Interactive checklist · saved in your browser

RIA Compliance Checklist

An RIA compliance checklist is a structured list of an investment adviser's recurring obligations under the Advisers Act, each tied to the rule and deadline that governs it. This interactive version covers compliance program review, CCO designation, Code of Ethics, books and records, Form ADV and Form CRS, marketing, custody, cybersecurity, business continuity, and state notice filings, with every item traced to the rule text. Tick items off as you confirm them. Your progress is saved in this browser, not on our servers.

Last reviewed July 15, 2026 · every item cited to primary sources

Overall progress 0 / 62 complete

Compliance program & annual review (Rule 206(4)-7)

0 / 5

Everything else on this checklist hangs from this rule. Rule 206(4)-7 requires every adviser registered or required to be registered with the SEC to adopt and implement written policies and procedures, designate a CCO, and review the program 'no less frequently than annually.'

17 CFR § 275.206(4)-7 Pillar guide: Compliance program & annual review

Maintain written compliance policies and procedures reasonably designed to prevent violations of the Advisers Act, describing what your firm actually does rather than a generic template.
Conduct the annual compliance program review assessing the adequacy of your policies and how well they're actually being followed (Rule 206(4)-7(b)). Frequency: at least annually; many CCOs also run interim reviews after material changes (new service line, M&A, a deficiency letter).
Write an annual review report (or memo) and retain it. A written record is no longer required by the rule text (the 2023 documentation amendment was vacated in 2024), but examiners commonly expect evidence that the review occurred, so it remains best practice.
Track and fix findings from the prior review; carry open items forward so they don't disappear.
Review and update the program when the business changes; don't wait for the annual cycle if a material risk emerges.

CCO designation (Rule 206(4)-7(c))

0 / 3

Rule 206(4)-7(c) requires every adviser to designate a Chief Compliance Officer responsible for administering the compliance program.

17 CFR § 275.206(4)-7(c) Pillar guide: CCO designation

Designate a Chief Compliance Officer who is a supervised person and is responsible for administering the compliance program (Rule 206(4)-7(c)).
Confirm the CCO has the authority, seniority, and resources to enforce the program. The SEC has repeatedly signaled, including in its framework for CCO liability, that the role must carry real authority, not just a title.
Document the CCO's responsibilities, reporting line, and any outsourced-CCO arrangements.

Code of Ethics & personal trading (Rule 204A-1)

0 / 8

Rule 204A-1 requires a written code of ethics setting a standard of business conduct and governing personal securities transactions by access persons. The reporting cadence is fixed, so calendar it.

17 CFR § 275.204A-1 Pillar guide: Code of Ethics & personal trading

Adopt and maintain a written Code of Ethics that includes a standard of business conduct and provisions for personal trading.
Identify and maintain a current list of access persons (and which employees are also 'supervised persons').
Collect initial holdings reports from each access person no later than 10 days after the person becomes an access person, with information current as of a date no more than 45 days prior (Rule 204A-1(b)(1)).
Collect quarterly transaction reports no later than 30 days after the end of each calendar quarter (Rule 204A-1(b)(2)). Deadline: 30 days post quarter-end.
Collect annual holdings reports at least once each 12-month period, current as of a date no more than 45 days before submission (Rule 204A-1(b)(1)(ii)).
Require pre-approval (preclearance) before access persons acquire beneficial ownership in any IPO or limited offering (Rule 204A-1(c)).
Provide the Code to every supervised person, obtain a written acknowledgment of receipt, and refresh acknowledgments after amendments.
Apply the reportable securities exclusions correctly (e.g., direct obligations of the U.S. government, money-market funds, certain open-end fund shares). Over-collecting creates noise; under-collecting creates gaps.

See how RegFin automates Code of Ethics & preclearance

Books & records (Rule 204-2)

0 / 5

Rule 204-2 is the recordkeeping rule. It enumerates what you must keep and for how long.

17 CFR § 275.204-2 Pillar guide: Books & records

Maintain the required books and records (financials, order memoranda, client agreements, advertisements, communications, and more) listed in Rule 204-2(a).
Retention period: preserve records for at least five years from the end of the fiscal year in which the last entry was made, the first two years in an appropriate office of the adviser (Rule 204-2(e)(1)).
Preserve records in an easily accessible format; if maintained electronically, meet the rule's storage, indexing, and reproduction conditions.
Capture and archive electronic communications and off-channel messaging used for business (text, chat, social DMs). Off-channel communications have been a recurring SEC enforcement theme.
Retain records that support performance claims in advertisements (now tied to the Marketing Rule).

See how RegFin archives the records that back this up

Form ADV annual amendment + Form CRS

0 / 5

17 CFR § 275.204-1 17 CFR § 275.204-3 SEC Form CRS guide Pillar guide: Form ADV annual amendment + Form CRS

File the Form ADV annual updating amendment through IARD within 90 days after the end of your fiscal year (Rule 204-1). Deadline: 90 days post fiscal year-end.
File other-than-annual (interim) amendments promptly when required by the Form ADV instructions (e.g., certain Item 1 changes, disciplinary events).
If there are material changes to the brochure since the last annual updating amendment, deliver the updated brochure (Form ADV Part 2A), or a summary of material changes plus an offer to provide the full brochure, to each client within 120 days after fiscal year-end (Rule 204-3). Deadline: 120 days post fiscal year-end. No annual delivery is required in years with no material changes.
Deliver brochure supplements (Part 2B) for relevant supervised persons and keep them current.
Maintain and deliver Form CRS / Form ADV Part 3 (the relationship summary) to retail investors: before or at the time of entering into an advisory contract, within 30 days of a request, and communicate changes to existing retail clients within 60 days of an update. Applies to advisers with retail-investor clients.

See how RegFin drafts your Form ADV annual amendment

Marketing (Rule 206(4)-1)

0 / 5

The Marketing Rule governs advertisements and compensated testimonials/endorsements.

17 CFR § 275.206(4)-1 Pillar guide: Marketing

Maintain policies for reviewing and approving advertisements against the rule's general prohibitions (no untrue or misleading statements; no unsubstantiated claims).
Ensure any performance advertising that shows gross performance also shows net performance with equal prominence and includes the required time periods.
For testimonials and endorsements, provide the required disclosures (client/non-client status, compensation, material conflicts), oversee compliance, check the disqualification provisions, and use written agreements where required. The written-agreement requirement has exceptions for certain affiliates and de minimis (≤ $1,000 over 12 months) compensation arrangements.
Substantiate factual claims and retain the supporting records. This ties back to Rule 204-2.
Confirm third-party ratings used in advertising meet the rule's conditions.

See how RegFin clears marketing materials

Custody (Rule 206(4)-2)

0 / 5

If your firm has custody of client assets, Rule 206(4)-2 adds significant obligations.

17 CFR § 275.206(4)-2 Pillar guide: Custody

First, determine whether you have custody (e.g., direct fee deduction, trustee/POA authority, access to client funds). Many advisers have custody solely through fee deduction.
Maintain client funds and securities with a qualified custodian.
Ensure the custodian sends account statements to clients at least quarterly, and verify clients are actually receiving them.
Unless an exception applies, undergo an annual surprise examination by an independent public accountant; the accountant files Form ADV-E within 120 days of the exam.
Check whether the independent verification or audited-financials exceptions (e.g., audited pooled vehicles, fee-deduction-only relief) apply to your situation.

Cybersecurity / Reg S-P

0 / 5

The SEC's 2024 amendments to Regulation S-P (Release No. 34-100155) added incident-response and customer-notification obligations. This section is a summary. Work through the dedicated Reg S-P checklist tool for the full set of items.

SEC Release 34-100155 Pillar guide: Cybersecurity / Reg S-P

Maintain written policies to safeguard customer records and information (the longstanding safeguards and disposal rules).
Adopt an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information (2024 Reg S-P amendments).
Implement customer notification procedures: notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, as soon as practicable, and not later than 30 days after becoming aware that the incident has occurred or is reasonably likely to have occurred.
Oversee service providers that receive customer information, with contractual safeguards and breach-notification expectations.
Confirm compliance with the compliance dates that are now in effect. Larger entities (advisers with $1.5 billion or more in AUM) were required to comply by December 3, 2025; smaller entities by June 3, 2026. Both deadlines have passed, so treat any gap as urgent.

Work through the full interactive Reg S-P checklist

Business continuity

0 / 3

For SEC-registered advisers, business continuity is generally treated as part of your reasonably designed policies and procedures under Rule 206(4)-7, not a separate standalone rule. Examiners still expect a workable plan.

17 CFR § 275.206(4)-7 Pillar guide: Business continuity

Maintain a written business continuity and transition plan as part of your Rule 206(4)-7 compliance program, addressing operational disruptions, data recovery, key-person risk, and the orderly transition of client accounts if the firm winds down.
Test the plan periodically and update it after material changes (key-person, vendor, or location changes).
Address key-person and succession risk and document data backup and recovery procedures.

State notice filings

0 / 3

Pillar guide: State notice filings

File and renew notice filings (and pay state fees) in every state where notice filing is required based on your client locations and assets.
Confirm investment adviser representative (IAR) registration and any IAR continuing education obligations in applicable states.
Track renewals through the IARD/CRD renewal program so registrations don't lapse at year-end.

Turning the checklist into a living program

0 / 5

A checklist is only as good as the system that runs it. The failure mode we see most often isn't ignorance of the rules — it's a quarterly transaction report that arrives on day 35, a brochure-delivery log nobody kept, or an annual review that got verbally 'done' but never written up. When an examiner asks for evidence, the documentation is the answer, not 'we do that.'

Pillar guide: Turning the checklist into a living program

Track each obligation on this checklist against its rule and deadline in one system, rather than relying on memory or a static document.
Route Code of Ethics and preclearance workflows so reports and approvals don't slip past their deadlines.
Archive the records that back up Marketing Rule and books-and-records duties in one place.
Surface what's due before it's late, instead of finding a missed deadline during an exam.
Build the annual review from a real audit trail instead of from memory, so the write-up documents itself.

See how RegFin runs this checklist as a program

This checklist is general information for compliance professionals, not legal advice. It's written for an SEC-registered adviser under the Investment Advisers Act of 1940; state-registered advisers should map each item to their state's analog. Verify each item against the linked primary sources and your firm's specific facts.

Turn this checklist into a running program

RegFin keeps the review calendar, personal-trading reports, marketing approvals, and exam-ready evidence trail this checklist assumes, all in one place, building as you work.

Book a demo

RIA Compliance Checklist

Compliance program & annual review (Rule 206(4)-7)

CCO designation (Rule 206(4)-7(c))

Code of Ethics & personal trading (Rule 204A-1)

Books & records (Rule 204-2)

Form ADV annual amendment + Form CRS

Marketing (Rule 206(4)-1)

Custody (Rule 206(4)-2)

Cybersecurity / Reg S-P

Business continuity

State notice filings

Key annual deadlines

Turning the checklist into a living program

Turn this checklist into a running program

Get this checklist as a PDF

Check your inbox