On November 9, 2015, the SEC’s Office of Compliance Inspections and Examinations (OCIE) published a risk alert titled “Examinations of Advisers and Funds That Outsource Their Chief Compliance Officers”, Volume V, Issue 1. It shared what staff saw in nearly 20 examinations of SEC-registered advisers and funds that outsourced their CCO to an unaffiliated third party. Its central point for a small firm is one sentence: each registrant “is ultimately responsible for adopting and implementing an effective compliance program and is accountable for its own deficiencies.”
What “Examinations of Advisers and Funds That Outsource Their Chief Compliance Officers” (November 9, 2015) is, and is not
The alert gives the views of OCIE staff, and it says the Commission “has expressed no view on the contents” and that it is not legal advice. Its closing note says the factors it describes are not exhaustive and do not constitute a safe harbor. It describes outsourced CCOs as people who may update policies and procedures, prepare regulatory filings and conduct annual compliance reviews.
What Rule 206(4)-7 requires: three duties and one named individual
The compliance rule for advisers, Rule 206(4)-7, was adopted in Release IA-2204, dated December 17, 2003. It requires a registered adviser to adopt and implement written policies and procedures, review them annually for their adequacy and the effectiveness of their implementation, and designate a chief compliance officer to administer them. The rule text says that person must be “an individual (who is a supervised person).”
The adopting release sets the bar for that person. A CCO “should be competent and knowledgeable regarding the Advisers Act and should be empowered with full responsibility and authority to develop and enforce appropriate policies and procedures for the firm,” and should hold “a position of sufficient seniority and authority within the organization to compel others to adhere to the compliance policies and procedures.”
Three more points in the release matter for small firms. The rule “does not require advisers to hire an additional executive to serve as compliance officer, but rather to designate an individual” for the role. The Commission expected “smaller advisory firms without conflicting business interests to require much simpler policies and procedures than larger firms.” And, as the 2015 alert quotes it, each firm “should first identify conflicts and other compliance factors creating risk exposure for the firm and its clients in light of the firm’s particular operations, and then design policies and procedures that address those risks.” Advisers must also keep records documenting the annual review under Rule 204-2(a)(17)(ii).
What the 2015 alert observed at outsourced CCOs
Staff considered, among other things, whether the program was proactive rather than reactive, whether the CCO had sufficient authority and resources, and whether compliance appeared to be an important part of the firm’s culture. Each examination typically includes interviews with the CCO and other senior officers, which staff use to assess tone at the top.
Staff linked effective outsourced CCOs with regular, often in-person, communication, strong relationships, sufficient support and access to documents, and knowledge of both the rules and the business. The alert draws out three themes.
- Communication: CCOs who interacted frequently and personally with advisory and fund employees appeared to understand the business better, and staff noted fewer inconsistencies between written procedures and actual practice.
- Resources: more significant issues appeared where one outsourced CCO served numerous unaffiliated firms and did not appear to have sufficient resources.
- Empowerment: annual reviews by CCOs who could obtain records independently more accurately reflected actual practice than reviews by CCOs who relied wholly on the firm to select the records.
The weaker cases share a pattern. Some outsourced CCOs could not articulate the firm’s business or compliance risks. Some standardized checklists were generic and did not capture the firm’s business model and risks. Several manuals were built from CCO-provided templates, and some of those templates were not tailored to the business. The examples include a policy of collecting fees quarterly in advance at a firm that billed monthly in arrears, and procedures naming departed employees as the people responsible for reviews. Staff also saw a general lack of documentation evidencing annual review testing, and some CCOs rarely visited the firm’s offices.
The alert’s conclusion applies to any arrangement: “A CCO, either as a direct employee of a registrant or as a contractor or consultant, must be empowered with sufficient knowledge and authority to be effective.”
Outsourcing the CCO role moves the work to a contractor; it does not move the responsibility for the program.
What has changed since 2015: the 2022 outsourcing proposal was withdrawn
In Release IA-6176, “Outsourcing by Investment Advisers,” the Commission proposed a new rule under the Advisers Act. It was published in the Federal Register on November 16, 2022, and would have barred advisers from outsourcing certain services or functions without first meeting certain requirements. The proposing release said the rule would cover outsourced compliance functions, “including outsourced chief compliance officers.”
The Commission then withdrew it. Its withdrawal release, 33-11377, withdraws the proposed rules listed there, including the one published at 87 FR 68816 on November 16, 2022, “as of June 17, 2025.” The release is dated June 12, 2025. The notice appeared in the Federal Register on June 17, 2025, at 90 FR 25531. The Commission said it “does not intend to issue final rules with respect to these proposals” and that any future action in these areas would start with a new proposed rule.
The proposal never became a rule. For an adviser with an outsourced CCO, the reference points remain the compliance rule, its adopting release and staff statements such as the 2015 alert.
What has changed since 2015: the 2020 and 2026 risk alerts
On November 19, 2020, OCIE published the risk alert “OCIE Observations: Investment Adviser Compliance Programs.” It described CCOs with numerous other professional responsibilities, “either elsewhere with the adviser or with outside firms,” who did not appear to devote sufficient time to the role. It also described advisers that restricted their CCOs from accessing critical compliance information, such as trading exception reports.
On the same date, Peter B. Driscoll, then OCIE’s director, gave a speech titled “The Role of the CCO: Empowered, Senior and With Authority.” He said a CCO should have, at a minimum, “a direct line of reporting to senior management, if not be part of senior management,” and that on compliance budgets “there is no standard or rule.” He also said examiners notice when CCOs are expected to create policies “but are not given the resources to hire personnel or engage vendors.” The speech gives his own views, which do not necessarily reflect the Commission’s.
On September 14, 2026, the Division of Examinations published “Examinations Observations Regarding Investment Adviser Annual Compliance Reviews.” It described reviews stretched over extended intervals because of personnel changes such as CCO departures. It also described policies that delegated work to others without identifying how the adviser should oversee it. The fiscal year 2027 examination priorities add that examinations “will also typically analyze an adviser’s annual compliance review.”
What firms should do
These questions come from the sources above. They are not a complete list.
- Is the person an individual who is a supervised person of the firm, as the rule requires of a CCO?
- Are they competent and knowledgeable regarding the Advisers Act, and will they have the seniority and authority to compel adherence?
- How often will they deal with your people, and in what form?
- How many other firms do they serve, and what resources do they have for yours?
- Can they obtain the records they need on their own, rather than only what staff choose to send?
- Will the risk assessment and manual be built from your actual business rather than a template?
- How will annual review testing be documented and kept under Rule 204-2(a)(17)(ii)?
- Who in senior management will the CCO report to directly?
- Who at the firm oversees the outsourced work, given that the firm stays responsible for its program?
Taft’s Fractional Compliance Team is one way to fill the role without a full-time hire, and our guide to what a fractional CCO is explains the arrangement. ExamReady is one way to work through these questions before an exam. In every arrangement the adviser remains responsible for its own compliance program, and neither service changes what the SEC asks for or finds.
Sources
- Risk Alert: Examinations of Advisers and Funds That Outsource Their Chief Compliance Officers, U.S. Securities and Exchange Commission
- Compliance Programs of Investment Companies and Investment Advisers, Release No. IA-2204, U.S. Securities and Exchange Commission
- Outsourcing by Investment Advisers, proposed rule, Release No. IA-6176, U.S. Securities and Exchange Commission
- Withdrawal of Proposed Regulatory Actions, Release No. 33-11377, U.S. Securities and Exchange Commission
- Withdrawal of Proposed Regulatory Actions (Federal Register, 2025-11110), Federal Register
- Risk Alert: OCIE Observations: Investment Adviser Compliance Programs, U.S. Securities and Exchange Commission
- The Role of the CCO: Empowered, Senior and With Authority (Peter B. Driscoll), U.S. Securities and Exchange Commission
- Risk Alert: Examinations Observations Regarding Investment Adviser Annual Compliance Reviews, U.S. Securities and Exchange Commission
- Fiscal Year 2027 Examination Priorities, U.S. Securities and Exchange Commission
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.