Practice question, Service providers
List every third party that can access client accounts or client data, and show the due diligence performed before onboarding and the ongoing oversight for each.
Taft practice question: not an official regulator question. SEC Division of Examinations, United States (federal). For SEC-registered investment advisers. Evidence category: Vendor records.
Not legal advice. A practice prompt for rehearsing how your team explains its controls and evidence. No scoring, no model answer, no implication that a regulator will ask these words.
Authored by Taft. Last checked 2026-11-09. All questions.
Why it is relevant
The 2027 priorities say the Division will focus on advisers that use third parties to access clients' accounts, where existing controls may be insufficient to protect client assets and data.
Sources: [1] Section I.A, page 6
Evidence to locate
Suggested, not mandatory. A regulator's actual request list governs.
No evidence cues listed.
Follow-up prompts
What happens to the third party's access when a client leaves?
Applicability
- Applies to
- Advisers registered or required to be registered with the SEC.
- Does not apply to
- Not stated.
Cite
Cite the official source first. Then: Taft Compliance Group, Exam-prep toolkit (draft), question q-third-party-access, https://taftcompliance.com/resources/exam-prep-toolkit/questions/q-third-party-access, last checked 2026-11-09.
Sources
U.S. Securities and Exchange Commission, Division of Examinations, Fiscal Year 2027 Examination Priorities (staff statement). regulator guidance. Section I.A, Fiduciary Standards of Conduct, page 6.
https://www.sec.gov/files/2027-exam-priorities.pdf
Checked 2026-11-09.
Supporting passage
The Division will also focus on advisers that use certain third-party service providers. This includes advisers using third parties to access clients' accounts, where existing controls may be insufficient to protect client assets and data.
Changes to this question
No released changes.