The U.S. Securities and Exchange Commission (SEC) announced on October 20, 2026, that it has entered into a new Memorandum of Understanding (MOU) with France’s Autorité des Marchés Financiers (AMF), establishing a framework for regulatory cooperation and information sharing.
The post SEC Opens Path for French Investment Advisers to Register in the United States appeared first on RIA Compliance Consultants.
]]>Importantly, the SEC confirmed that it will process new and pending registration applications from AMF-supervised asset management companies seeking to conduct business in the United States as investment advisers. The announcement provides a meaningful opportunity for covered French firms whose SEC investment adviser registration plans have been complicated by cross-border information-access concerns. SEC Press Release No. 2026-108.
The development follows the SEC’s resumption of registration processing for Swiss-based investment advisers and indications of a similar shift in practice involving Israel-based applicants. These developments suggest a willingness to address cross-border information-access concerns on a jurisdiction-by-jurisdiction basis.
Under Section 204 of the Investment Advisers Act of 1940, SEC-registered investment advisers generally must maintain required books and records and make them available for SEC examination.
For investment advisers located outside the United States, these obligations can present challenges when foreign laws restrict disclosure of information to foreign governmental authorities. Restrictions involving personal data, confidentiality, and regulatory access can complicate a firm’s ability to satisfy the SEC’s supervisory and examination requirements.
Cross-border information-access concerns have complicated SEC registration for advisers in certain jurisdictions. The SEC’s announcements concerning France and Switzerland reflect the importance of ensuring that the agency can obtain the information necessary to supervise and examine registered firms.
For affected firms, these concerns have created uncertainty about their ability to establish or expand investment advisory operations serving U.S. clients.
According to the SEC, the MOU establishes a framework for consultation, cooperation, and information sharing concerning certain investment advisers, investment companies, and investment service providers operating in the United States and France.
The announcement expressly confirms that the SEC will process new and pending registration applications from AMF-supervised asset management companies in light of the arrangement. Its significance is therefore more than a general commitment to regulatory cooperation: it provides an expressly recognized basis for considering applications from the covered firms. The AMF has also published the agreement on its website.
Processing an application is not the same as granting registration. The MOU does not guarantee approval of any particular applicant or provide a blanket exemption from the Investment Advisers Act.
The SEC’s announcement specifically references AMF-supervised asset management companies wishing to conduct business in the United States as investment advisers.
A French firm should therefore confirm that it falls within the category contemplated by the arrangement. Merely maintaining an office in France or holding another type of French financial-services authorization should not be assumed to qualify a firm for the announced processing arrangement.
The MOU does not itself grant SEC registration or eliminate applicable application requirements. However, an investment adviser whose principal office and place of business is outside the United States generally may register with the SEC without satisfying the minimum assets-under-management thresholds ordinarily applicable to U.S.-based advisers. The SEC’s Form ADV General Instructions recognize a principal office and place of business outside the United States as a basis for SEC-registration eligibility.
A French firm should evaluate its registration obligations, any available exemption, its principal office and place of business, and the requirements applicable to its proposed U.S. advisory activities. A U.S.-based affiliate should evaluate its own registration eligibility separately.
The MOU establishes a regulatory cooperation framework that supports information sharing and supervision of covered firms. That is important because SEC registration carries continuing recordkeeping and examination obligations.
Nevertheless, investment adviser firms should not interpret the announcement as eliminating the GDPR or all other applicable French and EU data-protection requirements. Before proceeding, a firm should confirm how applicable data-protection, confidentiality, and professional-secrecy obligations interact with SEC requests for records and information.
Coordination with French and U.S. legal counsel and compliance professionals may be necessary to determine how the firm can comply with both sets of obligations. The relevant analysis should address the firm’s actual activities, records, and proposed information-transfer procedures—not simply the existence of the MOU.
On June 10, 2025, the SEC announced that it would resume processing registration applications from Swiss-based investment advisers following discussions with the Swiss Financial Market Supervisory Authority (FINMA). Those discussions addressed access to books and records, including personal data, and the SEC’s ability to conduct on-site examinations in Switzerland. SEC Press Release No. 2025-83.
There have also been indications of a shift in registration practice involving Israel-based applicants. Individual registration approvals, however, should not be treated as equivalent to a publicly announced, jurisdiction-wide processing arrangement.
Together, these developments suggest a willingness to address cross-border supervisory-access concerns through engagement with foreign regulators and other legally supportable approaches.
The French arrangement does not automatically resolve registration issues for investment advisers elsewhere in the European Union. Investment adviser firms in other EU member states should not assume that the announcement extends to them. A common GDPR framework does not establish that every jurisdiction has the same domestic laws, supervisory structures, or regulatory cooperation arrangements.
The French agreement may offer a model for further regulatory cooperation, but investment adviser applicants elsewhere should evaluate the circumstances applicable to their own jurisdiction.
A French asset management company considering SEC registration should:
Investment adviser firms in France that previously postponed SEC registration because of cross-border information-access concerns should reassess whether an application is now viable.
The October 20, 2026 announcement represents significant progress for AMF-supervised French asset management companies seeking SEC registration. It addresses an important obstacle to application processing while preserving the SEC’s ability to obtain information needed for supervision and examinations.
For covered firms, the practical next step is to confirm the arrangement’s applicability and assess readiness to meet U.S. registration and ongoing compliance obligations. The opportunity is meaningful, but successful registration still requires a complete application and a workable cross-border compliance framework.
This regulatory alert is a summary which is general in nature and offered only for educational purposes. There is no warranty associated with this regulatory alert. It should not be considered as a comprehensive review or analysis of this development. There are certain requirements and exceptions outlined in the rule which are not covered in this regulatory alert. There may be additional obligations and nuances not covered here. Each investment adviser firm is unique, and specific guidance may be required to address your firm’s circumstances. This communication is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation without further analysis. This regulatory alert is not a safe harbor or a legal opinion. Merely reading this regulatory alert does not create an engagement with RIA Compliance Consultants, Inc. The reader should study the actual guidance, rule or enforcement action in detail and consult with his or her legal counsel and compliance professionals. This information in this regulatory alert may become out of date.
The post SEC Opens Path for French Investment Advisers to Register in the United States appeared first on RIA Compliance Consultants.
]]>The Colorado Division of Securities recently implemented one of the most significant changes to the state’s investment adviser licensing framework in years. Effective August 12, 2026, Colorado House Bill 26-1188 amended the Colorado Securities Act by removing the longstanding “place of business” limitation from certain investment adviser licensing and federal covered adviser notice-filing provisions.
The post Colorado Changes Investment Adviser Licensing Requirements – New Notice Filing Rules For SEC Investment Advisers appeared first on RIA Compliance Consultants.
]]>At the same time, the legislation extended Colorado’s existing de minimis exemption to SEC-registered investment advisers—referred to under Colorado law as “federal covered advisers.” As a result, an SEC-registered investment adviser with no place of business in Colorado generally remains exempt from notice filing if it has had no more than five non-institutional Colorado clients during the preceding twelve months.
The Division also issued Interpretive Order No. 2026-IN-001, clarifying when investment adviser representatives of federal covered advisers must become licensed in Colorado.
SEC-registered investment advisers serving Colorado residents should understand both the expanded “transacting business” standard and the important five-client exception.
Historically, Colorado’s notice-filing requirements for federal covered investment advisers generally focused on physical presence. An SEC-registered investment adviser typically became subject to Colorado’s notice-filing requirement if the firm maintained a place of business in Colorado or employed an investment adviser representative with a place of business in the state.
Colorado’s investment adviser representative licensing requirements similarly focused on whether the representative operated from a Colorado place of business.
Under the former statutory framework, an SEC-registered adviser serving Colorado residents remotely could frequently conclude that it was not required to make a Colorado notice filing because neither the firm nor its representatives maintained a place of business in Colorado.
That place-of-business analysis, standing alone, is no longer sufficient.
As part of the state’s 2026 sunset-review legislation, Colorado enacted House Bill 26-1188. Among other changes, the legislation amended Section 11-51-401 of the Colorado Securities Act by removing the place-of-business limitation from the general licensing and notice-filing requirements.
Under the amended provisions:
The statutory change shifts the focus from physical presence to whether the adviser is transacting advisory business in Colorado. An adviser may therefore have a Colorado notice-filing obligation even if it does not maintain an office in the state and serves its Colorado clients entirely through telephone calls, videoconferences, email, or other remote means.
Investment advisers that have acquired Colorado clients through referrals, digital marketing, virtual meetings, or nationwide financial-planning services should re-evaluate any prior conclusion based exclusively on the absence of a Colorado office.
Although House Bill 26-1188 broadened Colorado’s general notice-filing requirement, the legislation also amended Section 11-51-402(5) of the Colorado Securities Act to extend the state’s existing de minimis exemption to federal covered advisers.
Under the amended statute, a federal covered adviser with no place of business in Colorado is exempt from Colorado’s notice-filing requirement if, during the preceding twelve-month period, it has had no more than five Colorado clients other than the institutional clients identified in the statute.
Accordingly, an SEC-registered investment adviser generally is not required to make a Colorado notice filing solely because it provides advisory services to five or fewer non-institutional Colorado clients during the preceding twelve months, provided the adviser has no place of business in Colorado.
This exemption has several important conditions:
For example, an SEC-registered adviser with no Colorado place of business and four individual Colorado clients generally may rely on the exemption. If the adviser accepts two additional non-institutional Colorado clients, bringing its total to six during the applicable twelve-month period, the adviser generally would no longer qualify for the exemption.
Advisers should not interpret the exception as permitting five new clients during each calendar year. Because the statute uses a preceding twelve-month period, firms should monitor their Colorado client count on a rolling basis.
Section 11-51-402(5) also provides an exemption when an out-of-state adviser’s only Colorado clients fall within specified institutional categories.
The statute identifies the following types of clients:
Subject to the statute’s terms, these institutional clients do not count toward the five-client limit. Thus, an adviser could have more than five Colorado relationships and still qualify for the exemption if the additional relationships consist entirely of qualifying institutional clients.
Advisers should carefully confirm that a client satisfies the applicable statutory category before excluding the client from the calculation. In particular, the exemption should not be assumed merely because a client is sophisticated, accredited, wealthy, or organized as a legal entity.
The five-client exemption substantially limits the effect of Colorado’s expanded notice-filing requirement, but the statutory change remains important for SEC-registered advisers serving Colorado residents remotely.
Before House Bill 26-1188, an adviser might have concluded that no Colorado notice filing was required because the firm and its representatives had no place of business in the state. Under the amended law, that conclusion may no longer be correct once the adviser exceeds the five-client threshold or otherwise fails to satisfy Section 11-51-402(5).
In practical terms:
Accordingly, the principal change is not that every SEC-registered adviser with one Colorado client must notice file. Rather, an adviser that does not qualify for the statutory exemption may no longer avoid notice filing solely because it lacks a physical presence in Colorado.
While House Bill 26-1188 potentially expands firm-level filing obligations, Colorado also provided important relief concerning the licensing of investment adviser representatives associated with federal covered advisers.
According to the Division’s accompanying guidance and Interpretive Order No. 2026-IN-001, an investment adviser representative of a federal covered adviser who does not maintain a place of business in Colorado generally is not required to become licensed in the state. The order excludes such an individual from Colorado’s definition of an investment adviser representative of a federal covered adviser for licensing purposes.
In addition, amended Section 11-51-402(6) provides an exemption for investment adviser representatives employed by or associated with an investment adviser or federal covered adviser that qualifies for the exemption under Section 11-51-402(5).
This distinction is important. An SEC-registered adviser may have a Colorado firm-level notice-filing obligation because it has more than five non-institutional Colorado clients, while its representatives may remain exempt from Colorado IAR licensing because they do not have a place of business in the state.
Conversely, an individual who maintains a place of business in Colorado requires a separate licensing analysis. Firms should not assume that the firm’s notice filing automatically satisfies an individual representative’s licensing obligations.
SEC-registered and state-registered investment advisers should consider taking the following steps:
Colorado’s 2026 amendments broaden the circumstances in which an SEC-registered investment adviser may be required to make a Colorado notice filing, but they do not require every out-of-state adviser with a Colorado client to file.
An SEC-registered adviser with no place of business in Colorado generally remains exempt if it has had no more than five non-institutional Colorado clients during the preceding twelve months. Once the adviser accepts a sixth such client, however, the absence of a Colorado office will no longer, by itself, prevent a notice-filing obligation.
Advisers should distinguish among three separate questions:
Each question requires a separate analysis based on the adviser’s particular facts and circumstances.
RIA Compliance Consultants, Inc. helps SEC-registered and state-registered investment advisers evaluate multi-state registration obligations, notice-filing requirements, and investment adviser representative licensing issues.
Contact our team to review your firm’s state registration matrix and determine whether its Colorado relationships qualify for the five-client or institutional-client exemption.
Colorado Proposes Cybersecurity Rule for Investment Adviser Firms
Colorado Requiring New Investment Adviser Applications to Include New ADV Part 2
This post is a brief summary which is general in nature and offered only for informational and educational purposes. It is not intended to constitute legal, regulatory, or compliance advice. The application of federal and state securities laws depends upon the specific facts and circumstances of each investment adviser.
RIA Compliance Consultants, Inc. is not a law firm and does not provide legal services. Investment advisers should consult qualified legal counsel and compliance professionals regarding the implementation of their compliance programs. This blog/newsletter does not create an attorney-client relationship or compliance consulting engagement and does not constitute a legal opinion.
This post is not a safe harbor. The reader should study applicable SEC and state statutes, rules, regulatory requirements and guidance, enforcement actions, and ethics opinions in detail and consult with legal and compliance professionals before implementing any compliance procedures discussed herein. This information may become out of date
The post Colorado Changes Investment Adviser Licensing Requirements – New Notice Filing Rules For SEC Investment Advisers appeared first on RIA Compliance Consultants.
]]>The U.S. Securities and Exchange Commission’s Marketing Rule 206(4)-1 under the Investment Advisers Act of 1940 as amended has now been in effect for several years, yet performance advertising continues to be one of the most frequently cited areas of concern during regulatory examinations. SEC Risk Alerts, enforcement actions, and examination observations demonstrate that many investment advisers continue to struggle with Rule 206(4)-1 compliance including presenting performance information in a manner that fully complies with SEC requirements and expectations.
The post Performance Advertising Remains One of the SEC’s Primary Marketing Rule Focus Areas appeared first on RIA Compliance Consultants.
]]>For many investment adviser firms, the challenge is not whether performance can be advertised. Rather, the challenge is understanding how performance must be presented, documented, reviewed, and supervised before it is used in advertising materials.
When investment advisers think about performance advertising, they often focus only on historical returns. The SEC, however, applies a much broader view.
Performance-related content can include:
In many cases, investment adviser firms create compliance concerns not because the performance information is inaccurate, but because the presentation lacks important context, disclosures, assumptions, limitations, or supporting documentation.
Recent SEC examination findings have highlighted several recurring deficiencies involving performance advertising. Some of the most common concerns include the following.
A strong review process by an investment adviser’s chief compliance officer typically evaluates:
Investment adviser firms should also ensure that reviewers have sufficient training and authority to challenge performance claims before materials are distributed.
Many investment advisers spend significant time developing marketing materials but devote little attention to documenting the review process.
During an examination, regulators typically request the following:
A well-documented review file can help demonstrate that the firm exercised reasonable oversight and followed established compliance procedures.
Performance advertising remains an active examination priority for the SEC. Firms that advertise investment performance should periodically review their marketing practices, internal controls, disclosure language, and recordkeeping procedures to help identify potential gaps before regulators do. As marketing practices evolve and SEC guidance continues to develop, investment advisers should periodically revisit their policies and procedures to ensure they remain consistent with current regulatory expectations.
This post is a brief summary which is general in nature and offered only for educational purposes. It should not be considered a safe harbor or even a recommendation for an investment adviser to introduce, recommend or use a digital estate planning tool. This is not a comprehensive review or analysis of digital estate planning tools, unauthorized practice of law issues, fiduciary obligations, Form ADV disclosure requirements, Regulation S-P, state law, insurance coverage, privacy, cybersecurity, or any particular investment adviser firm’s compliance obligations.
Nothing in this post constitutes an opinion on whether any specific activity constitutes the unauthorized practice of law in any jurisdiction, as UPL standards vary significantly by state. and the particular facts and circumstances of a situation.
This communication is not intended to constitute legal advice, a legal opinion, or compliance consulting advice for any particular firm’s specific situation. RIA Compliance Consultants, Inc. is not a law firm and does not provide legal services. Investment adviser firms should consult with qualified legal counsel regarding unauthorized practice of law issues, estate planning services, state-specific requirements, digital estate planning platforms, client disclosures, contracts, insurance coverage, Regulation S-P obligations, and other legal matters.
This post is not a safe harbor. The reader should study applicable statutes, rules, regulatory guidance, enforcement actions, ethics opinions, and state law in detail and consult with legal and compliance professionals. This information may become out of date.
The post Performance Advertising Remains One of the SEC’s Primary Marketing Rule Focus Areas appeared first on RIA Compliance Consultants.
]]>Missouri has proposed an amendment that would treat an investment adviser’s access to a client account using the client’s own unique identifying information – such as a username and password – as a dishonest or unethical business practice. The proposal has significant implications for investment adviser firms and investment adviser representatives registered with the State of Missouri using, or considering using, third-party account aggregation and account-management technologies to view or manage held-away assets, including employer-sponsored retirement accounts.
The post Missouri Proposes Rule That Deems Investment Adviser’s’ Use of Client Passwords as Unethical appeared first on RIA Compliance Consultants.
]]>The proposal is not yet final. It was published in the Missouri Register on July 1, 2026, and a copy of the proposed rule may be accessed at: https://www.sos.mo.gov/CMSImages/GeneralCounsel/ProposedAmendment-15CSR30-51_172.pdf
Nevertheless, investment advisers registered with Missouri should evaluate their current technology, vendor, and supervisory practices now, particularly where a workflow depends on a client providing credentials to access an account maintained by a retirement-plan recordkeeper, bank, broker-dealer, custodian, or other financial institution.
The rulemaking notice was filed June 1, 2026, and published July 1, 2026. Because the proposal has not been finalized, investment advisers should monitor the rulemaking process and any additional guidance issued by the Missouri Securities Division.
Many advisers use technology tools to help clients and advisers obtain a more complete view of held-away accounts. Depending on the tool and its workflow, these services may be used for account aggregation, financial planning, billing-related reporting, or management of assets held in workplace retirement plans and other accounts outside the adviser’s primary custodial platform.
Missouri previously warned certain state-registered firms regarding tools that rely on client login credentials and that the new proposal would formalize Missouri’s position. The state had previously issued more informal guidance to advisory firms back in 2024 with a message that using third-party tools to access client accounts was unethical. These tools are used by many firms to access a client’s workplace retirement plan data.
The proposed text does not identify particular providers by name. Accordingly, investment advisers should not assume that a vendor’s branding, encryption features, or a client’s authorization alone resolves the issue. The key compliance question is how the investment adviser or its service provider accesses the client account and whether the process uses the client’s unique identifying information.
Missouri investment advisers that use or are evaluating third-party account-management or aggregation tools should consider the following:
Investment adviser firms should begin with a targeted inventory of every technology provider that accesses, receives, aggregates, or acts on held-away account data. The review should document the exact authentication process, who receives or can use client credentials, whether the account institution authorizes the access method, and the scope of activity enabled by the tool.
If the investment adviser firm determines that a current workflow depends on the client’s username or password, it should assess the potential impact of the proposed rule and consider whether an alternative, institution-approved access method is available. Investment adviser firms should also preserve documentation of their analysis and monitor the proposed amendment through the final rulemaking process.
Missouri’s proposal reflects an ongoing regulatory focus on credential sharing, third-party access to client accounts, cybersecurity, fiduciary obligations, and the management of held-away retirement assets. State securities regulators have taken different approaches to these issues, and a practice by an investment adviser that may be accepted in one jurisdiction may receive heightened scrutiny in another.
For that reason, investment advisers should avoid applying a one-size-fits-all approach to third-party account-access technologies. A firm’s analysis should account for the jurisdictions in which it is registered, the specific functionality of the technology, the applicable account-provider terms, and the firm’s own policies and disclosures.
This post is a brief summary which is general in nature and offered only for informational and educational purposes. It is not intended to constitute legal, regulatory, or compliance advice. The application of federal and state securities laws depends upon the specific facts and circumstances of each investment adviser.
RIA Compliance Consultants, Inc. is not a law firm and does not provide legal services. Investment advisers should consult qualified legal counsel and compliance professionals regarding the implementation of their compliance programs. This blog/newsletter does not create an attorney-client relationship or compliance consulting engagement and does not constitute a legal opinion.
This post is not a safe harbor. The reader should study applicable SEC and state statutes, rules, regulatory requirements and guidance, enforcement actions, and ethics opinions in detail and consult with legal and compliance professionals before implementing any compliance procedures discussed herein. This information may become out of date.
The post Missouri Proposes Rule That Deems Investment Adviser’s’ Use of Client Passwords as Unethical appeared first on RIA Compliance Consultants.
]]>Digital estate and legacy planning tools are increasingly being considered by investment adviser firms as part of expanded financial and estate planning services. These digital estate planning tools may offer clients convenience and accessibility, but they can also create significant compliance, fiduciary, unauthorized practice of law (“UPL”), privacy, cybersecurity, insurance coverage, and other liability risks that investment adviser firms should carefully evaluate.
The post Digital Estate Planning Tools: Compliance Risks and Best Practices for Investment Advisers appeared first on RIA Compliance Consultants.
]]>Digital estate planning platforms typically allow users to create wills, trusts, powers of attorney, health care directives, and related documents through an online interface — often without direct attorney involvement. Some platforms offer attorney review as an optional or tiered service. Investment adviser firms may be drawn to these tools as a way to add value to clients, but the compliance implications deserve careful attention.
One of the most significant risks is the unauthorized practice of law. In order to avoid UPL issues, investment adviser representatives who are not licensed attorneys should generally avoid drafting or modifying legal documents or providing legal opinions.
Recommending a digital estate planning platform does not eliminate this risk of UPL. A particularly important boundary involves the platform’s online questionnaire. The client — not the investment adviser representative (IAR) — should be responsible for reading, answering, and completing the questionnaire. The questionnaire often drives the content and structure of the legal documents the platform generates. When an IAR completes or guides a client through the questionnaire, answers questions on the client’s behalf, interprets what a question means, or makes selections within the platform based on the IAR’s own judgment, these actions may expose the IAR to UPL claims depending upon the particular facts and circumstances at hand.
This distinction matters even when the IAR’s involvement is well-intentioned. Helping a client “fill out the form” is not a neutral administrative act when the form determines the structure of a will, trust, or power of attorney. To the extent that an investment adviser firm intends to permit the introduction to or recommendation of such digital estate planning tools, a firm should establish clear written guidance that IARs may introduce a properly vetted and approved platform, explain its general purpose, and assist with basic technical navigation, but the client must independently read and answer each substantive question.
A lower-risk approach is to identify financial planning observations — for example, that a client may wish to review estate planning documents, beneficiary designations, or titling arrangements — and then refer the client to qualified legal counsel. Risk increases when the IAR moves from identifying an issue to preparing the specific legal document for the client.
Digital estate planning platforms may not address all state-specific legal requirements, may not be updated promptly for changes in law, and may not be appropriate for clients with complex circumstances such as blended families, minor children, significant wealth, business interests, special needs planning, or out-of-state property. Documents generated by a digital estate planning platform may be invalid, unenforceable, incomplete, or improperly executed depending upon the circumstances.
Equally important, estate planning platform-generated documents may be inconsistent with a client’s existing documents — such as a prior trust, pour-over will, or existing beneficiary designations — creating conflicts that may not surface until after the client’s death or incapacity.
Investment adviser firms should consider whether digital estate planning tools are appropriate only for a limited client profile, such as clients with relatively simple circumstances, and whether the investment adviser firm should prohibit or discourage use for clients with complex planning needs.
Investment adviser firms owe fiduciary duties to clients. An investment adviser firm that introduces or recommends a digital estate planning platform should be able to demonstrate that the introduction or recommendation was in the client’s best interest, that the firm conducted due diligence, and that the firm disclosed material limitations, conflicts, and compensation arrangements.
Form ADV Part 2A should accurately describe the firm’s use of digital estate planning tools, the limitations of those tools, the firm’s role, any compensation or referral arrangements, and the firm’s recommendation that clients consult qualified legal counsel. A brochure that broadly describes “estate planning” services without explaining the firm’s actual role and the estate planning platform’s limitations may increase compliance and liability risk.
Digital estate planning tools may be more appropriate for some client situations than others. Investment adviser firms should consider whether they will recommend or make available these tools only for clients with relatively simple estate planning needs, and whether clients with more complex circumstances should be referred directly to qualified estate planning counsel. Relevant factors may include blended families, minor children, special needs beneficiaries, closely held business interests, significant wealth, multistate property ownership, charitable planning, prior trusts, tax-sensitive planning, or existing legal disputes. Firms should document the basis for any recommendation and avoid implying that a digital estate planning tool is appropriate for all clients or that such a tool is a substitute for working with legal counsel.
Standard errors and omissions (E&O) insurance policies for investment advisers often exclude legal services, which may be interpreted broadly to include estate planning-related activities. Investment adviser firms should confirm whether their E&O insurance coverage extends to digital estate planning tool recommendations and related services before offering those services to clients.
Digital estate planning platforms collect highly sensitive information about client assets, family members, beneficiaries, health decisions, incapacity planning, and personal identity. For SEC-registered investment advisers, sharing or transmitting this information to a third-party platform vendor implicates the requirements of Regulation S-P, as amended by the SEC’s 2024 amendments that significantly expanded the rule’s scope and obligations.
As of June 2026, the compliance dates for the amended Regulation S-P have arrived for both larger and smaller covered institutions.
Under amended Regulation S-P, SEC-registered investment adviser firms are required to adopt and implement written policies and procedures reasonably designed to safeguard customer records and information. Key obligations that are directly relevant to digital estate planning tool use include:
State-registered investment adviser firms should also review applicable state privacy, cybersecurity, data-breach notification, and UPL requirements, which vary by jurisdiction and may impose independent obligations.
Investment adviser firms should evaluate whether a platform’s privacy and cybersecurity practices are consistent with the firm’s Regulation S-P policies, client expectations, and regulatory obligations. The firm’s vendor oversight program should address data retention, access controls, information-sharing practices, contractual safeguards, and incident response coordination with the platform vendor.
Before introducing or recommending any digital estate planning tool, investment adviser firms should conduct and document due diligence. This should include review of the platform’s legal disclaimers and terms of service, privacy and cybersecurity practices, state-law coverage, attorney involvement or availability, document update process, platform limitations, insurance coverage, complaint history, and data retention and information-sharing practices. For SEC-registered firms, due diligence should also include an assessment of whether the platform’s contractual terms, security practices, breach-notification procedures, and vendor oversight information are consistent with the firm’s Regulation S-P obligations. Due diligence should be revisited periodically.
For investment adviser firms seeking additional guidance, RIA Compliance Consultants, Inc. has prepared a platform-neutral Digital Estate Planning Investment Adviser Due Diligence Checklist to assist firms with this process.
Investment adviser firms should adopt written guidance defining the permissible scope of an investment adviser representative’s involvement with digital estate planning platforms. IARs may introduce a recommended platform, explain its general purpose, and assist with basic technical navigation. However, for purposes of avoiding unauthorized practice of law issues, IARs should not complete the online questionnaire on behalf of a client, answer substantive questions within the platform, interpret what a question means in the context of the client’s legal or family circumstances, or make selections within the platform based on the IAR’s own judgment. The client must independently read, answer, and complete each substantive question. This boundary is essential to managing UPL risk and should be addressed explicitly in firm training and written supervisory procedures.
Investment adviser firms should clearly define what services they provide and what services they do not provide in connection with digital estate planning tools. Client agreements, Form ADV Part 2A, marketing materials, and website content should be consistent and accurate. Firms should disclose that they do not provide legal advice, are not a law firm, and do not verify the legal sufficiency of platform-generated documents.
Regardless of which platform an investment adviser firm introduces or recommends, clients should be encouraged to consult with a qualified estate planning attorney licensed in their jurisdiction before executing any platform-generated legal document. Attorney involvement is especially important for clients with complex family or financial circumstances.
Investment adviser representatives should understand the difference between financial planning education and legal advice, the limitations of digital estate planning platforms, the firm’s written guidance on permissible IAR involvement, and the need to recommend attorney involvement. Training should address prohibited statements, the IAR’s role boundaries with respect to the online questionnaire, documentation standards, client-suitability considerations, and escalation protocols.
Written policies and procedures of an investment adviser should address digital estate planning tool recommendations, vendor due diligence, client disclosures, UPL risk, IAR role boundaries, privacy, and cybersecurity. Form ADV Part 2A should be reviewed for accuracy and consistency with the firm’s actual practices.
RIA Compliance Consultants, Inc. is offering a compliance webinar and IAR CE course that addresses these issues in greater detail:
Estate Planning Services by Investment Advisers: Fiduciary Boundaries, Digital Tools, and UPL Risk
The course is designed for investment adviser representatives, Chief Compliance Officers, firm principals, and other supervised persons involved in financial planning, estate planning-related services, beneficiary reviews, attorney coordination, or digital estate planning tool selection. Topics include fiduciary boundaries, UPL risk, Form ADV disclosure considerations, due diligence, documentation, and best practices.
This post is a brief summary which is general in nature and offered only for educational purposes. It should not be considered a safe harbor or even a recommendation for an investment adviser to introduce, recommend or use a digital estate planning tool. This is not a comprehensive review or analysis of digital estate planning tools, unauthorized practice of law issues, fiduciary obligations, Form ADV disclosure requirements, Regulation S-P, state law, insurance coverage, privacy, cybersecurity, or any particular investment adviser firm’s compliance obligations.
Nothing in this post constitutes an opinion on whether any specific activity constitutes the unauthorized practice of law in any jurisdiction, as UPL standards vary significantly by state. and the particular facts and circumstances of a sitaution.
This communication is not intended to constitute legal advice, a legal opinion, or compliance consulting advice for any particular firm’s specific situation. RIA Compliance Consultants, Inc. is not a law firm and does not provide legal services. Investment adviser firms should consult with qualified legal counsel regarding unauthorized practice of law issues, estate planning services, state-specific requirements, digital estate planning platforms, client disclosures, contracts, insurance coverage, Regulation S-P obligations, and other legal matters.
This post is not a safe harbor. The reader should study applicable statutes, rules, regulatory guidance, enforcement actions, ethics opinions, and state law in detail and consult with legal and compliance professionals. This information may become out of date.
NASAA Disclaimer: NASAA does not endorse any particular provider of IAR CE courses. The content of any course offered by RIA Compliance Consultants, Inc. through CE4Advisers.com and any views expressed therein are our own and do not necessarily reflect the views of NASAA or any of its member jurisdictions.
The post Digital Estate Planning Tools: Compliance Risks and Best Practices for Investment Advisers appeared first on RIA Compliance Consultants.
]]>The compliance deadline for smaller SEC-registered investment advisers under the U.S. Securities and Exchange Commission’s amended Regulation S-P is quickly approaching. Smaller SEC-registered investment advisers — generally those with less than $1.5 billion in regulatory assets under management — must comply with the amended Regulation S-P requirements by June 3, 2026. The SEC announced that smaller entities would have 24 months after Federal Register publication to comply, and the final amendments were published on June 3, 2024.
The post Regulation S-P Compliance Deadline for Smaller Investment Advisers Is Almost Here appeared first on RIA Compliance Consultants.
]]>For many investment adviser firms, these amendments are not merely a “policy update.” They may require a more structured compliance build-out involving a written incident response program, customer notification procedures, service provider oversight, updated due diligence processes, privacy notice review, disposal procedures, training, and testing.
As we discussed in our prior post, Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers, the amended Regulation S-P applies directly to SEC-registered investment advisers, not state-registered investment advisers. However, state securities regulators may view similar information security, cybersecurity, privacy, vendor oversight, and incident response practices as relevant to reasonable supervisory and fiduciary practices.
The compliance dates for the SEC’s amended Regulation S-P requirements are the following:
December 3, 2025 – Large SEC-registered investment advisers with $1.5 billion or more in RAUM; and
June 3, 2026 – Smaller SEC-registered investment advisers with less than $1.5 billion in RAUM.
For smaller SEC-registered investment adviser firms, the June 3, 2026 deadline is now close enough that firms should be focused on finalizing, documenting, and testing implementation rather than merely planning for it.
The SEC’s amended Regulation S-P represents a significant expansion of customer information safeguarding expectations. While each firm’s implementation should be tailored to its business model, technology environment, service providers, and client relationships, the following areas should generally be reviewed.
SEC-registered investment advisers must adopt and maintain a written incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. In practice, this means an investment adviser firm should have a documented process for identifying potential incidents, escalating concerns internally, assessing the scope of affected information, containing the incident, and determining whether customer notification is required.
A written incident response program should generally identify responsible personnel, escalation procedures, investigation steps, containment and control measures, documentation requirements, and post-incident review expectations. SEC-registered investment adviser firms should also consider whether they have tested the plan through a tabletop exercise or similar review.
The amended rule requires covered firms to notify affected individuals as soon as practicable, but no later than 30 days after becoming aware that sensitive customer information was accessed without authorization or was reasonably likely to have been accessed or used without authorization, unless a narrow exception applies.
For this reason, investment adviser firms should not wait until an incident occurs to determine how customer notification decisions will be made. Firms should consider developing procedures for identifying affected individuals, evaluating whether sensitive customer information was involved, determining whether notification is required, coordinating with legal and compliance professionals, and documenting the basis for the firm’s conclusions.
Service provider oversight is now an express part of the Regulation S-P framework. SEC-registered investment adviser firms should review service providers that receive, maintain, process, or otherwise have access to customer information and consider whether the firm has a reasonable basis for believing it will receive timely notice of relevant cybersecurity incidents.
This review may include due diligence questionnaires, contract provisions, vendor cybersecurity materials, business continuity information, incident response representations, SOC reports, portal security documentation, and other risk-based materials.
As discussed in our recent post, Does a Custodian Qualify as a “Service Provider” to an Investment Adviser Under Amended Regulation S-P?, investment advisers should be careful not to treat all third-party relationships as identical. The analysis may differ depending on whether a firm is evaluating traditional custodial services, adviser-facing technology, data feeds, reporting tools, integrations, billing services, or other operational services provided directly to the adviser.
Even where a qualified custodian does not characterize itself as a Regulation S-P service provider in its custodial capacity, investment advisers should still consider the custodian a critical third party for cybersecurity, operational, and incident response purposes.
The amended Regulation S-P requirements also affect privacy notice and disposal considerations. Investment adviser firms should review whether their privacy notice practices remain accurate and whether their written policies address the proper disposal of customer information. The amended rule clarifies that disposal includes discarding, abandoning, selling, donating, or transferring any medium containing customer information.
Chief Compliance Officers of smaller SEC-registered investment adviser firms should consider whether the firm has completed the following steps before the June 3, 2026 compliance deadline:
These steps may help demonstrate that the firm implemented a thoughtful, risk-based compliance process rather than waiting until after an incident or regulatory examination to address the amended requirements.
Although the amended SEC Regulation S-P requirements apply directly to SEC-registered investment advisers, state-registered investment advisers should also pay attention to these developments. State securities regulators may have separate cybersecurity, privacy, information security, books and records, fiduciary, or supervisory expectations that overlap with many of the same concepts.
In addition, state regulators may look to SEC rules, NASAA cybersecurity resources, enforcement actions, and examination practices when evaluating whether a state-registered investment adviser has reasonably protected client information. Accordingly, state-registered investment advisers should consider reviewing their cybersecurity, vendor oversight, incident response, and client notification practices even if the amended SEC rule does not directly apply.
RIA Compliance Consultants, Inc. has prepared updated sample compliance manual sections and supplemental forms to assist investment adviser firms preparing for the amended Regulation S-P requirements.
The available sample materials include:
Sample WSP/CoE – Incident Response Program
Sample WSP/CoE – Information Security Plan
Sample WSP/CoE Section – Service Provider – Due Diligence
Cybersecurity – Best Practices Checklist
Cybersecurity – Best Practices for RIA Collecting Devices for Digital Forensic Expert
Due Diligence – Regulation S-P Service Provider Review Package
Sample WSP/CoE Package – Regulation S-P Policies & Procedures
Regulation S‑P Service Provider Due Diligence & Information Security Bundle
RIA Compliance Consultants, Inc. also offers webinars and training materials addressing the amended Regulation S-P requirements, including incident response, vendor oversight, customer notification, cybersecurity documentation, and implementation considerations.
Recorded Webinar/IAR CE Course: Mastering SEC’s Amendments to Regulation S-P
Where applicable, certain webinars may be eligible for IAR continuing education credit. Please review the applicable product page for credit availability, timing, category, and completion requirements.*
Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers (04/27/2026)
Upcoming Reg S-P Deadline for Large Investment Advisers (11/25/2025)
Regulatory Alert – SEC Amends Reg S-P (05/28/2024)
Investment Advisers Should Review Cybersecurity Incident Response Plans of Vendors (03/21/2020)
NASAA Cybersecurity Model Rule Package (05/31/2019)
This regulatory alert is a brief summary which is general in nature and offered only for educational purposes. It should not be considered as a comprehensive review or analysis of this development. There are certain requirements and exceptions outlined in the rule which are not covered in this regulatory alert. This communication is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation without further analysis.
This regulatory alert is not a safe harbor or a legal opinion. The reader should study the actual guidance, rule or enforcement action in detail and consult with his or her compliance professionals. This information in this regulatory alert may become out of date.
*NASAA Disclaimer: NASAA does not endorse any particular provider of IAR CE courses. The content of any course offered by RIA Compliance Consultants, Inc. through CE4Advisers.com and any views expressed therein are our own and do not necessarily reflect the views of NASAA or any of its member jurisdictions.
The post Regulation S-P Compliance Deadline for Smaller Investment Advisers Is Almost Here appeared first on RIA Compliance Consultants.
]]>As investment adviser firms registered with the U.S. Securities and Exchange Commission (SEC) prepare for compliance with the SEC’s amended Regulation S-P Safeguards Rule, many chief compliance officers are asking an important question:
The post Does a Custodian Qualify as a “Service Provider” to an Investment Adviser Under Amended Regulation S-P? appeared first on RIA Compliance Consultants.
]]>Is a qualified custodian considered a “service provider” to the SEC-registered investment adviser under the amended Safeguards Rule of Regulation S-P?
Recently, one qualified custodian responded to this question by taking the position that, in its custodial and brokerage capacity, it acts as an independent covered institution and not as a “service provider” to the SEC-registered investment adviser for purposes of Regulation S-P. That interpretation appears to have some support under the structure of the amended Safeguards Rule, although the SEC has not provided definitive custodian-specific guidance on the issue, and investment advisers should be careful not to oversimplify the analysis.
The qualified custodian explained that it:
In other words, the custodian is distinguishing itself from a traditional outsourced vendor of an investment adviser.
That distinction matters because the amended rule does not define “service provider” simply as any third party that has access to client or customer information. Under the SEC’s amended Safeguards Rule, a “service provider” generally refers to an entity that receives, maintains, processes, or otherwise is permitted access to customer information, as defined under Regulation S-P, through providing services directly to a covered institution, such as an SEC-registered investment adviser.
The qualified custodian’s position appears to be that:
A broker-dealer, bank or trust company acting as a qualified custodian for account holders may therefore argue that it receives and maintains the information in its own regulated capacity, not as an outsourced function of the investment adviser.
The SEC has not provided a categorical exclusion stating that banks, broker-dealers, or trust companies can never be considered service providers under Regulation S-P. Nor does the amended rule appear to resolve the question solely by entity type.
Importantly, the amended rule and related SEC adopting-release discussion appear to define “service provider” functionally rather than by entity type. In other words, the analysis focuses less on whether an entity is a bank, broker-dealer, or trust company and more on whether the entity receives, maintains, processes, or is otherwise permitted access to customer information through services provided directly to the covered institution.
As a result, a qualified custodian’s position may be more supportable with respect to its core custodial and brokerage functions performed for account holders, while the analysis could differ for adviser-facing services provided directly to the investment adviser.
That distinction matters because many qualified custodians and their affiliates now provide extensive adviser-facing operational and technology infrastructure, including:
Depending on the structure of those services and the related access to customer information, certain investment adviser-facing arrangements may warrant separate analysis under the amended Safeguards Rule.
Accordingly, investment advisers should avoid treating the issue as an “all-or-nothing” determination and instead apply a relationship-specific, risk-based analysis to custodial and related service arrangements.
Rather than taking an “all-or-nothing” approach, investment advisers should adopt a practical, risk-based compliance strategy.
If your qualified custodian provides written clarification regarding its Regulation S-P interpretation, retain that correspondence within your compliance files.
This demonstrates that the investment adviser identified the issue and evaluated it thoughtfully.
Even if the qualified custodian is not formally classified as a Regulation S-P “service provider,” it remains one of the firm’s most important third-party relationships due to:
From a practical compliance standpoint, qualified custodians should remain part of the investment adviser’s broader cybersecurity and third-party/custodian due diligence oversight framework.
Investment advisers should continue reviewing available:
In examinations, securities regulators are increasingly focused on whether firms can demonstrate ongoing third-party and cybersecurity risk evaluation — particularly for critical relationships involving access to sensitive customer information.
Many SEC-registered investment advisers may need to separately analyze whether certain custodian-related services are being provided directly to the adviser rather than solely to account holders.
This review may include:
The legal and operational characterization of those services could differ from the custodian’s traditional brokerage and custody functions.
One practical concern under amended Regulation S-P is incident notification timing and coordination.
Importantly, if the qualified custodian is not a Regulation S-P service provider to the SEC-registered investment adviser in a particular capacity, the amended rule’s 72-hour service-provider notification provision may not directly apply to that custodial relationship. But investment advisers still need timely information to evaluate their own incident-response and client-notification obligations.
Advisers should also recognize that a custodian’s promise to notify investment advisers when individual customer notice is legally required may be narrower than what the investment adviser needs operationally. The investment adviser may need earlier or broader notice to assess whether its own incident-response procedures are implicated.
Advisers may want to ask qualified custodians:
These operational details may become increasingly important as firms refine their incident-response programs.
At this stage, SEC-registered investment advisers likely do not need to challenge a qualified custodian’s interpretation with respect to its core custodial and brokerage functions performed for account holders or insist that the custodian universally characterize itself as a Regulation S-P service provider.
However, investment advisers should recognize that the analysis may differ depending upon the nature of the specific custodial, operational, technology, reporting, integration, or adviser-facing services being provided and the extent to which those services are provided directly to the SEC-registered investment adviser.
Accordingly, SEC registered investment adviser firms should be prepared to demonstrate that they:
As with many areas of cybersecurity regulation, securities regulators will often focus on whether the firm applied a thoughtful, well-documented, risk-based compliance process.
As SEC examinations increasingly focus on cybersecurity governance, incident response, and third-party due diligence, SEC-registered investment advisers should ensure that their Regulation S-P documentation reflects:
Investment adviser firms that proactively document their analysis and compliance approach will likely be in a significantly stronger position during future examinations.
Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers (04/27/2026)
Upcoming Reg S-P Deadline for Large Investment Advisers (11/25/2025)
Regulatory Alert – SEC Amends Reg S-P (05/28/2024)
Investment Advisers Should Review Cybersecurity Incident Response Plans of Vendors (03/21/2020)
NASAA Cybersecurity Model Rule Package (05/31/2019)
Sample WSP/CoE – Incident Response Program
Sample WSP/CoE – Information Security Plan
Sample WSP/CoE Section – Service Provider – Due Diligence
Cybersecurity – Best Practices Checklist
Cybersecurity – Best Practices for RIA Collecting Devices for Digital Forensic Expert
Recorded Webinar/IAR CE Course: Mastering SEC’s Amendments to Regulation S-P
This regulatory alert is a brief summary which is general in nature and offered only for educational purposes. It should not be considered as a comprehensive review or analysis of this development. There are certain requirements and exceptions outlined in the rule which are not covered in this regulatory alert. This communication is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation without further analysis. This regulatory alert is not a safe harbor or a legal opinion. The reader should study the actual guidance, rule or enforcement action in detail and consult with his or her compliance professionals. This information in this regulatory alert may become out of date.
*NASAA Disclaimer: NASAA does not endorse any particular provider of IAR CE courses. The content of any course offered by RIA Compliance Consultants, Inc. through CE4Advisers.com and any views expressed therein are our own and do not necessarily reflect the views of NASAA or any of its member jurisdictions.
The post Does a Custodian Qualify as a “Service Provider” to an Investment Adviser Under Amended Regulation S-P? appeared first on RIA Compliance Consultants.
]]>The compliance clock is ticking—and for many smaller investment advisers, Regulation S-P’s amended requirements are closer than they may seem.
The post Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers appeared first on RIA Compliance Consultants.
]]>The 2024 amendments to Regulation S-P represent the most significant overhaul by the United States Securities and Exchange Commission (“SEC”) of customer information safeguarding obligations in over two decades. As with many major rule changes, investment adviser firms that wait too long to prepare often find themselves scrambling to implement operational and compliance changes under time pressure.
Before diving in, it is important to clarify scope: the amended Regulation S-P applies to SEC-registered investment advisers – not state-registered investment advisers. However, state securities regulators are likely to view these requirements as a benchmark for reasonable data protection practices, and many of the concepts discussed below are directly relevant to state-registered firms.
The SEC published the amended Regulation S-P in the Federal Register on June 3, 2024. The compliance dates for the new requirements under Regulation S-P are the following:
This is not simply a policy update. It is a structural compliance build-out involving incident response, vendor oversight, and documentation.
The amended rule represents a significant expansion of the SEC’s expectations regarding the safeguarding of customer information.
Each SEC-registered investment adviser must adopt and maintain a written Incident Response Program that is reasonably designed to detect unauthorized access to or use of customer information, respond effectively to incidents, recover from cybersecurity events, assess the nature and scope of incidents, and implement appropriate containment and control measures.
As a practical matter, this means that firms should be prepared to assess which systems were accessed, what information was or may have been compromised, how long the exposure lasted, and whether the issue resulted from internal error, an outside threat actor, or some combination of the two. Examples of containment and control actions may include disabling compromised accounts, isolating affected systems, rotating credentials, and enhancing monitoring.
The amended rule requires advisers to notify affected individuals as soon as practicable, but no later than 30 days after becoming aware that sensitive customer information was accessed without authorization or was reasonably likely to have been accessed or used without authorization. A narrow exception may apply where a reasonable investigation determines that the information has not been, and is not reasonably likely to be, used in a manner that could result in substantial harm or inconvenience.
Service-provider oversight is now an express part of the rule framework. If service providers have access to customer information, firms should perform due diligence, monitor vendor controls, and ensure appropriate oversight mechanisms are in place.
Importantly, a firm should have a reasonable basis for believing that it will be notified promptly of a cybersecurity incident involving customer information held by a service provider. That reasonable basis may be established through contractual provisions, due diligence into the service provider’s incident response capabilities, ongoing oversight, or a combination of these measures. In practice, firms should be able to document how they reached that conclusion.
At a minimum, SEC-registered investment adviser firms should ensure their policies and procedures address:
Importantly, policies must reflect how your firm actually operates.
The amended rule clarifies that disposal includes discarding, abandoning, selling, donating, or transferring any medium containing customer information. Advisers must dispose of customer data in a manner that prevents unauthorized access.
Investment adviser firms that wait until the last minute may find that Regulation S-P implementation requires more than expected. Updating a compliance manual is only one part of the process. Many firms will also need to review vendor relationships, revise due diligence questionnaires, enhance incident escalation procedures, conduct training, and test their incident response process through tabletop exercises or similar reviews.
State-registered investment advisers should also pay attention. Although the amended SEC rule does not directly apply to them, the concepts reflected in the amendments may still inform state expectations through fiduciary-duty principles, information security obligations, and examination priorities.
Chief Compliance Offiers should consider the following actions:
These steps will help demonstrate a reasonable compliance effort and readiness for regulatory examinations.
RIA Compliance Consultants, Inc. is hosting the following compliance webinar covering these new requirements:
Date: Wednesday, April 29, 2026
Time: 12:00 – 2:00 p.m. U.S. Central Daylight Time
Description: This two-hour course provides investment adviser representatives, supervisors, and compliance professionals with a comprehensive overview of the SEC’s amendments to Regulation S-P. The course explains the key rule changes, including the requirement to adopt a written incident response program, enhanced customer notification obligations, and expanded oversight of service providers. Participants will gain practical guidance on implementing policies and procedures, updating compliance manuals, and conducting defensible internal reviews aligned with regulatory expectations. Through case studies, the course highlights common deficiencies and how firms can mitigate regulatory and operational risks. The program is designed to equip attendees with actionable steps to strengthen data protection, incident response, and vendor oversight practices within their organizations.
Click here to register.
This webinar has also been approved by NASAA* to provide two IAR CE credit hour in the Products & Practices category. A full explanation of how to receive IAR CE credit for this webinar is provided on the product page, linked above.
To support firms preparing for the amended Regulation S-P requirements:
Investment advisers who have engaged us under our Annual Compliance Program (Bronze, Silver, Gold, Platinum or Titanium Package) can access a sample Incident Response Plan, Information Security Plan and Service Provider – Due Diligence policies specifically designed to address the new requirements, through our Knowledge Base.
Investment advisers not enrolled in our annual program may purchase the sample Incident Response Plan, Information Security Plan and Service Provider – Due Diligence in our online store:
Upcoming Reg S-P Deadline for Large Investment Advisers (11/25/2026)
Regulatory Alert – SEC Amends Reg S-P (05/28/2024)
Investment Advisers Should Review Cybersecurity Incident Response Plans of Vendors (03/21/2020)
NASAA Cybersecurity Model Rule Package (05/31/2019)
Sample WSP/CoE – Incident Response Program
Sample WSP/CoE – Information Security Plan
Sample WSP/CoE Section – Service Provider – Due Diligence
Cybersecurity – Best Practices Checklist
Cybersecurity – Best Practices for RIA Collecting Devices for Digital Forensic Expert
Recorded Webinar/IAR CE Course: Mastering SEC’s Amendments to Regulation S-P
This regulatory alert is a brief summary which is general in nature and offered only for educational purposes. It should not be considered as a comprehensive review or analysis of this development. There are certain requirements and exceptions outlined in the rule which are not covered in this regulatory alert. This communication is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation without further analysis. This regulatory alert is not a safe harbor or a legal opinion. The reader should study the actual guidance, rule or enforcement action in detail and consult with his or her compliance professionals. This information in this regulatory alert may become out of date.
*NASAA Disclaimer: NASAA does not endorse any particular provider of IAR CE courses. The content of any course offered by RIA Compliance Consultants, Inc. through CE4Advisers.com and any views expressed therein are our own and do not necessarily reflect the views of NASAA or any of its member jurisdictions.
The post Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers appeared first on RIA Compliance Consultants.
]]>Question: Did the vacatur of the U.S. Department of Labor’s 2024 fiduciary rule eliminate rollover compliance obligations for investment advisers?
The post Rollover Compliance After the Vacatur of the DOL’s 2024 Fiduciary Rule: What Investment Advisers Need to Know appeared first on RIA Compliance Consultants.
]]>Answer: Not exactly — the 2024 DOL fiduciary rule was vacated, but rollover obligations did not disappear.
The vacatur has created some confusion, particularly around whether a recommendation by an investment adviser to roll over assets from a retirement plan to an individual retirement account (IRA) is still subject to fiduciary standards. In reality, the vacatur did not eliminate the regulatory framework — it shifted it back to a more familiar, but still nuanced, structure.
For ERISA purposes, the analysis reverts to the longstanding 1975 five-part test for investment advice fiduciary status. As a result, some rollover recommendations may fall outside ERISA, while others — particularly those involving an existing investment advisory relationship — may still trigger fiduciary and related compliance obligations depending on the facts.
Here’s how this looks in practice:
Federal courts in Texas vacated the Department of Labor’s 2024 Retirement Security Rule, and the U.S. Court of Appeals for the Fifth Circuit subsequently dismissed the DOL’s appeal, allowing the vacatur to stand. On March 17, 2026, the DOL published a final rule formally removing the 2024 rule from the Code of Federal Regulations and officially restoring the 1975 five-part test for determining ERISA fiduciary status.
As a result, the attempted expansion that would have treated many one-time rollover recommendations as fiduciary advice is no longer in effect.
Importantly, in connection with the final rule, the DOL also declared the entire preamble to Prohibited Transaction Exemption 2020-02 (PTE 2020-02) “no longer reliable.” The DOL explained that the courts’ vacaturs left too much ambiguity regarding what portions of the preamble remained valid, making it necessary to withdraw the preamble in its entirety. The exemption itself, however, remains in effect.
Rollover recommendations may still be subject to ERISA fiduciary standards — but only where the 1975 five-part test is satisfied.
This is a narrower, fact-specific framework. Many one-time rollover recommendations are unlikely to meet the test. However, the analysis is materially different where there is an existing investment advisory relationship.
For example, if an adviser is already providing investment advice to a retirement plan or its participants:
In those cases, if the adviser receives compensation that would otherwise be prohibited (e.g., advisory fees on IRA assets), reliance on PTE 2020-02 may be required. Although the DOL has declared the PTE’s preamble no longer reliable, the exemption’s operative requirements remain in effect, including:
In other words, the vacatur does not eliminate rollover-related compliance obligations where an ongoing advisory relationship exists. It does, however, create some uncertainty about the scope of PTE 2020-02’s application given the loss of the preamble guidance. Advisers should work with ERISA counsel to evaluate their specific facts.
Separate and apart from the DOL framework, rollover recommendations remain subject to the fiduciary duty under the Investment Advisers Act (and, for broker-dealers, Regulation Best Interest).
The SEC’s Investment Adviser/Broker-Dealer Staff Bulletin specifically addresses rollover recommendations and emphasizes that advisers must have a reasonable basis to believe that both:
are in the retail investor’s best interest.
The Staff identifies factors that should generally be considered, including:
The SEC also makes clear that:
You are encouraged to review the bulletin in full: SEC Staff Bulletin — Section 4: Retirement Account Rollover Recommendations
The vacatur narrows when ERISA applies — but it does not reduce regulatory risk around rollover recommendations. In most cases, the safest approach remains the same: perform and document a thorough, client-specific best interest analysis.
The information contained in this post is general in nature intended for educational purposes only and is not a comprehensive analysis of this topic. This is merely a summary and does not necessarily include all material facts from the proceeding. This post is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation. Please consult with legal counsel and refer to the U.S. Department of Labor and the applicable securities regulator’s published guidance for more details about the topics referenced above. For more information about the limitations of this blog post and information on our website, please see our Disclosures webpage.
The post Rollover Compliance After the Vacatur of the DOL’s 2024 Fiduciary Rule: What Investment Advisers Need to Know appeared first on RIA Compliance Consultants.
]]>Artificial intelligence–powered note takers are rapidly finding their way into investment adviser firms. These tools promise efficiency—automated meeting transcripts, summaries, action items, and CRM integration. For busy investment advisers, that convenience is understandably appealing.
The post AI Note Takers for Investment Advisers: Efficiency Tool or Emerging Compliance Risk? appeared first on RIA Compliance Consultants.
]]>From a compliance and legal perspective, however, AI note takers raise important questions that a chief compliance officer of an investment adviser firm should evaluate before widespread adoption. The key issue is whether an investment adviser firm has obtained the necessary consent of participants and implemented the appropriate compliance guardrails, supervision, and documentation to support the use of AI note takers.
Securities regulators have made clear – through guidance, examinations, and enforcement actions of previous innovations – that technology does not reduce an investment adviser’s fiduciary or supervisory obligations.
AI note takers are often viewed as productivity tools, similar to calendar apps or standard CRM systems. That comparison is incomplete.
Unlike traditional tools, AI note takers may:
From a regulatory standpoint, this implicates several core investment adviser compliance areas at once, including:
Importantly, if an investment adviser relies on an AI-generated summary, the firm – not the software provider – remains responsible for the accuracy and completeness of that record.
Common Compliance Gaps
In some cases, AI note takers are adopted before a comprehensive compliance analysis is completed by the investment adviser firm, which can result in the following compliance gaps:
These gaps often stem from treating AI note takers as a convenience rather than as a regulated activity touching multiple compliance obligations.
A prudent compliance approach requires asking the right questions, such as:
These questions should be addressed before a regulatory exam—not for the first time during one.
To help navigate these issues, RIA Compliance Consultants, Inc. is hosting an upcoming educational webinar focused specifically on AI note takers in investment advisory firms.
This online event, Artificial Intelligence Note-Takers: Ethics, Compliance, Privacy, and Legal Guardrails for Investment Adviser, will address the following:
This course content is designed for both investment adviser representatives and compliance leadership and will focus on practical risk management. RIA Compliance Consultants has submitted this course for approval by NASAA* for IAR continuing education credit.
To register for our live webinar, Artificial Intelligence Note-Takers: Ethics, Compliance, Privacy, and Legal Guardrails for Investment Advisers,” on Thursday, January 29, 2026, please click upon the following link: https://www.ria-compliance-consultants.com/product/artificial-intelligence-note-takers-for-investment-advisers/ .
AI tools can be valuable for investment advisers, but convenience does not eliminate responsibility. Investment adviser firms that approach AI note takers with the same rigor they apply to marketing, trading, or recordkeeping are far better positioned to demonstrate good faith compliance if securities regulators come calling. Education, documentation, and supervision remain the compliance foundation for an investment adviser regardless of how advanced the technology becomes.
Privacy Risks and Best Practices for an Investment Adviser Using ChatGPT (09/24/2023)
Previously Recorded IAR CE Course: Artificial Intelligence Issues for IARs
This post is a brief summary which is general in nature and offered only for educational purposes. It should not be considered as a comprehensive review or analysis of this development. There are other regulatory requirements and risks which are not covered in this regulatory alert. This communication is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation without further analysis. This post is not a safe harbor or a legal opinion. The reader should consult with his or her compliance professionals. This information in this post may become out of date.
*NASAA Disclaimer: NASAA does not endorse any particular provider of IAR CE courses. The content of any course offered by RIA Compliance Consultants, Inc. through CE4Advisers.com and any views expressed therein are our own and do not necessarily reflect the views of NASAA or any of its member jurisdictions.
The post AI Note Takers for Investment Advisers: Efficiency Tool or Emerging Compliance Risk? appeared first on RIA Compliance Consultants.
]]>