Solo adviser compliance, from A to Z

Form ADV is your registration and your disclosure document in one. Part 1 is the check-the-box filing. Part 2A is the brochure your clients read. Part 2B is the supplement about each person who advises them. Part 3, Form CRS, applies only if you are SEC-registered and serve retail investors.

Rule 204-2 lists the records an SEC adviser must keep, from the general ledger to written communications about advice, orders and performance, advertisements, and the records behind every performance number. Most are kept five years from the end of the fiscal year of the last entry, the first two years in an appropriate office. Formation documents are kept three years after the firm closes. NASAA's model recordkeeping rule uses the same periods and adds items such as a complaint file, but states differ: some require only three years (Alabama, Illinois, North Dakota, West Virginia), others six (Maine, New Mexico, Washington), and Texas requires write-once storage. Keeping six or seven years satisfies every state.

Rule 206(4)-7 requires an SEC adviser to adopt written policies reasonably designed to prevent violations, review them at least annually for adequacy and effectiveness, and designate a chief compliance officer. The 2003 adopting release lists the areas most advisers should cover: portfolio management, trading, disclosures, safeguarding assets, recordkeeping, marketing, valuation, privacy and business continuity. NASAA's 2020 model rule on written policies and procedures brings a similar requirement to the states that adopt it.

You are a fiduciary. The SEC's 2019 interpretation says that means a duty of care and a duty of loyalty. Loyalty requires you to eliminate a conflict or disclose it fully and fairly enough that the client can give informed consent. States reach the same place through their unethical business practices rules, which require written disclosure of material conflicts before advice is given.

Rule 204A-1 requires an SEC adviser's written code of ethics to set a standard of conduct, require compliance with the securities laws, require access persons to report personal holdings and transactions, require pre-approval of IPOs and limited offerings, and require prompt reporting of violations. Holdings reports are due within 10 days of becoming an access person and annually after that; transaction reports are due within 30 days after each quarter. If you are the firm's only access person, you may keep the records instead of reporting to yourself. NASAA's model policies rule carries the same code of ethics content into adopting states.

Your fee schedule is disclosed in Part 2A Item 5, and your bills have to match it. If you require or solicit prepayment of more than $1,200 per client six months or more in advance, Item 18 requires an audited balance sheet. For state-registered advisers that threshold is $500. NASAA's unethical practices rule makes charging an unreasonable fee a violation, and NASAA's 2022 fee guidance says many state regulators treat an annual fee above 2 percent as unreasonable.

Performance fees are prohibited unless the client is a "qualified client." The SEC raised those thresholds effective June 29, 2026: $1,400,000 under management with you, or $2,700,000 net worth. NASAA's model rule points state advisers to the same definition, but several states still use older, lower thresholds or their own rules, and Maine prohibits them except fee arrangements that can move down as well as up. Check yours.

No SEC rule sets a dollar limit on gifts for advisers. FINRA's $300 limit applies to broker-dealers, not to you. Your code of ethics sets your own limit, and you keep a log.

Political contributions are different. Rule 206(4)-5 bars an SEC adviser from being paid to advise a government entity for two years after the adviser or a covered associate contributes to an official who can influence the hiring, with a de minimis exception of $350 per election if the contributor can vote for the candidate and $150 if not. The rule is in force today. On September 10, 2026 the SEC proposed to rescind it; comments are due November 9, 2026. Watch that. State advisers: check whether your state has its own pay-to-play rule.

The SEC has no complaint-log rule for advisers, but written complaints are communications about your advice, and Rule 204-2 requires you to keep those. NASAA's model recordkeeping rule, which many states have adopted in some form, requires a file of all written communications about any written client complaint and any litigation. Examiners ask how complaints are received, handled and reviewed.

Section 204A requires every SEC-registered adviser to have written policies to prevent misuse of material non-public information. NASAA's model policies rule requires the same of state advisers in adopting states. Insider trading law reaches everyone regardless.

A state cannot require you to register there if you have no place of business in the state and fewer than six clients who are residents there in the preceding 12 months. That is the national de minimis standard in Section 222(d). Above it, a state-registered adviser registers in the second state and an SEC-registered adviser makes a notice filing there. States can also license investment adviser representatives who have a place of business in the state, even if the firm is SEC-registered.

FinCEN's anti-money laundering rule for advisers covers SEC-registered advisers and exempt reporting advisers. On December 31, 2025 FinCEN postponed its effective date from January 1, 2026 to January 1, 2028, and said it would revisit the rule. State-registered advisers are not covered by it. OFAC sanctions apply to every U.S. person today, so you cannot do business with a sanctioned person whether or not an AML program is required.

To register as an investment adviser representative, NASAA's model rule requires the Series 65 within two years of application, or the Series 66 plus the Series 7. The exam is waived for a current CFP, ChFC, CFA, PFS or CIMA, though each state decides its own waivers. Pass the exam and you have two years to register before it expires.

Continuing education: in jurisdictions that have adopted NASAA's IAR CE rule, each registered IAR completes 12 credits a year, 6 in ethics and professional responsibility and 6 in products and practice, through approved providers, on your CRD transcript by year end. It applies to IARs of SEC-registered firms too. Twenty-five jurisdictions have adopted it, with effective dates from 2022 to 2027. Miss it and your status goes CE Inactive; miss two years and you cannot renew.

The SEC Marketing Rule, 206(4)-1, applies to SEC-registered advisers. It prohibits seven kinds of statement in any advertisement, including unsubstantiated claims and benefits without a fair and balanced treatment of risks. Testimonials and endorsements are allowed with clear disclosures of client status, compensation and conflicts; a compensated promoter generally needs a written agreement unless paid $1,000 or less in the preceding 12 months. Gross performance must be shown with net, and non-fund performance must show 1-, 5- and 10-year periods. Keep a copy of every advertisement.

State-registered advisers: your state's advertising rule governs. On May 4, 2026 NASAA amended its model rules to permit testimonials, endorsements and performance with similar guardrails, but each state must adopt the amendments before they apply there. At least 14 states still ban testimonials outright today. Until yours changes its rule, check before you post a review.

The SEC has no net worth or bonding requirement for advisers. States do. NASAA's model rule, which many states adapt, requires $35,000 net worth if you have custody, $10,000 if you have discretion without custody, and a positive net worth if you accept prepayment of more than $500 six or more months in advance. An adviser below the minimum may post a bond for the shortfall. Real state rules vary far more than the model: some require a bond from every adviser, Oklahoma and Oregon require errors-and-omissions insurance instead, and Louisiana, New York and Texas have no minimum. Read yours. If your net worth falls below the minimum, the model rule requires notice to the regulator by the next business day.

If a text message is about a recommendation, an order, money moving, or performance, it is a required record under Rule 204-2(a)(7), and you have to keep it. The SEC has brought years of cases on this. In January 2025 alone, nine investment advisers and three broker-dealers paid a combined $63.1 million for failing to preserve messages sent on personal devices. State recordkeeping rules reach the same communications.

If you are SEC-registered, Regulation S-P applies. The 2024 amendments required every SEC adviser to comply by June 3, 2026 at the latest: written safeguards, an incident response program, notice to affected individuals as soon as practicable and no later than 30 days after you learn of unauthorized access to sensitive customer information, and service providers who must notify you within 72 hours.

If you are state-registered, the FTC Safeguards Rule applies instead; the FTC names "investment advisors that aren't required to register with the SEC" among the businesses it covers. It requires a qualified individual, a risk assessment, encryption in transit and at rest, multi-factor authentication, training, service provider oversight and incident response. Firms holding information on fewer than 5,000 consumers are exempt from the written risk assessment, annual penetration testing, the written incident response plan and the annual board report. Since May 2024, a breach involving 500 or more consumers must be reported to the FTC within 30 days of discovery. NASAA's 2020 model policies rule adds a cybersecurity policy and an annual privacy notice in adopting states.

Everyone: every state has a breach notification law.

Under Rule 206(4)-2, an SEC adviser with custody must keep client assets with a qualified custodian, tell clients who it is, have a reasonable basis to believe the custodian sends statements at least quarterly, and get an annual surprise examination by an independent accountant. The surprise exam does not apply if your only custody is deducting your fee. A standing letter authorizing you to move client money to a third party is custody; the SEC staff's 2017 letter lets you skip the surprise exam if seven conditions are met. Assets received by mistake go back within three business days.

States follow NASAA's model custody rule in their own versions. It treats fee deduction as custody too, conditions the exemption on an invoice each time you deduct, and custody is what triggers the $35,000 net worth figure above.

Under $100 million in regulatory assets under management, you register with your state. At $100 million you may register with the SEC; at $110 million you must; once SEC-registered you need not leave until you fall below $90 million, when you withdraw within 180 days of fiscal year end on Form ADV-W. Two exceptions put smaller advisers with the SEC: mid-sized advisers not subject to examination by their home state (today only New York) and advisers required to register in 15 or more states. Everything is filed through IARD, which FINRA operates. Renewals run every fall: for 2027, preliminary statements post November 9, 2026 and payment is due December 7, 2026. Miss it and you fail to renew on January 1.

No SEC rule requires a business continuity plan; the SEC proposed one in 2016 and never adopted it. But the 2003 compliance rule release lists business continuity among the areas your policies should address, and examiners ask for the plan. NASAA's 2015 model rule requires advisers in adopting states to have a written plan covering backup of records, alternate communications, office relocation, assignment of duties if key personnel die or become unavailable, and minimizing client harm.

For a solo adviser this is the hardest entry in the alphabet, because the key person is you.

Best execution is part of your duty of care. You seek the most favorable terms reasonably available, and the SEC has said the determining factor is not the lowest commission but the best qualitative execution. Form ADV Part 2A Item 12 discloses how you choose brokers. The SEC's 2018 risk alert lists the usual failures: no review at all, no comparison with other brokers, and policies that are never followed.

Form U4 registers each investment adviser representative through IARD and CRD; Form U5 ends it. You, the firm, file them. Both carry disclosure questions about criminal, regulatory, civil and financial events, and the Form U4 instructions impose a continuing obligation to amend as changes occur. NASAA's IARD model rules treat an amendment as prompt if filed within 30 days of the event; Illinois requires 10 business days. States set their own U5 deadlines; FINRA's rule for its members is 30 days, and your state's may match. Check it.

If a vendor touches client information, you are responsible for overseeing it. Reg S-P requires SEC advisers to oversee service providers and require 72-hour breach notice from them. The FTC Safeguards Rule requires state advisers to select capable providers, require safeguards by contract and assess them periodically. The SEC withdrew its 2022 outsourcing proposal in June 2025, so there is no separate outsourcing rule, but examiners still ask.

Section 205 requires an SEC adviser's contract to say it cannot be assigned without the client's consent and, for a partnership, that the client will be told of changes in membership, and it prohibits performance fees outside the qualified client exception. States go further: NASAA's model rules require the contract to be in writing and to state the services, the term, the fee and how it is computed, how prepaid fees are refunded on termination, and whether you have discretion. The SEC's 2019 interpretation warns against hedge clauses that purport to waive your fiduciary duty.

The SEC's 2026 priorities say the Division will keep prioritizing advisers that have never been examined, with particular emphasis on recently registered advisers, and will look at fiduciary conduct, compliance programs and annual reviews. States run their own programs. NASAA's 2025 coordinated exams covered 1,086 state advisers, 365 of them examined for the first time, and found 3,402 deficiencies across 23 categories, led by books and records, financial matters, registration, fees and advertising.

Your year has a shape. Annual updating amendment within 90 days of fiscal year end. Brochure delivery within 120 days. Code of ethics holdings reports annually and transaction reports every quarter. Annual compliance review. Privacy notice annually unless an exception applies. IAR CE by December 31 in adopting states. IARD renewal in November and December. Add your custody surprise exam, your state's financial filings and your own policy dates.

Rule 206(4)-7(c) requires you to designate a chief compliance officer, and the SEC has said that person should be competent and knowledgeable about the Advisers Act and empowered with full responsibility and authority. Its 2015 alert on outsourced CCOs and its 2020 compliance programs alert both describe CCOs with too many other jobs and too little authority. For a solo adviser the CCO is you, and no consultant or software changes that.