No tasks in this phase match your answers. Change them in Your firm or Your role; your checkmarks are kept.

1. Confirm the mandate and decision routes

   Discuss what the role owns, what management owns and how disagreements are raised and resolved. Write down what is still unclear rather than assuming it.

   Output, who it is for, caveats and sources

   Output

   Draft role and decision map, with the unresolved questions listed.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Governance

   Caveat

   A written mandate is a working agreement inside the firm, not a regulatory determination of the role.

2. Map the business as it operates

   List products, customers, legal entities, locations, partners and the money and data flows between them, then walk the list with the teams who run each part.

   Output, who it is for, caveats and sources

   Output

   Business map with the gaps still to verify marked on it.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Business understanding

   Caveat

   The map describes what the firm does; it does not decide which regimes apply.

3. Locate the current program and its history

   Ask where policies, prior reviews, issue logs and management reporting are kept, and who owns each. Record what is missing as missing; never backdate or reconstruct a record.

   Output, who it is for, caveats and sources

   Output

   Inventory of the program's documents and a gaps list.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO.

   Topics

   Program inventory

   Caveat

   An inventory is not a judgement of adequacy.

   Caveat

   Related sourced requirement records, by firm type: req-ria-written-policies and req-ria-designate-cco for SEC-registered advisers; req-msb-aml-program for money services businesses. Relevance, not a finding that either regime applies.

   Builds on

   Rule text: written compliance policies and procedures (SEC-registered advisers); Rule text: designation of a chief compliance officer (SEC-registered advisers); Rule text: anti-money laundering program of a money services business (suggested order; nothing is locked)

4. Identify dates and issues already in motion

   Ask the existing owners about actual regulatory correspondence, filing calendars, open incidents and commitments the firm has already made, and who is handling each.

   Output, who it is for, caveats and sources

   Output

   Priority list verified by the firm's own records; this tool calculates no legal deadline.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Obligations

   Applicability

   Which dates are binding depends on the firm's actual obligations and correspondence, which need confirmation.

   Caveat

   Existing obligations and urgent issues may require action before any planning band suggests it.

   Caveat

   Related sourced requirement records, by firm type: req-ria-adv-annual-amendment for SEC-registered advisers; req-msb-registration for money services businesses. Relevance, not a finding that either regime applies.

   Builds on

   Rule text: Form ADV annual updating amendment (SEC-registered advisers); Rule text: registration of money services businesses with FinCEN (suggested order; nothing is locked)

5. Identify which regimes need confirmation

   Record the registrations and permissions the firm says it holds, where each is evidenced, and the questions a qualified reviewer needs to answer. A label such as RIA or fintech does not settle applicability.

   Output, who it is for, caveats and sources

   Output

   Perimeter questions and a source-verification queue.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO.

   Topics

   Obligations

   Applicability

   Legal geography and registration scope are open questions for the firm and its advisers.

   Caveat

   Do not assume a US regime, an MSB status or a bank partner's duties from the firm type alone.

   Builds on

   Map the business as it operates (suggested order; nothing is locked)

6. Discuss access, people and resources for the work

   Identify the systems, data and people the work needs, the information gaps, and the decisions the incoming person cannot resolve alone.

   Output, who it is for, caveats and sources

   Output

   Resourcing discussion note and the questions to escalate.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Resourcing

   Builds on

   Confirm the mandate and decision routes (suggested order; nothing is locked)

7. Sourced requirement

   Rule text: written compliance policies and procedures (SEC-registered advisers)

   The Advisers Act compliance rule makes it unlawful for an adviser registered or required to be registered under section 203 to provide investment advice unless it adopts and implements written policies and procedures reasonably designed to prevent violation, by the adviser and its supervised persons, of the Act and the Commission's rules under it. This record quotes the rule; it does not decide whether your firm is such an adviser.

   Output, who it is for, caveats and sources

   Output

   Confirmation, in the firm's own records, of where the written policies and procedures are and when they were adopted.

   Relevant to

   RIA. Perspective: CCO and Founder.

   Topics

   Compliance rule

   Applicability

   Investment advisers registered or required to be registered with the SEC under section 203 of the Advisers Act. Registration status is confirmed, not assumed from the RIA label.

   Caveat

   State-registered advisers follow their state's rules, which this record does not cover.

   Sources

   [1] § 275.206(4)-7(a) Checked 2026-11-09.

8. Sourced requirement

   Rule text: designation of a chief compliance officer (SEC-registered advisers)

   The same compliance rule requires the adviser to designate an individual, who is a supervised person, responsible for administering the policies and procedures adopted under paragraph (a) of the rule. Apart from the paragraph heading, Chief compliance officer, the quoted rule text does not prescribe the role's title, seniority or reporting line.

   Output, who it is for, caveats and sources

   Output

   The firm's record of who is designated and when the designation was made.

   Relevant to

   RIA. Perspective: CCO and Founder.

   Topics

   Compliance rule, Governance

   Applicability

   Investment advisers registered or required to be registered with the SEC under section 203 of the Advisers Act.

   Caveat

   Whether a fractional or outsourced arrangement meets the rule is a question for the firm and its advisers; this record quotes the rule only.

   Sources

   [1] § 275.206(4)-7(c) Checked 2026-11-09.

9. Sourced requirement

   Rule text: Form ADV annual updating amendment (SEC-registered advisers)

   Advisers Act Rule 204-1 requires an adviser to amend Parts 1 and 2 of its Form ADV at least annually, within 90 days of the end of its fiscal year, and more frequently if the Form ADV instructions require. Part 3 is amended at the frequency the form instructions require. This tool calculates no date; the firm's fiscal year end and its own filing calendar govern.

   Output, who it is for, caveats and sources

   Output

   The firm's fiscal year end and the dates of its last annual updating amendment and any other-than-annual amendments, taken from the firm's own filing records.

   Relevant to

   RIA. Perspective: CCO and Founder.

   Topics

   Form ADV, Filings

   Applicability

   Advisers that file Form ADV with the SEC.

   Caveat

   The rule states 90 days without saying business or calendar days.

   Sources

   [2] § 275.204-1(a) Checked 2026-11-09.

10. Sourced requirement

    Rule text: registration of money services businesses with FinCEN

    Under 31 CFR 1022.380, each money services business, with the stated exceptions for agents and certain sellers of prepaid access, must register with FinCEN and must maintain a list of its agents as part of its registration. The registration form for the initial registration period must be filed on or before the end of the 180-day period beginning on the day following the date the business is established, and a renewal form on or before the last day of the calendar year preceding the renewal period.

    Output, who it is for, caveats and sources

    Output

    The firm's written analysis of whether it is a money services business, and if so, its registration record and renewal calendar.

    Relevant to

    Fintech / MSB. Perspective: CCO and Founder.

    Topics

    MSB registration, Financial crime

    Applicability

    Money services businesses as defined in 31 CFR 1010.100(ff). Whether a fintech is an MSB is a perimeter question the firm confirms with its advisers; the Fintech / MSB label does not settle it.

    Caveat

    A person that is an MSB solely as an agent of another MSB is addressed separately in the rule.

    Caveat

    The rule states a 180-day period without saying business or calendar days.

    Sources

    [8] § 1022.380(a)(1) and (b)(3) Checked 2026-11-09.

11. Sourced requirement

    Rule text: anti-money laundering program of a money services business

    Under FinCEN's rule at section 1022.210 of chapter X, each money services business shall develop, implement and maintain an effective written anti-money laundering program, commensurate with its risks, that at a minimum incorporates policies, procedures and internal controls, designates a person to assure day to day compliance, provides education or training of appropriate personnel, and provides for independent review to monitor and maintain an adequate program.

    Output, who it is for, caveats and sources

    Output

    Location and date of the firm's written AML program and the name of the role designated to assure day to day compliance, from the firm's own records.

    Relevant to

    Fintech / MSB. Perspective: CCO and Founder.

    Topics

    AML program, Financial crime

    Applicability

    Money services businesses as defined in § 1010.100(ff) of chapter X. Whether the firm is an MSB is confirmed separately.

    Caveat

    The rule's detailed program elements in paragraph (d)(1)(i) to (iv) are not reproduced in full here; read the rule text.

    Caveat

    A bank partner's own program obligations do not pass to the firm by assumption, and bank requirements are not covered by this record.

    Sources

    [6] § 1022.210(a) to (c) [7] § 1022.210(d)(1) to (d)(4) Checked 2026-11-09.

No tasks in this phase match your answers. Change them in Your firm or Your role; your checkmarks are kept.

1. Draft a business-specific risk and conflicts inventory

   Walk through where the actual products, relationships and incentives could create problems, with the people closest to them. Prioritize what to look at, not what to certify.

   Output, who it is for, caveats and sources

   Output

   Prioritized questions and the evidence to inspect; not a risk certification.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO.

   Topics

   Risk

   Caveat

   An inventory of questions is not a risk assessment that any regime may require; that is a separate, scoped piece of work.

   Builds on

   Map the business as it operates (suggested order; nothing is locked)

2. Inspect a small, explained sample of controls and evidence

   Choose a few areas based on the firm's own issues and priorities, look at the evidence that exists, and record what was tested and what was not.

   Output, who it is for, caveats and sources

   Output

   Sample and testing log with its limitations stated.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO.

   Topics

   Testing

   Caveat

   A small sample shows what it shows; it does not establish that controls work.

   Caveat

   Related sourced requirement records for SEC-registered advisers, often useful when choosing a sample: req-ria-code-of-ethics and req-ria-records-retention. Relevance, not a finding that the rules apply.

   Builds on

   Locate the current program and its history; Rule text: written code of ethics (SEC-registered advisers); Rule text: retention of most required books and records (SEC-registered advisers) (suggested order; nothing is locked)

3. Compare the business description with disclosures and communications

   Read what the firm tells clients, regulators and the public against the business map, and flag differences for the right reviewer. Do not rewrite a filing on your own.

   Output, who it is for, caveats and sources

   Output

   Discrepancy list and the decision route responsible for each item.

   Relevant to

   RIA, Broker-dealer. Perspective: CCO.

   Topics

   Disclosures

   Applicability

   Which disclosures exist, and who may amend them, depends on the firm's registrations.

   Builds on

   Map the business as it operates (suggested order; nothing is locked)

4. Clarify interfaces with banking and operating partners

   Discuss responsibilities, contractual handoffs and the unanswered questions on each partner relationship, without assuming one party's regulatory duties transfer to another.

   Output, who it is for, caveats and sources

   Output

   Interface map and open questions.

   Relevant to

   Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Partners

   Applicability

   Partner contracts and the partner's own regime decide who owes what; confirm rather than infer.

   Builds on

   Map the business as it operates (suggested order; nothing is locked)

5. Understand the existing financial-crime workflow where relevant

   Ask who runs onboarding, monitoring and escalations today, what tools and records they use, and where applicability still needs confirmation.

   Output, who it is for, caveats and sources

   Output

   Workflow map and evidence gaps; not a statement of a universal AML requirement.

   Relevant to

   Fintech / MSB, Bank-adjacent. Perspective: CCO.

   Topics

   Financial crime

   Applicability

   Whether, and which, financial-crime obligations apply is a perimeter question to confirm.

   Caveat

   Related sourced requirement record for money services businesses: req-msb-aml-program. Bank-adjacent firms confirm their own position; bank rules are not covered here.

   Builds on

   Identify which regimes need confirmation; Rule text: anti-money laundering program of a money services business (suggested order; nothing is locked)

6. Agree which gaps to address first

   Discuss severity, dependencies, who decides and what the practical next action is for each gap found so far.

   Output, who it is for, caveats and sources

   Output

   Management-agreed work queue; not a claim that everything can be remediated by a given day.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Prioritization

   Builds on

   Inspect a small, explained sample of controls and evidence; Draft a business-specific risk and conflicts inventory (suggested order; nothing is locked)

7. Sourced requirement

   Rule text: written code of ethics (SEC-registered advisers)

   Advisers Act Rule 204A-1 requires an adviser registered or required to be registered under section 203 to establish, maintain and enforce a written code of ethics that, at a minimum, includes a standard of business conduct reflecting its fiduciary obligations, provisions requiring supervised persons to comply with applicable Federal securities laws, provisions requiring access persons to report and the adviser to review personal securities transactions and holdings, provisions requiring supervised persons to report any violations of the code promptly to the chief compliance officer or other designated persons, and provisions requiring the adviser to provide each supervised person with the code and its amendments and to obtain written acknowledgment of receipt.

   Output, who it is for, caveats and sources

   Output

   Location of the current code, the list of access persons and the most recent acknowledgments, from the firm's own records.

   Relevant to

   RIA. Perspective: CCO.

   Topics

   Code of ethics

   Applicability

   Investment advisers registered or required to be registered with the SEC under section 203 of the Advisers Act.

   Caveat

   Report timing and content requirements sit in paragraph (b) of the rule and are quoted in the exam-prep toolkit's deadline references rather than here.

   Sources

   [3] § 275.204A-1(a)(1) to (a)(3) [4] § 275.204A-1(a)(4) and (a)(5) Checked 2026-11-09.

8. Sourced requirement

   Rule text: retention of most required books and records (SEC-registered advisers)

   Advisers Act Rule 204-2(e)(1) requires the books and records made under paragraphs (a) to (c)(1)(i) and (c)(2) of the rule, with the exceptions the paragraph lists, to be maintained and preserved in an easily accessible place for not less than five years from the end of the fiscal year during which the last entry was made on the record, the first two years in an appropriate office of the adviser.

   Output, who it is for, caveats and sources

   Output

   The firm's records inventory showing where each class of record is kept and how the retention period is tracked.

   Relevant to

   RIA. Perspective: CCO.

   Topics

   Books and records

   Applicability

   Investment advisers subject to Rule 204-2. Other paragraphs of the rule set different periods for specific records and are not quoted here.

   Caveat

   The exceptions listed in paragraph (e)(1) and the periods in paragraphs (e)(2) and (e)(3) need to be read in the rule.

   Sources

   [5] § 275.204-2(e)(1) Checked 2026-11-09.

9. Sourced requirement

   Rule text: annual review of compliance policies and procedures (SEC-registered advisers)

   The Advisers Act compliance rule requires the adviser to review, no less frequently than annually, the adequacy of the policies and procedures established under the rule and the effectiveness of their implementation. The rule states the frequency in words and sets no calendar date.

   Output, who it is for, caveats and sources

   Output

   The dates and reports of the firm's most recent reviews, from the firm's own records.

   Relevant to

   RIA. Perspective: CCO and Founder.

   Topics

   Compliance rule, Cadence

   Applicability

   Investment advisers registered or required to be registered with the SEC under section 203 of the Advisers Act.

   Caveat

   Staff observations about annual reviews are staff statements, not rules, and are cited only in the exam-prep toolkit.

   Sources

   [1] § 275.206(4)-7(b) Checked 2026-11-09.

No tasks in this phase match your answers. Change them in Your firm or Your role; your checkmarks are kept.

1. Prepare a plain-language management brief

   Explain what was reviewed, the key limitations, the issues found, the decisions needed and the next work, in words the readers use.

   Output, who it is for, caveats and sources

   Output

   Draft brief, with evidence links held in the firm's own systems; nothing is uploaded to this tool.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Reporting

   Builds on

   Agree which gaps to address first (suggested order; nothing is locked)

2. Propose a practical reporting and review rhythm

   Align the proposed rhythm with the firm's verified obligations and its governance, rather than inventing universal meeting frequencies.

   Output, who it is for, caveats and sources

   Output

   Proposed process for management to consider.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Cadence

   Caveat

   Any review frequency a regime requires comes from that regime's binding text, not from this plan.

   Caveat

   Related sourced requirement record for SEC-registered advisers: req-ria-annual-review.

   Builds on

   Rule text: annual review of compliance policies and procedures (SEC-registered advisers) (suggested order; nothing is locked)

3. Revisit a sample of agreed actions

   Look at what actually changed for a sample of the agreed actions, record the evidence, and note what remains unresolved.

   Output, who it is for, caveats and sources

   Output

   Follow-through note with its limits; no compliance score.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO.

   Topics

   Follow through

   Builds on

   Agree which gaps to address first (suggested order; nothing is locked)

4. Organize examination-related evidence if relevant

   Identify which evidence exists, what needs review and who handles actual regulator requests, so a request does not start from nothing.

   Output, who it is for, caveats and sources

   Output

   Evidence index and questions; no assertion that an examination will occur within any period.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO.

   Topics

   Examinations

   Applicability

   Whether the firm is subject to examination, and by whom, is a perimeter question.

   Builds on

   Locate the current program and its history (suggested order; nothing is locked)

   Related Taft page

   ExamReady

5. Revisit the proposed hire or engagement scope against the business map

   Clarify responsibilities, interfaces and gaps for the discussion with the candidate or advisers, now that the business is mapped.

   Output, who it is for, caveats and sources

   Output

   Revised role brief; not a regulator's acceptance of any arrangement, fractional or otherwise.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: Founder.

   Topics

   Hiring

   Builds on

   Map the business as it operates (suggested order; nothing is locked)

   Related Taft page

   Fractional Compliance Team

6. Agree the next stage of work

   Brief management on the unfinished questions and the proposed priorities beyond this planning horizon.

   Output, who it is for, caveats and sources

   Output

   Next-stage work queue, without a promised outcome or an internal target date.

   Relevant to

   RIA, Broker-dealer, Fintech / MSB, Bank-adjacent. Perspective: CCO and Founder.

   Topics

   Planning

   Builds on

   Prepare a plain-language management brief (suggested order; nothing is locked)