Insider trading policies for investment advisers

Section 204A of the Investment Advisers Act requires an investment adviser to establish, maintain and enforce written policies and procedures reasonably designed, taking into consideration the nature of its business, to prevent the misuse of material non-public information by the adviser or anyone associated with it. That written program is what the industry calls the insider trading policy. It is a separate obligation from the insider trading prohibitions themselves: a firm can breach Section 204A without anyone ever trading on inside information, because the requirement is about the procedures.

Congress added Section 204A in the Insider Trading and Securities Fraud Enforcement Act of 1988. The Rule 204A-1 code of ethics, adopted in 2004, sits beside it and covers the personal trading side. In its April 2022 Risk Alert, the Division of Examinations said that findings under Section 204A and the code of ethics rule have been among the most commonly observed in adviser exams.

This guide covers what the policy needs to say, how it fits with the code of ethics, and the controls that make it work. For the underlying question of what counts as MNPI, start with What is MNPI?.

Who Section 204A applies to

The statute applies to every investment adviser subject to Section 204 of the Advisers Act, the recordkeeping and reporting section. In practice that includes every SEC-registered adviser, whatever its size. The Division's 2022 Risk Alert describes Section 204A as applying to all investment advisers, registered and unregistered, so exempt reporting advisers should treat it as applying to them too. State-registered advisers should also check their state's rules.

The reach within the firm is broad. The policy must address misuse by the adviser "or any person associated with" it, which covers partners, officers, directors, employees and others the firm controls.

What the policy must cover

Section 204A does not list required contents. It requires procedures "reasonably designed, taking into consideration the nature of such investment adviser's business." Two things follow. The policy has to be written, and it has to fit the ways MNPI actually reaches your firm. A policy copied from a template that mentions neither your board seats nor your expert network calls is the kind examiners describe as not tailored.

A working policy usually covers these elements.

1. A plain explanation of the law

The Commission noted in the release adopting Rule 204A-1 that an adviser's Section 204A procedures usually contain a summary of insider trading law and procedures for deciding whether information has become public. Explain materiality, when information becomes public, tipping, and the misappropriation theory, with examples drawn from your own business. The MNPI guide covers the legal tests.

2. Both kinds of MNPI

There are two sources of MNPI at an adviser, and the policy should deal with both:

• Information about issuers, such as a pending deal learned through a board seat, a private placement or an expert call.
• Information about the firm's own clients, meaning what the firm is about to buy or sell for client accounts and what client portfolios hold. Trading ahead of client orders, or passing that information to someone who does, is a misuse of MNPI. The Commission's code of ethics adopting release distinguished these procedures from the issuer-focused ones and cited Section 204A cases about the leaking of fund portfolio holdings.

3. What to do on receiving MNPI

The heart of the policy is the escalation step. Anyone who believes they may have received MNPI stops, tells compliance, and does not trade or pass the information on until compliance decides what it is. The policy should say who to tell, how quickly, and what happens next. It should be clear that the person who received the information does not get to decide on their own that it is not material.

4. Restricted and watch lists

These are the main tools for turning a decision about MNPI into a trading control:

• The restricted list names issuers whose securities may not be traded, for personal or client accounts, while the firm holds MNPI about them or for other reasons such as an underwriting relationship. The Commission named restricted lists, with prohibitions on any trading in those issuers, among the practices all advisers should consider in its code of ethics adopting release. The list is visible to the people it restricts.
• The watch list (sometimes called a grey list) is confidential to compliance. It names issuers where the firm holds sensitive information but has not restricted trading, often because restricting would itself signal that something is happening. Compliance uses it to monitor trading without telling the firm.

The policy should say who can add and remove names, what evidence supports each change, and how quickly a name goes on. Trades in a restricted security are one of the specific findings in the 2022 Risk Alert, so the list has to be checked at the point of trading, not only reviewed afterward.

5. Information barriers

Where one part of the firm receives MNPI and another part trades, an information barrier (sometimes still called a Chinese wall) keeps the information on one side. A barrier is a set of controls: physical and electronic separation, restricted access to files and systems, rules on communications between the groups, and a procedure for bringing someone "over the wall" with compliance approval and a record of who crossed, when and why. Smaller firms often cannot separate teams in a meaningful way. If so, the policy should say so and rely on restriction rather than a barrier that exists only on paper.

6. Higher-risk sources

The 2022 Risk Alert identified three areas where examiners found policies missing or not implemented:

• Expert networks. Advisers did not track and log calls with expert network consultants, did not review detailed notes from those calls, and did not review supervised persons' trading in companies in the industries discussed. Common controls include approved networks only, consultant certifications that they will not share confidential information, pre-approval of calls with current or recent employees of public companies, chaperoning higher-risk calls, and keeping notes.
• Alternative data. Advisers that used data from non-traditional sources, such as aggregated card transactions, geolocation or app data, did not document or consistently apply their due diligence on data vendors, did not assess the legal terms under which data was collected, and had no trigger for repeating diligence when time passed or a vendor's practices changed.
• "Value-add investors". Advisers did not have, or did not apply, procedures for clients and fund investors who are more likely to hold MNPI, such as officers or directors of public companies, portfolio managers at other firms and investment bankers, or did not correctly identify those investors and track their relationships.

Other sources to name where they apply include board and observer seats, creditor committees, wall-crossings for private placements and PIPEs, meetings with company management, and political intelligence consultants.

7. Training, certification and testing

Train new staff at hire and everyone at least annually, and keep the attestations. Test the policy in the annual review required by Rule 206(4)-7: pick matters from the year and trace each from receipt to the restricted list to clearance, and compare personal and client trades with the restricted and watch lists.

How the policy relates to the code of ethics

Section 204A and Rule 204A-1 are related but different.

• Section 204A is about MNPI. It applies to the firm and everyone associated with it, and it requires procedures to prevent misuse.
• Rule 204A-1, the code of ethics rule, is broader in subject and narrower in some mechanics. The Commission said it "goes beyond section 204A" and expands advisers' policies to other situations where staff could benefit at clients' expense. The code must set a standard of business conduct, require compliance with the federal securities laws, require access persons to report holdings and transactions and the firm to review them, require prompt internal reporting of breaches of the code, and require each supervised person to acknowledge receipt of the code in writing.

The code supplies two of the most useful MNPI controls:

• Personal trading reports. Access persons file an initial holdings report within 10 days of becoming an access person, an annual holdings report, and quarterly transaction reports within 30 days of quarter end. Reviewing those reports against the restricted list, the watch list and each open matter's insider list is where many firms first catch a trade that should not have happened.
• Preclearance of IPOs and limited offerings. Rule 204A-1(c) requires access persons to obtain the firm's approval before acquiring any security in an initial public offering or a limited offering, such as a private placement. Rule 204-2(a)(13)(iii) requires a record of each approval and the reasons for it.

Many firms go further and require preclearance of all personal trades in reportable securities, which lets compliance check every request against the lists before it is placed. The Commission listed firm-wide preclearance, blackout periods around client trading, and restrictions on short-term trading among the practices advisers should consider.

Firms may put the Section 204A procedures inside the code of ethics or keep them as a separate policy. The adopting release said many advisers may integrate them, "but they are not required to do so." What matters is that the two documents are consistent and that each refers to the other. The code of ethics guide covers access persons, reportable securities and reporting deadlines in detail.

Solo advisers

Rule 204A-1(d) excuses an adviser with only one access person from submitting reports to itself and obtaining its own preclearance, provided it keeps records of all holdings and transactions the rule would otherwise require it to report. Section 204A has no such exception. A solo adviser still needs a written policy on MNPI, and the exposure is real if the adviser sits on a public company board or advises a company's officers.

Records that show the policy works

A policy without records is hard to defend in an exam. The records that matter are:

• the written policy and each version of it, with training and acknowledgment records
• a log of each MNPI matter: the issuer, what the information is, its source, when it arrived, who knows it, and when it was cleared and why
• the restricted and watch lists, with the date and reason for each change
• preclearance requests and decisions, with the reasons
• holdings and transaction reports, and evidence that someone reviewed them
• expert network call logs, notes and consultant certifications
• alternative data vendor diligence files

Code of ethics records under Rule 204-2(a)(12) and (a)(13) are generally kept for five years. The books and records guide covers retention.

What examiners commonly look at

The 2022 Risk Alert, together with the code of ethics observations in the Division's 2017 Risk Alert on the most frequent compliance topics, gives a fair picture of what examiners test:

• whether the policy addresses the firm's actual sources of MNPI, including expert networks, alternative data and value-add investors
• whether the firm can show it followed its own procedures, with documentation, rather than just having them
• trades by employees in securities on the restricted list
• employees buying ahead of clients, contrary to the code
• access persons who were never identified as access persons
• IPOs and private placements bought without preclearance
• holdings and transaction reports that were late, incomplete (private placements left out is a common one) or never reviewed
• the chief compliance officer reviewing their own reports, with no one assigned to review them
• missing acknowledgments of the code and its amendments

Common questions

Is an insider trading policy required for investment advisers?

Yes. Section 204A requires every adviser subject to Section 204 to establish, maintain and enforce written policies and procedures reasonably designed to prevent the misuse of material non-public information. For an SEC-registered adviser that is a written insider trading policy, whether it stands alone or sits inside the code of ethics.

What is the difference between a restricted list and a watch list?

A restricted list bars trading in named securities and is visible to the people it restricts. A watch list is confidential to compliance and is used to monitor trading in issuers about which the firm holds sensitive information, without signalling to the rest of the firm that anything is happening.

Does the code of ethics replace the insider trading policy?

No, although the two can be combined in one document. Rule 204A-1 covers personal trading and standards of conduct. Section 204A separately requires procedures to prevent misuse of MNPI, including MNPI about the firm's own client trading. If they are combined, the combined document has to satisfy both.

Do expert network calls need compliance approval?

Section 204A does not name expert networks, but the 2022 Risk Alert lists the absence of controls over expert network calls as a specific finding. Logging calls, reviewing notes and checking related trading are the controls the Division described, and many firms also pre-approve higher-risk calls.

How often should the restricted list be updated?

Whenever the firm comes into or out of possession of MNPI about an issuer. The list is only useful if names go on as soon as compliance decides they should, and come off only after a recorded decision that the information is public or no longer material.

Make the policy a record

The code of ethics template covers Rule 204A-1 and leaves room for the firm's insider trading procedures. In Luna, the MNPI register records each matter and its insider list and refuses preclearance to anyone on that list, and personal trading checks each preclearance request against the restricted list and records the decision with its reasoning. A person still makes every decision about when a matter is cleared.