{ "schemaVersion": "1.0.0", "releaseVersion": null, "status": "draft", "publishedAt": null, "updatedAt": null, "notice": "Not legal advice. This tool provides general planning guidance, not a compliance assessment, official regulator checklist or guarantee of any outcome. Confirm requirements for your own firm and circumstances in the official sources and with appropriate advisers.", "attribution": "Taft Compliance Group. Original guidance is Taft's own and cites no source; each requirement record cites the official text it quotes.", "reuseTerms": "Undecided: not approved for public release.", "scope": { "audiences": [ "Incoming and new Chief Compliance Officers", "Founders hiring a compliance lead" ], "inclusions": [ "Original practitioner guidance for planning the first hundred days", "Firm-type and perspective tags that express relevance", "Sourced requirement records for SEC-registered investment advisers and money services businesses, quoted from the current eCFR text and linked from the guidance steps they relate to" ], "exclusions": [ "Requirements without a binding official source", "Legal applicability determinations", "Deadline calculations of any kind", "State registration regimes, bank regulators and self-regulatory organization rules" ], "geographyNote": "Legal geography and registration scope remain open. Firm types are relevance filters: not every RIA is SEC-registered, not every fintech is an MSB, not every user is US-regulated, and a bank partner's duties do not pass to a service provider. The requirement records in this plan quote United States federal rules only." }, "firmTypes": [ { "id": "ria", "label": "RIA", "description": "Investment advisers. Registration status and regulator are not assumed." }, { "id": "broker-dealer", "label": "Broker-dealer", "description": "Broker-dealers and firms with brokerage activity." }, { "id": "fintech-msb", "label": "Fintech / MSB", "description": "Payments, lending and money services businesses. MSB status is not assumed." }, { "id": "bank-adjacent", "label": "Bank-adjacent", "description": "Firms operating with or through banking partners. Partner duties do not transfer by assumption." } ], "perspectives": [ { "id": "cco", "label": "CCO" }, { "id": "founder", "label": "Founder" } ], "phases": [ { "id": "days-1-30", "order": 1, "label": "Days 1 to 30: understand and establish", "dayStart": 1, "dayEnd": 30, "summary": "Learn the business as it operates, find the existing program and agree how the role works. A suggested planning band, not a deadline." }, { "id": "days-31-60", "order": 2, "label": "Days 31 to 60: test and prioritize", "dayStart": 31, "dayEnd": 60, "summary": "Look at a sample of controls and evidence, map risks and interfaces, and agree what to address first. A suggested planning band, not a deadline." }, { "id": "days-61-100", "order": 3, "label": "Days 61 to 100: report and follow through", "dayStart": 61, "dayEnd": 100, "summary": "Brief management, propose a rhythm, check what changed and agree the next stage. A suggested planning band, not a deadline." } ], "sources": [ { "id": "src-17cfr-275-206-4-7", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-7", "publisher": "Office of the Federal Register, eCFR", "title": "17 CFR 275.206(4)-7 Compliance procedures and practices", "sourceKind": "rule", "publishedDate": null, "effectiveDate": null, "checkedAt": "2026-11-09", "locator": "§ 275.206(4)-7, introductory text and paragraphs (a) to (c)", "passage": "If you are an investment adviser registered or required to be registered under section 203 of the Investment Advisers Act of 1940 (15 U.S.C. 80b-3), it shall be unlawful within the meaning of section 206 of the Act (15 U.S.C. 80b-6) for you to provide investment advice to clients unless you: (a) Policies and procedures. Adopt and implement written policies and procedures reasonably designed to prevent violation, by you and your supervised persons, of the Act and the rules that the Commission has adopted under the Act; (b) Annual review. Review, no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation; and (c) Chief compliance officer. Designate an individual (who is a supervised person) responsible for administering the policies and procedures that you adopt under paragraph (a) of this section." }, { "id": "src-17cfr-275-204-1", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-1", "publisher": "Office of the Federal Register, eCFR", "title": "17 CFR 275.204-1 Amendments to Form ADV", "sourceKind": "rule", "publishedDate": null, "effectiveDate": null, "checkedAt": "2026-11-09", "locator": "§ 275.204-1(a)", "passage": "(a) When amendment is required. You must amend your Form ADV (17 CFR 279.1): (1) Parts 1 and 2: (i) At least annually, within 90 days of the end of your fiscal year; and (ii) More frequently, if required by the instructions to Form ADV. (2) Part 3 at the frequency required by the instructions to Form ADV." }, { "id": "src-17cfr-275-204a-1", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.204A-1", "publisher": "Office of the Federal Register, eCFR", "title": "17 CFR 275.204A-1 Investment adviser codes of ethics", "sourceKind": "rule", "publishedDate": null, "effectiveDate": null, "checkedAt": "2026-11-09", "locator": "§ 275.204A-1(a), introductory text and paragraphs (a)(1) to (a)(3)", "passage": "(a) Adoption of code of ethics. If you are an investment adviser registered or required to be registered under section 203 of the Act (15 U.S.C. 80b-3), you must establish, maintain and enforce a written code of ethics that, at a minimum, includes: (1) A standard (or standards) of business conduct that you require of your supervised persons, which standard must reflect your fiduciary obligations and those of your supervised persons; (2) Provisions requiring your supervised persons to comply with applicable Federal securities laws; (3) Provisions that require all of your access persons to report, and you to review, their personal securities transactions and holdings periodically as provided below;" }, { "id": "src-17cfr-275-204a-1-b", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.204A-1", "publisher": "Office of the Federal Register, eCFR", "title": "17 CFR 275.204A-1 Investment adviser codes of ethics", "sourceKind": "rule", "publishedDate": null, "effectiveDate": null, "checkedAt": "2026-11-09", "locator": "§ 275.204A-1(a)(4) and (a)(5)", "passage": "(4) Provisions requiring supervised persons to report any violations of your code of ethics promptly to your chief compliance officer or, provided your chief compliance officer also receives reports of all violations, to other persons you designate in your code of ethics; and (5) Provisions requiring you to provide each of your supervised persons with a copy of your code of ethics and any amendments, and requiring your supervised persons to provide you with a written acknowledgment of their receipt of the code and any amendments." }, { "id": "src-17cfr-275-204-2", "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2", "publisher": "Office of the Federal Register, eCFR", "title": "17 CFR 275.204-2 Books and records to be maintained by investment advisers", "sourceKind": "rule", "publishedDate": null, "effectiveDate": null, "checkedAt": "2026-11-09", "locator": "§ 275.204-2(e)(1)", "passage": "(e)(1) All books and records required to be made under the provisions of paragraphs (a) to (c)(1)(i), inclusive, and (c)(2) of this section (except for books and records required to be made under the provisions of paragraphs (a)(11), (a)(12)(i), (a)(12)(iii), (a)(13)(ii), (a)(13)(iii), (a)(16), and (a)(17)(i) of this section), shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser." }, { "id": "src-31cfr-1022-210", "url": "https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/section-1022.210", "publisher": "Office of the Federal Register, eCFR", "title": "31 CFR 1022.210 Anti-money laundering programs for money services businesses", "sourceKind": "rule", "publishedDate": null, "effectiveDate": null, "checkedAt": "2026-11-09", "locator": "§ 1022.210(a) to (c)", "passage": "(a) Each money services business, as defined by § 1010.100(ff) of this chapter, shall develop, implement, and maintain an effective anti-money laundering program. An effective anti-money laundering program is one that is reasonably designed to prevent the money services business from being used to facilitate money laundering and the financing of terrorist activities. (b) The program shall be commensurate with the risks posed by the location and size of, and the nature and volume of the financial services provided by, the money services business. (c) The program shall be in writing, and a money services business shall make copies of the anti-money laundering program available for inspection to the Department of the Treasury upon request." }, { "id": "src-31cfr-1022-210-d", "url": "https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/section-1022.210", "publisher": "Office of the Federal Register, eCFR", "title": "31 CFR 1022.210 Anti-money laundering programs for money services businesses", "sourceKind": "rule", "publishedDate": null, "effectiveDate": null, "checkedAt": "2026-11-09", "locator": "§ 1022.210(d)(1), (d)(2), (d)(3) and (d)(4)", "passage": "(d) At a minimum, the program shall: (1) Incorporate policies, procedures, and internal controls reasonably designed to assure compliance with this chapter. (2) Designate a person to assure day to day compliance with the program and this chapter. (3) Provide education and/or training of appropriate personnel concerning their responsibilities under the program, including training in the detection of suspicious transactions to the extent that the money services business is required to report such transactions under this chapter. (4) Provide for independent review to monitor and maintain an adequate program." }, { "id": "src-31cfr-1022-380", "url": "https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/section-1022.380", "publisher": "Office of the Federal Register, eCFR", "title": "31 CFR 1022.380 Registration of money services businesses", "sourceKind": "rule", "publishedDate": null, "effectiveDate": null, "checkedAt": "2026-11-09", "locator": "§ 1022.380(a)(1) and (b)(3)", "passage": "Except as provided in paragraph (a)(3) of this section, relating to agents, and except for sellers of prepaid access as defined in § 1010.100(ff)(7) of this chapter to the extent that they are not already agents, each money services business (whether or not licensed as a money services business by any State) must register with FinCEN. Each money services business must, as part of its registration, maintain a list of its agents as required by 31 U.S.C. 5330 and this section. (3) Due date. The registration form for the initial registration period must be filed on or before the end of the 180-day period beginning on the day following the date the business is established. The registration form for a renewal period must be filed on or before the last day of the calendar year preceding the renewal period." } ], "tasks": [ { "id": "confirm-mandate", "phaseId": "days-1-30", "order": 1, "title": "Confirm the mandate and decision routes", "explanation": "Discuss what the role owns, what management owns and how disagreements are raised and resolved. Write down what is still unclear rather than assuming it.", "output": "Draft role and decision map, with the unresolved questions listed.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "governance" ], "kind": "guidance", "applicability": "", "caveats": [ "A written mandate is a working agreement inside the firm, not a regulatory determination of the role." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "map-business", "phaseId": "days-1-30", "order": 2, "title": "Map the business as it operates", "explanation": "List products, customers, legal entities, locations, partners and the money and data flows between them, then walk the list with the teams who run each part.", "output": "Business map with the gaps still to verify marked on it.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "business-understanding" ], "kind": "guidance", "applicability": "", "caveats": [ "The map describes what the firm does; it does not decide which regimes apply." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "gather-program", "phaseId": "days-1-30", "order": 3, "title": "Locate the current program and its history", "explanation": "Ask where policies, prior reviews, issue logs and management reporting are kept, and who owns each. Record what is missing as missing; never backdate or reconstruct a record.", "output": "Inventory of the program's documents and a gaps list.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco" ], "topics": [ "program-inventory" ], "kind": "guidance", "applicability": "", "caveats": [ "An inventory is not a judgement of adequacy.", "Related sourced requirement records, by firm type: req-ria-written-policies and req-ria-designate-cco for SEC-registered advisers; req-msb-aml-program for money services businesses. Relevance, not a finding that either regime applies." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "req-ria-written-policies", "req-ria-designate-cco", "req-msb-aml-program" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "triage-existing-commitments", "phaseId": "days-1-30", "order": 4, "title": "Identify dates and issues already in motion", "explanation": "Ask the existing owners about actual regulatory correspondence, filing calendars, open incidents and commitments the firm has already made, and who is handling each.", "output": "Priority list verified by the firm's own records; this tool calculates no legal deadline.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "obligations" ], "kind": "guidance", "applicability": "Which dates are binding depends on the firm's actual obligations and correspondence, which need confirmation.", "caveats": [ "Existing obligations and urgent issues may require action before any planning band suggests it.", "Related sourced requirement records, by firm type: req-ria-adv-annual-amendment for SEC-registered advisers; req-msb-registration for money services businesses. Relevance, not a finding that either regime applies." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "req-ria-adv-annual-amendment", "req-msb-registration" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "map-authorities", "phaseId": "days-1-30", "order": 5, "title": "Identify which regimes need confirmation", "explanation": "Record the registrations and permissions the firm says it holds, where each is evidenced, and the questions a qualified reviewer needs to answer. A label such as RIA or fintech does not settle applicability.", "output": "Perimeter questions and a source-verification queue.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco" ], "topics": [ "obligations" ], "kind": "guidance", "applicability": "Legal geography and registration scope are open questions for the firm and its advisers.", "caveats": [ "Do not assume a US regime, an MSB status or a bank partner's duties from the firm type alone." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "map-business" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "agree-resourcing", "phaseId": "days-1-30", "order": 6, "title": "Discuss access, people and resources for the work", "explanation": "Identify the systems, data and people the work needs, the information gaps, and the decisions the incoming person cannot resolve alone.", "output": "Resourcing discussion note and the questions to escalate.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "resourcing" ], "kind": "guidance", "applicability": "", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "confirm-mandate" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "req-ria-written-policies", "phaseId": "days-1-30", "order": 7, "title": "Rule text: written compliance policies and procedures (SEC-registered advisers)", "explanation": "The Advisers Act compliance rule makes it unlawful for an adviser registered or required to be registered under section 203 to provide investment advice unless it adopts and implements written policies and procedures reasonably designed to prevent violation, by the adviser and its supervised persons, of the Act and the Commission's rules under it. This record quotes the rule; it does not decide whether your firm is such an adviser.", "output": "Confirmation, in the firm's own records, of where the written policies and procedures are and when they were adopted.", "firmTypes": [ "ria" ], "perspectives": [ "cco", "founder" ], "topics": [ "compliance-rule" ], "kind": "requirement", "applicability": "Investment advisers registered or required to be registered with the SEC under section 203 of the Advisers Act. Registration status is confirmed, not assumed from the RIA label.", "caveats": [ "State-registered advisers follow their state's rules, which this record does not cover." ], "sourceIds": [ "src-17cfr-275-206-4-7" ], "evidenceLocators": [ "§ 275.206(4)-7(a)" ], "lastChecked": "2026-11-09", "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "req-ria-designate-cco", "phaseId": "days-1-30", "order": 8, "title": "Rule text: designation of a chief compliance officer (SEC-registered advisers)", "explanation": "The same compliance rule requires the adviser to designate an individual, who is a supervised person, responsible for administering the policies and procedures adopted under paragraph (a) of the rule. Apart from the paragraph heading, Chief compliance officer, the quoted rule text does not prescribe the role's title, seniority or reporting line.", "output": "The firm's record of who is designated and when the designation was made.", "firmTypes": [ "ria" ], "perspectives": [ "cco", "founder" ], "topics": [ "compliance-rule", "governance" ], "kind": "requirement", "applicability": "Investment advisers registered or required to be registered with the SEC under section 203 of the Advisers Act.", "caveats": [ "Whether a fractional or outsourced arrangement meets the rule is a question for the firm and its advisers; this record quotes the rule only." ], "sourceIds": [ "src-17cfr-275-206-4-7" ], "evidenceLocators": [ "§ 275.206(4)-7(c)" ], "lastChecked": "2026-11-09", "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "req-ria-adv-annual-amendment", "phaseId": "days-1-30", "order": 9, "title": "Rule text: Form ADV annual updating amendment (SEC-registered advisers)", "explanation": "Advisers Act Rule 204-1 requires an adviser to amend Parts 1 and 2 of its Form ADV at least annually, within 90 days of the end of its fiscal year, and more frequently if the Form ADV instructions require. Part 3 is amended at the frequency the form instructions require. This tool calculates no date; the firm's fiscal year end and its own filing calendar govern.", "output": "The firm's fiscal year end and the dates of its last annual updating amendment and any other-than-annual amendments, taken from the firm's own filing records.", "firmTypes": [ "ria" ], "perspectives": [ "cco", "founder" ], "topics": [ "form-adv", "filings" ], "kind": "requirement", "applicability": "Advisers that file Form ADV with the SEC.", "caveats": [ "The rule states 90 days without saying business or calendar days." ], "sourceIds": [ "src-17cfr-275-204-1" ], "evidenceLocators": [ "§ 275.204-1(a)" ], "lastChecked": "2026-11-09", "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "req-msb-registration", "phaseId": "days-1-30", "order": 10, "title": "Rule text: registration of money services businesses with FinCEN", "explanation": "Under 31 CFR 1022.380, each money services business, with the stated exceptions for agents and certain sellers of prepaid access, must register with FinCEN and must maintain a list of its agents as part of its registration. The registration form for the initial registration period must be filed on or before the end of the 180-day period beginning on the day following the date the business is established, and a renewal form on or before the last day of the calendar year preceding the renewal period.", "output": "The firm's written analysis of whether it is a money services business, and if so, its registration record and renewal calendar.", "firmTypes": [ "fintech-msb" ], "perspectives": [ "cco", "founder" ], "topics": [ "msb-registration", "financial-crime" ], "kind": "requirement", "applicability": "Money services businesses as defined in 31 CFR 1010.100(ff). Whether a fintech is an MSB is a perimeter question the firm confirms with its advisers; the Fintech / MSB label does not settle it.", "caveats": [ "A person that is an MSB solely as an agent of another MSB is addressed separately in the rule.", "The rule states a 180-day period without saying business or calendar days." ], "sourceIds": [ "src-31cfr-1022-380" ], "evidenceLocators": [ "§ 1022.380(a)(1) and (b)(3)" ], "lastChecked": "2026-11-09", "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "req-msb-aml-program", "phaseId": "days-1-30", "order": 11, "title": "Rule text: anti-money laundering program of a money services business", "explanation": "Under FinCEN's rule at section 1022.210 of chapter X, each money services business shall develop, implement and maintain an effective written anti-money laundering program, commensurate with its risks, that at a minimum incorporates policies, procedures and internal controls, designates a person to assure day to day compliance, provides education or training of appropriate personnel, and provides for independent review to monitor and maintain an adequate program.", "output": "Location and date of the firm's written AML program and the name of the role designated to assure day to day compliance, from the firm's own records.", "firmTypes": [ "fintech-msb" ], "perspectives": [ "cco", "founder" ], "topics": [ "aml-program", "financial-crime" ], "kind": "requirement", "applicability": "Money services businesses as defined in § 1010.100(ff) of chapter X. Whether the firm is an MSB is confirmed separately.", "caveats": [ "The rule's detailed program elements in paragraph (d)(1)(i) to (iv) are not reproduced in full here; read the rule text.", "A bank partner's own program obligations do not pass to the firm by assumption, and bank requirements are not covered by this record." ], "sourceIds": [ "src-31cfr-1022-210", "src-31cfr-1022-210-d" ], "evidenceLocators": [ "§ 1022.210(a) to (c)", "§ 1022.210(d)(1) to (d)(4)" ], "lastChecked": "2026-11-09", "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "map-risk-and-conflicts", "phaseId": "days-31-60", "order": 1, "title": "Draft a business-specific risk and conflicts inventory", "explanation": "Walk through where the actual products, relationships and incentives could create problems, with the people closest to them. Prioritize what to look at, not what to certify.", "output": "Prioritized questions and the evidence to inspect; not a risk certification.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco" ], "topics": [ "risk" ], "kind": "guidance", "applicability": "", "caveats": [ "An inventory of questions is not a risk assessment that any regime may require; that is a separate, scoped piece of work." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "map-business" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "sample-controls", "phaseId": "days-31-60", "order": 2, "title": "Inspect a small, explained sample of controls and evidence", "explanation": "Choose a few areas based on the firm's own issues and priorities, look at the evidence that exists, and record what was tested and what was not.", "output": "Sample and testing log with its limitations stated.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco" ], "topics": [ "testing" ], "kind": "guidance", "applicability": "", "caveats": [ "A small sample shows what it shows; it does not establish that controls work.", "Related sourced requirement records for SEC-registered advisers, often useful when choosing a sample: req-ria-code-of-ethics and req-ria-records-retention. Relevance, not a finding that the rules apply." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "gather-program", "req-ria-code-of-ethics", "req-ria-records-retention" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "reconcile-disclosures", "phaseId": "days-31-60", "order": 3, "title": "Compare the business description with disclosures and communications", "explanation": "Read what the firm tells clients, regulators and the public against the business map, and flag differences for the right reviewer. Do not rewrite a filing on your own.", "output": "Discrepancy list and the decision route responsible for each item.", "firmTypes": [ "ria", "broker-dealer" ], "perspectives": [ "cco" ], "topics": [ "disclosures" ], "kind": "guidance", "applicability": "Which disclosures exist, and who may amend them, depends on the firm's registrations.", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "map-business" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "map-partner-interfaces", "phaseId": "days-31-60", "order": 4, "title": "Clarify interfaces with banking and operating partners", "explanation": "Discuss responsibilities, contractual handoffs and the unanswered questions on each partner relationship, without assuming one party's regulatory duties transfer to another.", "output": "Interface map and open questions.", "firmTypes": [ "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "partners" ], "kind": "guidance", "applicability": "Partner contracts and the partner's own regime decide who owes what; confirm rather than infer.", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "map-business" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "review-financial-crime-workflow", "phaseId": "days-31-60", "order": 5, "title": "Understand the existing financial-crime workflow where relevant", "explanation": "Ask who runs onboarding, monitoring and escalations today, what tools and records they use, and where applicability still needs confirmation.", "output": "Workflow map and evidence gaps; not a statement of a universal AML requirement.", "firmTypes": [ "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco" ], "topics": [ "financial-crime" ], "kind": "guidance", "applicability": "Whether, and which, financial-crime obligations apply is a perimeter question to confirm.", "caveats": [ "Related sourced requirement record for money services businesses: req-msb-aml-program. Bank-adjacent firms confirm their own position; bank rules are not covered here." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "map-authorities", "req-msb-aml-program" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "agree-priority-work", "phaseId": "days-31-60", "order": 6, "title": "Agree which gaps to address first", "explanation": "Discuss severity, dependencies, who decides and what the practical next action is for each gap found so far.", "output": "Management-agreed work queue; not a claim that everything can be remediated by a given day.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "prioritization" ], "kind": "guidance", "applicability": "", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "sample-controls", "map-risk-and-conflicts" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "req-ria-code-of-ethics", "phaseId": "days-31-60", "order": 7, "title": "Rule text: written code of ethics (SEC-registered advisers)", "explanation": "Advisers Act Rule 204A-1 requires an adviser registered or required to be registered under section 203 to establish, maintain and enforce a written code of ethics that, at a minimum, includes a standard of business conduct reflecting its fiduciary obligations, provisions requiring supervised persons to comply with applicable Federal securities laws, provisions requiring access persons to report and the adviser to review personal securities transactions and holdings, provisions requiring supervised persons to report any violations of the code promptly to the chief compliance officer or other designated persons, and provisions requiring the adviser to provide each supervised person with the code and its amendments and to obtain written acknowledgment of receipt.", "output": "Location of the current code, the list of access persons and the most recent acknowledgments, from the firm's own records.", "firmTypes": [ "ria" ], "perspectives": [ "cco" ], "topics": [ "code-of-ethics" ], "kind": "requirement", "applicability": "Investment advisers registered or required to be registered with the SEC under section 203 of the Advisers Act.", "caveats": [ "Report timing and content requirements sit in paragraph (b) of the rule and are quoted in the exam-prep toolkit's deadline references rather than here." ], "sourceIds": [ "src-17cfr-275-204a-1", "src-17cfr-275-204a-1-b" ], "evidenceLocators": [ "§ 275.204A-1(a)(1) to (a)(3)", "§ 275.204A-1(a)(4) and (a)(5)" ], "lastChecked": "2026-11-09", "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "req-ria-records-retention", "phaseId": "days-31-60", "order": 8, "title": "Rule text: retention of most required books and records (SEC-registered advisers)", "explanation": "Advisers Act Rule 204-2(e)(1) requires the books and records made under paragraphs (a) to (c)(1)(i) and (c)(2) of the rule, with the exceptions the paragraph lists, to be maintained and preserved in an easily accessible place for not less than five years from the end of the fiscal year during which the last entry was made on the record, the first two years in an appropriate office of the adviser.", "output": "The firm's records inventory showing where each class of record is kept and how the retention period is tracked.", "firmTypes": [ "ria" ], "perspectives": [ "cco" ], "topics": [ "books-and-records" ], "kind": "requirement", "applicability": "Investment advisers subject to Rule 204-2. Other paragraphs of the rule set different periods for specific records and are not quoted here.", "caveats": [ "The exceptions listed in paragraph (e)(1) and the periods in paragraphs (e)(2) and (e)(3) need to be read in the rule." ], "sourceIds": [ "src-17cfr-275-204-2" ], "evidenceLocators": [ "§ 275.204-2(e)(1)" ], "lastChecked": "2026-11-09", "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "req-ria-annual-review", "phaseId": "days-31-60", "order": 9, "title": "Rule text: annual review of compliance policies and procedures (SEC-registered advisers)", "explanation": "The Advisers Act compliance rule requires the adviser to review, no less frequently than annually, the adequacy of the policies and procedures established under the rule and the effectiveness of their implementation. The rule states the frequency in words and sets no calendar date.", "output": "The dates and reports of the firm's most recent reviews, from the firm's own records.", "firmTypes": [ "ria" ], "perspectives": [ "cco", "founder" ], "topics": [ "compliance-rule", "cadence" ], "kind": "requirement", "applicability": "Investment advisers registered or required to be registered with the SEC under section 203 of the Advisers Act.", "caveats": [ "Staff observations about annual reviews are staff statements, not rules, and are cited only in the exam-prep toolkit." ], "sourceIds": [ "src-17cfr-275-206-4-7" ], "evidenceLocators": [ "§ 275.206(4)-7(b)" ], "lastChecked": "2026-11-09", "status": "active", "dependsOn": [], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "draft-management-brief", "phaseId": "days-61-100", "order": 1, "title": "Prepare a plain-language management brief", "explanation": "Explain what was reviewed, the key limitations, the issues found, the decisions needed and the next work, in words the readers use.", "output": "Draft brief, with evidence links held in the firm's own systems; nothing is uploaded to this tool.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "reporting" ], "kind": "guidance", "applicability": "", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "agree-priority-work" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "organize-review-cadence", "phaseId": "days-61-100", "order": 2, "title": "Propose a practical reporting and review rhythm", "explanation": "Align the proposed rhythm with the firm's verified obligations and its governance, rather than inventing universal meeting frequencies.", "output": "Proposed process for management to consider.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "cadence" ], "kind": "guidance", "applicability": "", "caveats": [ "Any review frequency a regime requires comes from that regime's binding text, not from this plan.", "Related sourced requirement record for SEC-registered advisers: req-ria-annual-review." ], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "req-ria-annual-review" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "check-follow-through", "phaseId": "days-61-100", "order": 3, "title": "Revisit a sample of agreed actions", "explanation": "Look at what actually changed for a sample of the agreed actions, record the evidence, and note what remains unresolved.", "output": "Follow-through note with its limits; no compliance score.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco" ], "topics": [ "follow-through" ], "kind": "guidance", "applicability": "", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "agree-priority-work" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "plan-exam-evidence", "phaseId": "days-61-100", "order": 4, "title": "Organize examination-related evidence if relevant", "explanation": "Identify which evidence exists, what needs review and who handles actual regulator requests, so a request does not start from nothing.", "output": "Evidence index and questions; no assertion that an examination will occur within any period.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco" ], "topics": [ "examinations" ], "kind": "guidance", "applicability": "Whether the firm is subject to examination, and by whom, is a perimeter question.", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "offerPath": "/products/examready", "dependsOn": [ "gather-program" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "refine-role-for-hiring", "phaseId": "days-61-100", "order": 5, "title": "Revisit the proposed hire or engagement scope against the business map", "explanation": "Clarify responsibilities, interfaces and gaps for the discussion with the candidate or advisers, now that the business is mapped.", "output": "Revised role brief; not a regulator's acceptance of any arrangement, fractional or otherwise.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "founder" ], "topics": [ "hiring" ], "kind": "guidance", "applicability": "", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "offerPath": "/solutions/fractional-compliance-team", "dependsOn": [ "map-business" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } }, { "id": "agree-next-stage", "phaseId": "days-61-100", "order": 6, "title": "Agree the next stage of work", "explanation": "Brief management on the unfinished questions and the proposed priorities beyond this planning horizon.", "output": "Next-stage work queue, without a promised outcome or an internal target date.", "firmTypes": [ "ria", "broker-dealer", "fintech-msb", "bank-adjacent" ], "perspectives": [ "cco", "founder" ], "topics": [ "planning" ], "kind": "guidance", "applicability": "", "caveats": [], "sourceIds": [], "evidenceLocators": [], "lastChecked": null, "status": "active", "dependsOn": [ "draft-management-brief" ], "review": { "status": "unreviewed", "approvedAt": null, "revisionHash": null } } ], "changelog": [] }