How to respond to an SEC deficiency letter

A deficiency letter is the SEC staff's written list of the problems it found in an examination, and it asks the adviser to respond in writing, typically within 30 days of the letter's date, describing what it has done or will do to fix each one. Most examinations end this way. A careful, specific response, backed by evidence that the fixes are real, is how the examination gets closed.

This guide follows the end of an examination in order: the exit conference, the letter itself, the response, and what the firm should keep afterward. The process described here comes from the Division of Examinations' own account of it, The SEC Exam Handbook (SEC Form 2389, published October 2026), and from the statute that sets the staff's deadline, 15 U.S.C. 78d-5(b).

How an examination ends

The exit conference

When the staff has finished its interviews and analysis, it typically holds an exit conference to go through the issues it has identified. Supervisory staff may attend, and the staff typically asks for members of senior management or the board to attend too.

The exit conference is the firm's best chance to correct the record before anything is written down. The handbook says the findings are based on the best information available to the staff at the time, and invites the firm to say so during the conference if something is inaccurate or if there is information the staff should consider. Come prepared:

• Have someone take careful notes of each issue as the staff describes it. The letter will usually track what was said.
• If a finding rests on a misunderstanding of how the firm operates, say so and offer the records that show it.
• Describe any fix already made or planned. The handbook specifically invites this.

The firm does not need to wait for the exit conference. The handbook encourages firms to raise a misunderstanding as soon as possible during the exam, and to keep the staff informed of steps taken to address issues discussed along the way.

The disposition letter and its deadline

Under 15 U.S.C. 78d-5(b), the staff must send a written notice within 180 days after the later of two events: the end of the on-site portion of the examination, or receipt of all the records requested. The head of the Division (or a designee) may extend that deadline once, by one further 180-day period, if the examination is too complex to finish in time, after notifying the Chairman.

The letter will say one of three things:

1. the examination has concluded
2. the examination has concluded without findings
3. the staff requests that the firm take corrective action

The first two need no response. The third is the deficiency letter. None of the three prevents the Commission from taking action later, including an enforcement action.

What a deficiency letter is and is not

The letter sets out findings of potential violations of the federal securities laws, and other findings within the scope of the exam. The handbook is explicit about its limits:

• It does not mandate a particular corrective action beyond complying with the law. The firm chooses how to fix the problem.
• It does not grade the firm, rank it against peers, or describe best practices.
• If the letter does not mention an activity, that does not mean the activity complies.

That last point matters for the response. A clean area in this letter is not a clearance, and the next examination may look at it.

Referrals to Enforcement

The staff may refer issues to the Division of Enforcement, a self-regulatory organization, a state regulator or other authorities, including criminal authorities. It can do this without an exit conference or a deficiency letter, typically when there are exigent circumstances. A deficiency letter on its own is not a referral, and the Division typically does not publicly disclose whether a firm is under examination or the results. Information obtained in an examination is presumed confidential and non-public under 17 CFR 203.2, and a firm may ask for confidential treatment of what it submits under SEC Rule 83 (17 CFR 200.83).

The handbook also says that prompt and appropriate action to correct findings of potential violations may be a mitigating factor when the staff considers whether to refer a finding to Enforcement. It is not dispositive, but it is the strongest practical reason to treat the response as more than paperwork.

The deadline: 30 days, and ask early for more

The staff will typically ask for a response within 30 days of the date of the deficiency letter. That is the date on the letter, not the date it reached the CCO. Put it on the compliance calendar the day the letter arrives.

If 30 days is not enough, for example because a fix needs a vendor or an outside accountant, ask the exam team for an extension as soon as you realize it. The handbook asks for exactly that. Confirm any extension in writing and note the new date.

Missing the date without asking is the worst outcome.

What to put in the response

The handbook says the letter will ask the firm to respond in writing to the findings and to indicate the steps that have been or will be taken to address the issues and prevent their recurrence. Build the response around those three things: the finding, the fix, and the prevention.

Structure

1. A short cover letter from the CCO or a senior officer, identifying the examination and the letter by date.
2. One section per finding, in the same order and with the same numbering as the letter. Quote or closely paraphrase the finding so the staff does not have to cross-reference.
3. For each finding:
   • whether the firm agrees, and if not, the specific facts and records that support its view
   • what the firm has already done, with the date it was done
   • what remains to be done, with a target date and the person responsible
   • how the firm will prevent recurrence: a policy change, a new control, training, or testing
   • whether the issue affected clients and, if so, what the firm did for them (for example, a refund of overbilled fees and how it was calculated)
4. A list of attachments referenced by finding.

Tone and accuracy

• Be specific. "We have enhanced our procedures" is not an answer. "On 4 November we amended section 7 of the compliance manual to require quarterly review of fee calculations by someone other than the person who prepared them; the first review was completed on 15 January and is attached" is.
• Be accurate. Every statement in the response is a representation to the SEC. Do not say a fix is complete if it is not. Do not commit to a date the firm cannot meet.
• Disagree on facts, not tone. If the firm believes a finding is wrong, say why, briefly, with the documents. The firm can describe what it changed without conceding the legal conclusion, a judgment for counsel if a referral is possible.
• Look beyond the sample. If the staff found a problem in the accounts it tested, the firm should ask whether the same problem exists in accounts it did not test, and say what it found.

Should counsel be involved?

The handbook does not require it. Many firms handle a routine letter in-house. Consider outside counsel where a finding alleges a violation that harmed clients, involves possible misstatements to clients or the SEC, or looks like it could be referred. If the firm withholds any document as privileged during the exam or in support of the response, the handbook expects a privilege log identifying the document, its creator and recipients, its date, a description, the privilege claimed and the request it relates to, and privilege assertions for any redactions.

Evidence of remediation

A response that describes a fix is weaker than one that proves it. For each finding, attach or be ready to produce:

• the amended policy or procedure, with its adoption date
• the corrected filing, such as an amended Form ADV, with its filing date
• records showing the new control operating: a completed review, a sign-off, a reconciliation, a log entry
• training materials and attendance or attestation records
• client remediation records: the calculation, the list of affected accounts, and proof of payment or notice
• for a fix still in progress, the plan, the owner and the target date

Then keep doing it. The fix described in the response is what the staff is likely to test at the next examination. A control that was performed twice and then dropped is a repeat finding, and repeat findings are the ones that tend to escalate. The handbook lists prior examination history first among the factors that inform which firms are selected for examination.

After the response

The staff will review the response and may comment. If it has comments, it will strive to provide them within 60 days of the response, or contact the firm about when it can. Three points from the handbook are easy to misread:

• The staff generally does not comment on whether proposed corrective actions are adequate.
• Silence on the response is not agreement with the positions the firm took in it.
• If the staff has no further comments, the examination is closed, but closing it is not a finding by the Commission and does not bind it. The firm can ask its exam team to confirm the exam is closed.

Feed it into the compliance program

The deficiency letter should go straight into the firm's next annual review under Rule 206(4)-7. The Commission's adopting release for that rule (Release IA-2204, 2003) said the annual review should consider any compliance matters that arose during the previous year, any changes in the business, and any changes in the Advisers Act or applicable regulations. An exam finding is the clearest example of a compliance matter that arose. The review should test whether each fix is still working.

Keep the record

Keep the letter, the response, the attachments and the evidence of each fix together. Rule 204-2(a)(17) requires an adviser to keep its compliance policies and procedures and any records documenting the annual review, and an examiner preparing the next exam will want to see how the last one was resolved.

State-registered advisers

Everything above describes SEC examinations of SEC-registered advisers. State-registered advisers are examined by their state securities regulator, whose process, letters and response deadlines are set by that state. Read the state's letter for its deadline rather than assuming 30 days.

Common questions

How long do I have to respond to an SEC deficiency letter?

The staff typically asks for a response within 30 days of the date of the letter. The letter itself states the deadline. If you need more time, ask the exam team for an extension as soon as you know, and confirm it in writing.

Is a deficiency letter an enforcement action?

No. It is a request for corrective action following an examination. The staff can separately refer issues to the Division of Enforcement or other regulators, and the letter does not prevent the Commission from acting later. Prompt, appropriate corrective action may be a mitigating factor in the staff's referral decision.

Do I have to respond if the letter finds nothing?

No. A letter saying the examination has concluded, or concluded without findings, does not ask for a response. Only a deficiency letter requests one.

Can I disagree with a finding?

Yes. Explain the facts briefly and attach the records that support your position. Raise the disagreement at the exit conference first if you can, since that is when the staff invites additional information.

Does SEC silence after my response mean the issue is resolved?

No. The handbook says the absence of comment is not agreement with the positions in the response, and that the staff generally does not comment on whether proposed fixes are adequate. Expect the next examination to test them.

How long does the SEC have to send the letter?

Under 15 U.S.C. 78d-5(b), 180 days from the later of the end of the on-site portion of the examination or receipt of all requested records. The Division can extend that once by another 180 days for a complex examination.

Prepare before the letter arrives

Luna's exam readiness resources cover what to have ready when an examination is announced, and the compliance calendar tracks the response deadline and each remediation step with the evidence attached. The annual compliance review checklist shows how to carry exam findings into the next review, and the guide to books and records requirements covers what to keep.