopts and implements written policies and procedures reasonably designed to prevent violation of the Advisers Act and its rules by the firm and its supervised persons
2. reviews them at least annually for their adequacy and the effectiveness of their implementation
3. designates an individual (who is a supervised person) responsible for administering them

The obligation sits with the firm. The CCO administers the program, but the adviser is the one that violates the rule if the program is missing or does not work.

The rule applies to advisers registered or required to be registered with the SEC. State-registered advisers should check their state's requirements, which differ.

Who can be the CCO

• An individual, not a committee or a firm.
• A supervised person. Section 202(a)(25) defines that as a partner, officer, director or employee of the adviser, or another person who provides investment advice on its behalf and is subject to its supervision and control.
• Not necessarily a new hire. The adopting release says the rule "does not require advisers to hire an additional executive," only to designate one. In a small firm the CCO may also hold other roles.
• Someone with the time. The Division's March 2023 Risk Alert on newly registered advisers cited firms that "assigned additional and unrelated responsibilities" to the CCO, "resulting in limited time for the CCO to dedicate to compliance."

The CCO is named in Item 1.J of Form ADV Part 1A. If the CCO is compensated or employed by someone other than the adviser, a related person or a registered fund it advises, for providing CCO services to the adviser, Item 1.J(2) requires that person's name and IRS Employer Identification Number.

Authority: the three qualities the Commission named

Release IA-2204, Section II.C.1:

An adviser's chief compliance officer should be competent and knowledgeable regarding the Advisers Act and should be empowered with full responsibility and authority to develop and enforce appropriate policies and procedures for the firm. Thus, the compliance officer should have a position of sufficient seniority and authority within the organization to compel others to adhere to the compliance policies and procedures.

In its 2015 review of firms with outsourced CCOs, the staff tested this by considering, among other things, whether the CCO "appeared to have sufficient authority to influence adherence" to the firm's policies and "was allocated sufficient resources." The library's note on Rule 206(4)-7 lists "a CCO title given to someone without the seniority or time to administer the program" as a recurring finding.

What the CCO actually does

Builds and maintains the policies

The adopting release says each adviser should "first identify conflicts and other compliance factors creating risk exposure for the firm and its clients," then design policies to address them. It expects the policies, at a minimum and to the extent relevant, to address:

• portfolio management, including allocation of opportunities and consistency with client objectives and disclosures
• trading practices, including best execution, soft dollars and allocation of aggregated trades
• proprietary trading and personal trading by supervised persons
• accuracy of disclosures to investors, clients and regulators
• safeguarding of client assets
• accurate creation and maintenance of required records
• marketing advisory services
• valuation of client holdings and fee calculation
• privacy protection of client records and information
• business continuity plans

Many firms keep these in one compliance manual. The test is whether it describes how the firm actually operates. Off-the-shelf manuals that were not tailored to the firm are a finding in the 2023 Risk Alert.

Runs the annual review

Rule 206(4)-7(b) requires a review "no less frequently than annually." The adopting release says it should consider compliance matters that arose during the year, changes in the business of the adviser or its affiliates, and changes in the law. It also says advisers "should consider the need for interim reviews" after significant compliance events, business changes or regulatory developments.

A recent change. The 2023 Private Fund Advisers rules had amended Rule 206(4)-7 to require that the annual review be documented in writing. The Fifth Circuit vacated those rules on June 5, 2024, and the Commission restored the rule's original text (Release IA-6773, effective November 19, 2024). There is again no standalone requirement to write the review up, but Rule 204-2(a)(17)(ii) requires you to keep any records that do document it, and an examiner will ask for them. See the annual compliance review checklist.

Administers the code of ethics

Rule 204A-1 gives the CCO specific roles. The code must require supervised persons to report violations promptly to the CCO, or to other designated persons if the CCO also receives reports of all violations (Rule 204A-1(a)(4)). Access persons submit holdings reports to the CCO or other designated persons (Rule 204A-1(b)(1)), and Rule 204A-1(a)(3) requires the adviser to review them.

Keeps the record

Rule 204-2(a)(17)(i) requires the adviser to keep the compliance policies in effect now and at any time in the past five years. A well-run program also keeps the evidence that it ran: testing, exceptions, escalations, training and attestations.

Leads the firm through examinations

The Division's examinations typically include interviews with the CCO and other senior officers, which the staff uses to assess tone at the top and the culture of compliance (2015 outsourced CCO Risk Alert). The SEC Exam Handbook (SEC Form 2389, October 2026) describes the process from the initial call to the deficiency letter, which typically asks for a written response within 30 days. See the exam resources.

Is the CCO personally liable?

The adopting release addresses supervision directly, in footnote 73:

Having the title of chief compliance officer does not, in and of itself, carry supervisory responsibilities. Thus, a chief compliance officer appointed in accordance with rule 206(4)-7 ... would not necessarily be subject to a sanction by us for failure to supervise other advisory personnel.

A CCO who does have supervisory responsibilities, common where the CCO is also an owner or executive, can rely on the defense in Section 203(e)(6) of the Advisers Act. Under that section a person is not treated as failing to supervise reasonably if the firm had procedures reasonably designed to prevent and detect violations, a system for applying them, and the supervisor reasonably discharged his or her duties under them without reason to believe the supervised person was not complying.

The defense depends on the procedures existing and being followed, which is one more reason to keep a record of what compliance did and when.

Outsourcing the CCO

An adviser can use a CCO who is a contractor or consultant, but it cannot outsource its responsibility. The Office of Compliance Inspections and Examinations' Risk Alert of November 9, 2015, based on nearly 20 examinations of firms with outsourced CCOs, concluded that "a CCO, either as a direct employee of a registrant or as a contractor or consultant, must be empowered with sufficient knowledge and authority to be effective," and that each registrant "is ultimately responsible for adopting and implementing an effective compliance program."

What it found:

• Communication. Outsourced CCOs who regularly and personally dealt with the firm's staff understood the business better, and their firms had fewer gaps between policy and practice.
• Resources. More significant issues appeared where one outsourced CCO served many unaffiliated firms without enough resources.
• Empowerment. Annual reviews were more accurate where the CCO could obtain records independently, rather than relying on the firm to choose which records to provide.
• Knowledge. Some outsourced CCOs could not describe the firm's risks, and generic checklists missed parts of the business.
• Policies not followed, including reviews the outsourced CCO was designated to perform.

If you outsource, give the CCO direct access to records and people, agree a schedule of on-site or live contact, and record in Item 1.J(2) who pays them.

What examiners look for

• A CCO without the time, seniority or resources to run the program.
• Policies that describe a business the firm no longer runs.
• An annual review that left no record of what was tested or found.
• Outsourced functions that nobody at the firm oversees.
• No business continuity or succession plan, including for the death or incapacity of a key person.

Common questions

Can the owner or CEO also be the CCO?

Yes. The rule requires the adviser to designate an individual who is a supervised person; it does not require a separate hire. The CCO needs enough time and knowledge to run the program, which the 2023 Risk Alert on newly registered advisers found was not always the case.

Can an RIA outsource its chief compliance officer?

Yes, the CCO can be a contractor or consultant, and Item 1.J(2) of Form ADV asks who compensates an outsourced CCO. The firm remains responsible for the program, and the CCO must have the knowledge, access and authority to be effective.

Does a CCO need a license or certification?

Rule 206(4)-7 does not require any particular exam, license or designation. The Commission expects the CCO to be competent and knowledgeable about the Advisers Act. A CCO who is also an investment adviser representative may need to meet state exam requirements for that role.

Is a CCO liable for the firm's violations?

The CCO title alone does not carry supervisory responsibility, according to the adopting release. A CCO who also supervises others can rely on the Section 203(e)(6) defense where the firm had reasonable procedures and a system for applying them, and the CCO carried out his or her duties under them.

How often does the CCO have to review the compliance program?

At least annually under Rule 206(4)-7(b), with interim reviews after significant compliance events, business changes or new rules.

Give the CCO a system, not a binder

Luna's compliance platform keeps the calendar, the code of ethics, personal trading and the MNPI register in one place, with each obligation tied to the rule behind it. Start with the compliance manual template, and use the compliance calendar to put the annual review on a date.