Who does my compliance when I go independent?

The short answer: Your firm does. Once you register as an investment adviser, Advisers Act Rule 206(4)-7 requires written policies, an annual review, and one named chief compliance officer listed on Form ADV. You can hold that title yourself, hire an employee, outsource it to a fractional CCO, or buy software and keep a consultant on retainer. The work can be delegated. The liability stays with the firm.

Key facts

• The compliance rule (Advisers Act Rule 206(4)-7) requires written policies, an annual review, and a designated chief compliance officer. State rules follow the same shape.
• The CCO is a named natural person, not a department or a vendor entity, and that name sits on Form ADV Part 1 where an examiner reads it first.
• An outsourced CCO is normally made a supervised person or officer of your firm by contract, which is what makes the designation valid.
• No staffing model moves the adviser's liability off the registrant. Vendor indemnities are usually capped at fees paid.
• Fee billing, marketing, code of ethics administration, and electronic communications are the recurring exam themes for small advisers.

<!-- AGL blog | keyword: chief compliance officer small ria | SV: 0/mo | QC: CLEAR | judge: 7.8 | approved: True -->

What does a chief compliance officer actually do?

The compliance rule requires a registered adviser to adopt written policies and procedures reasonably designed to prevent violations of the Advisers Act, review them at least annually for adequacy and effectiveness, and designate one individual as the chief compliance officer responsible for administering them. The SEC's adopting release described the person it had in mind: competent and knowledgeable regarding the Act, and given full responsibility and authority to develop and enforce policy. Both halves matter. Knowledge without authority produces a manual nobody follows.

The word "designate" is doing real work. A firm cannot name a consulting company as its CCO. It names a human, and under the Act that human has to be a supervised person of the adviser, which is why credible outsourced arrangements appoint the outside CCO as an officer of your firm in the engagement agreement. A provider unwilling to be named at Item 1.J of your Form ADV Part 1 is selling you consulting, not the role. That field is public; it is where a deficiency letter goes, and the first thing an examiner checks against whoever answers the phone.

The scaling question comes up constantly with a small RIA: does a firm of one really need all of this? The obligation does not shrink with headcount. What changes is content. The SEC has been explicit that policies must be tailored to the adviser's own business, which cuts both ways: you need fewer policies than a firm with a trading desk, and a purchased manual describing a trading desk you do not have draws its own comment. This is for educational purposes only and is not individualized legal, tax, or compliance advice; a securities attorney and a compliance professional belong in your corner ahead of your filing, not after it.

What are my four options for staffing the CCO role?

Four honest models: you as owner-CCO, an employee CCO, an outsourced or fractional CCO, or a consultant-plus-software hybrid where you keep the title. Most firms cycle through two of them in the first few years.

Holding it yourself costs attention rather than cash, and attention is the resource you have least of in year one. The failure mode is almost never intelligence. It is the calendar. Rule amendments arrive on the regulator's schedule, quarterly reports come due whether or not you traded, and the annual review lands in the same stretch of the year as tax season and your ADV amendment. The tell that a firm has outgrown this model is a compliance manual whose version date matches the registration date.

An employee CCO becomes realistic once there is non-advisory headcount to carry it, and it brings a structural problem worth naming early: the person reviewing the owner's advice reports to the owner. A documented escalation path and an independent annual review make that manageable; pretending it does not exist is how a program hollows out. Pairing the CCO role with billing is a second conflict, since fee accuracy is what the CCO is supposed to test.

An outsourced or fractional CCO is how most small independent firms actually staff this. The SEC staff's guidance on outsourced CCOs is worth reading before you sign anything, because it names what separated the arrangements that worked: frequent and often in-person contact with the firm, direct access to documents and personnel, and real authority to enforce policy. The ones that failed were the ones where the CCO knew the firm only through a questionnaire the firm filled out itself.

The hybrid is a consultant on retainer plus the machinery: an email and text archive, an attestation workflow, a marketing review queue. You keep the title and do the administering; you buy the drafting, the filings, and a second set of eyes on the annual review.

On cost, the shape is more useful than a figure, since providers price on complexity rather than assets alone. Expect a one-time policy build, then a recurring retainer, then a separate line for what people forget to ask about: state notice filings, marketing reviews above a monthly count, mock exams, and exam support.

What can I never hand to somebody else?

Three things stay with you regardless of model, and the first is the only one that shows up in an enforcement caption: the firm's liability. The registrant is the adviser entity, and the fiduciary duty runs from your firm to your client. Your vendor contract runs between you and your vendor, and neither the client nor the regulator is a party to it. Read the limitation-of-liability clause and you will usually find damages capped at fees paid, which is not calibrated to a billing error repeated for three years.

Second is the culture, a soft word for a hard mechanic. Whether policy binds the owner gets settled the first time a policy is inconvenient. A CCO who says no, gets overruled, and documents nothing has taught the firm what the manual is worth, and in a shop of three that spreads in a week.

Third, and the one that trips solo owners: supervision of your own advice. Somebody has to review the recommendations of the person who owns the building, and no monthly call with an outside CCO constitutes supervision of your suitability decisions. What works instead is designed controls that run without a supervisor standing behind you:

• written criteria for what you will and will not recommend
• exception reporting off the custodian's surveillance
• a documented sample review by someone independent of the advice
• an annual review that pulls client files rather than checking a checklist

Write that construction into the manual, because an examiner will ask what it is. On enforcement posture, the Commission has said it does not second-guess a CCO's good-faith judgment calls, and it has charged compliance officers who wholly failed to implement the program they owned. Holding the title with no intention of doing the work is where the personal risk actually sits.

What lands on the compliance calendar every year?

The recurring obligations are finite, boring, and testable from documents, which is why examiners start there. Six things drive the calendar for a small RIA.

The code of ethics (Rule 204A-1) requires access persons to file an initial holdings report within ten days of becoming one, holdings annually thereafter, and transaction reports quarterly within thirty days of quarter end. In a one-person firm you are the access person, and you still produce the reports and retain them. This is the item most self-filers skip, and it takes an examiner an hour to test against your brokerage statements.

Books and records (Rule 204-2) sets retention at five years, the first two in an easily accessible place. That obligation is now mostly electronic: business conversations on a personal phone are a records problem before they are anything else, and off-channel communications remain an exam priority.

The annual review must consider issues that arose during the year, changes in your business, and changes in the rules. Document it. A review whose report contains no findings reads, to someone who does this for a living, like a review that did not happen.

Form ADV requires an annual updating amendment within ninety days of your fiscal year end, plus prompt amendments to certain Part 1 items when they change, including custody and disciplinary events. Part 2A's summary of material changes goes to clients each year.

Privacy and safeguards under Regulation S-P now reach past the annual notice into a written incident response program and a duty to notify affected customers.

The marketing rule (Rule 206(4)-1) governs testimonials, endorsements, third-party ratings, and performance. Two mechanics catch small firms: promoter arrangements generally require a written agreement and disclosure at the time of the endorsement, and any stated fact in an advertisement must be substantiable on demand. A client quote on your site is an advertisement.

What changes if I'm a hybrid RIA with a broker-dealer affiliation?

Keeping a securities registration gives you two compliance programs rather than one, and the question that governs your daily life is which program owns each piece of your business. The broker-dealer supervises brokerage activity under FINRA's supervision rule. Your advisory business still needs its own designated CCO if the RIA is yours.

The pivot point is whether advisory work runs through the broker-dealer's corporate RIA or through your own. Under the corporate RIA, their manual governs, their queue reviews your marketing, their fee schedule constrains your pricing, and their ADV gets amended. With your own RIA you own all of that, but the broker-dealer will require the entity to be disclosed as an outside business activity, will usually claim review rights over your advertising and correspondence, and often routes advisory email through their archive. Advisory business conducted for compensation away from an approving firm is the classic selling-away exposure, so the approval letter matters more than the logo on the door.

Two smaller mechanics generate outsized findings. Disclosure symmetry: a customer complaint, a lien, or a bankruptcy appears on both your Form U4 and your Form ADV, and a mismatch is the easiest deficiency an examiner will write all week. Duplication: two codes of ethics, two archives, two annual reviews, and two exam cycles, since a FINRA cycle exam and an adviser exam are separate events with separate document requests. Insurance sits alongside all of it, licensed at the state level and disclosed as a compensation conflict in your ADV.

How do I tell a good outsourced compliance provider from a bad one?

Judge a provider on the answers to six questions they will not volunteer:

• Which specific human is my CCO, and how many other firms does that person carry?
• Will they be named on my Form ADV and appointed as an officer of my firm?
• Do they sit in the room during an exam — and can they name clients who did?
• Who drafts the annual review, and what does a finding look like when they write it?
• Do they pull data directly from my custodian, billing system, and archive — or send a questionnaire and rely on my answers?
• Will they tell me no? And when did that last happen with a client? This one predicts everything.

Two non-obvious asks. Request a redacted annual review the provider wrote for a firm your size; the document tells you within a page whether you are buying a program or a subscription. And confirm records portability in writing, because the retention obligation belongs to your firm, not the vendor holding the files. Firms discover that gap in the week they change providers and an exam letter arrives.

Software gets one question of its own: does it capture text messages as well as email, and export them in a form an examiner will accept. Software is very good at custody of evidence. It signs nothing and answers nothing.

What does an SEC or state exam actually look at?

An exam opens with a document request list that reads like a table of contents for your program, on a short response window:

• Form ADV and brochures
• the compliance manual and code of ethics
• the annual review
• advisory agreements
• fee billing detail
• personal trading reports
• marketing materials
• electronic communications

What follows is testing rather than reading. Staff recompute a sample of advisory fees against the executed agreement, match marketing claims against the ADV, run code of ethics reports against brokerage records, and look for the business conversations that happened by text.

Fee billing is where small advisers most often get written up, and the exam division's risk alert on advisory fees and expenses laid out the patterns: fees calculated on a different value than the agreement specifies, householding applied inconsistently, refunds missed on mid-period termination, and ADV disclosure that does not match the invoice. The division's observations on compliance programs described CCOs stretched across too many roles and short on authority.

Most exams end with a deficiency letter and your written response. The useful preparation drill costs nothing: take a standard request list, set a one-week clock, and produce every item from your own files. Whatever you cannot produce is your program's actual gap, regardless of what the manual says.

State exams differ in texture. They tend to be on-site, cyclical, and focused on the advisory agreement, fee disclosure, brochure delivery, custody triggers such as direct fee deduction, and that state's financial or bonding condition. Which regulator you answer to turns on the size of your advisory business, a threshold worth confirming with whoever holds your CCO title.

Frequently asked questions

How much does a compliance consultant cost?

Providers price on complexity rather than assets alone, so the structure is more predictable than the number: a one-time policy build, then a recurring retainer, then extras. Ask what falls outside the retainer, because state notice filings, marketing reviews, mock exams, and exam support are commonly billed separately.

Can I keep selling insurance as an RIA or hybrid?

Generally yes, subject to your state insurance licensing and, for variable products, your broker-dealer's or general agent's requirements. The compliance work is conflict disclosure: commission compensation belongs in your Form ADV and in a plain client conversation, and your policies should say how a recommendation that pays a commission gets documented.

How difficult is it to start an RIA?

The filing is procedural. The hard part is the compliance function that starts operating the day you register: a tailored manual, a code of ethics with reports actually filed, an archive that captures texts, a billing process you can recompute, and a CCO with time to do the work. Firms that struggle underestimated the second list.

How does a captive insurance advisor become an independent RIA?

The sequence runs entity and registration, then compliance infrastructure, then the client conversations, with the staffing decision made at the front. The complication specific to captive backgrounds is the existing agreement: restrictive covenants, non-solicit terms, and ownership of client information vary widely, and reading yours is work for a securities attorney.

Can my outsourced CCO handle the exam for me?

They can prepare the response, assemble the production, and sit through the interviews with you, and a good one does all three. They cannot answer for how your firm actually operated, and examiners direct the substantive questions to you.

If you're weighing how to staff this, the CCO staffing checklist and the two-minute assessment are both free on the Advisor Growth Lab site.