An incoming chief compliance officer inherits a written program, a set of deadlines that were running before the appointment, and a board or chief executive who will sign something on the strength of that program within the year. The order of work matters more than the volume. This guide sets out what the rules ask of the role, which reviews and records carry dates, and a sequence for the opening months that puts the required items first.
What the role is
For an SEC-registered adviser or fund, the chief compliance officer is the person designated to be responsible for administering the firm’s compliance policies and procedures. The requirement comes from rule 206(4)-7 under the Advisers Act, adopted alongside rule 38a-1 under the Investment Company Act. The rules became effective on February 5, 2004, with a compliance date of October 5, 2004.
The adopting release describes the person, not just the title. The SEC said the compliance officer should have a position of sufficient seniority and authority within the organization to compel others to adhere to the policies and procedures. For a broker-dealer, FINRA Rule 3130 requires each member to designate one or more principals as chief compliance officer and to identify them to FINRA on Schedule A of Form BD.
Read together, the role has three parts: administer the written program, review it, and report on it. The opening months are about getting each of the three onto a footing you can defend.
What the rules require of the program
Rule 206(4)-7 requires a registered adviser to adopt and implement written policies and procedures reasonably designed to keep the adviser and its supervised persons within the Advisers Act. The rule does not enumerate specific elements that the policies must include. Instead, the SEC expects each adviser to first identify the conflicts and other compliance factors that create risk for the firm and its clients, and then design policies that address those risks. The policies should be designed to prevent problems from occurring, to detect any that have occurred, and to correct them promptly.
Three further features shape the first weeks. The program must be reviewed annually for its adequacy and the effectiveness of its implementation. The firm must keep copies of all policies and procedures that were in effect at any time during the last five years. And it must keep any records documenting the annual review. The SEC said these records would assist its examination staff in determining whether a firm is adhering to the rules. In our reading, that makes the records the first thing an incoming officer should locate, because they are the evidence of what the program has been, not what the manual says it is.
For a fund, rule 38a-1 adds a reporting line that runs to the board. The fund’s chief compliance officer must furnish the board annually with a written report on the operation of the fund’s policies and procedures and those of its service providers. The report must address, at a minimum, the operation of the policies since the last report, any material changes to them, any recommended material changes arising from the annual review, and any material compliance matters since the last report. The officer must also meet in executive session with the independent directors at least once each year, without fund management or interested directors present. The board, including a majority of its independent directors, must approve the officer’s designation and compensation.
For a broker-dealer, the annual obligation sits with the chief executive. Under FINRA Rule 3130, the chief executive officer must certify annually that the member has processes to establish, maintain, review, test and modify its written compliance policies and written supervisory procedures, and that the chief executive has met with the chief compliance officer in the preceding 12 months. The report evidencing those processes must go to the board and audit committee in final form either before the certification or within 45 days of its execution.
The areas the SEC expects the program to cover
The adopting release lists the areas an adviser’s policies and procedures should address, at a minimum, to the extent they are relevant to that adviser. The table below pairs each area with the question an incoming officer should be able to answer about it by the end of the opening months.
| Area in the release | The question to answer early |
|---|---|
| Portfolio management, including allocation of opportunities and consistency with client objectives | Who checks allocations, and where is the evidence |
| Trading practices, including best execution, soft dollars and aggregated trades | When was best execution last reviewed, and by whom |
| Proprietary trading and personal trading of supervised persons | Are personal trading reports complete for the current period |
| Accuracy of disclosures to clients and regulators, including advertisements | Does Form ADV match how the business runs today |
| Safeguarding client assets | Who can move client money, and who approves it |
| Creation and maintenance of required records | Can the five-year set of policies be produced on request |
| Marketing, including solicitors | Which arrangements pay for referrals, and are they documented |
| Valuation and fee calculation | Who values hard-to-price holdings, and who checks the fee run |
| Privacy of client records | Where is client data held, and who has access |
| Business continuity | When was the plan last tested |
The list is a floor, not a template. A firm with one line of business and no affiliates will likely need far less under most rows than a firm with several conflicts to manage. The point of the table is to stop the incoming officer from starting with the manual’s table of contents and instead start with the business.
The opening months, in order
Stage one: locate, read, date. Start with the records, not the manual. Find the current policies, every version in effect over the last five years, the documentation of the last annual review, and for a fund the last written report to the board. Date each item. The gaps you find here will tell you whether the first annual review under your name is a routine exercise or a rebuild.
Stage two: map the risks before touching the text. The release expects the program to be built from the firm’s own conflicts and compliance factors outward. Walk the business: products, clients, affiliates, service providers, how money moves and who signs. Write down the conflicts you find in plain language. Only then compare the written policies to the list. Policies that address risks the firm does not have are noise; risks with no policy are the finding.
Stage three: test what the manual claims. Pick the areas in the table with the highest exposure for this firm and test them against actual evidence: trade blotters, personal trading reports, marketing files, the fee run. The annual review is required to consider compliance matters from the previous year, changes in the business of the adviser or its affiliates, and changes in the Advisers Act or applicable regulations that might call for revisions. Testing early gives the annual review something to say beyond a restatement of the manual.
Stage four: set the reporting line. For a fund, calendar the written report to the board and the executive session with the independent directors. For a broker-dealer, calendar the chief executive’s certification and the meeting that must precede it, and agree who writes the report that evidences the processes. For an adviser without a board, agree with senior management how and when compliance matters reach them. Put the dates in writing now; they are the deadlines the rest of the year runs toward.
Stage five: fix, document, and brief. Correct what the testing found, record what was corrected and when, and brief the board or chief executive in plain language on what the program is, where it was thin, and what changed. If the firm cannot staff the work from inside, a fractional compliance team can carry the testing and documentation while the officer keeps the authority the rule expects of the role; Taft describes that arrangement at /solutions/fractional-compliance-team.
The order of work matters more than the volume.
Questions that come up
Does the chief compliance officer have to be a dedicated, full-time hire? No. The SEC said the rules would not require firms to hire an individual exclusively charged with serving in the role. What the rules do ask for is seniority and authority, and those are harder to supply from outside than hours are. A firm that splits the title across people or functions should be able to show who holds the authority to compel adherence.
Can the first review wait for the annual cycle? It can, but the release points the other way. The SEC said advisers should consider interim reviews in response to significant compliance events, changes in business arrangements, and regulatory developments. A change in the person running the program is, in our view, a sensible trigger for an interim look at the highest-risk areas.
What should the broker-dealer meeting with the chief executive cover? FINRA’s supplementary material says the meetings are to discuss and review the matters that are the subject of the certification, review the member’s compliance efforts, and identify and address significant compliance problems and plans for emerging business areas. Treat that as the agenda and keep minutes; the minutes are part of the evidence behind the certification.
What if the records are missing? Document what exists, what does not, and the date you looked. Rebuild from the current program forward and say so in the next report rather than back-filling. Where a gap raises a legal question, take it to counsel; this guide is not legal advice.
Where Taft helps
Taft provides fractional compliance teams that take on the testing, documentation and annual review work described in this guide, working under the firm’s designated chief compliance officer rather than in place of that person. Details of the arrangement are at /solutions/fractional-compliance-team. Taft is not a law firm and does not give legal advice.
Questions
Does the chief compliance officer have to be a dedicated, full-time hire?
No. In the adopting release for rule 206(4)-7 the SEC said the rules would not require firms to hire an individual exclusively charged with serving in the role, but it did say the officer should have sufficient seniority and authority to compel others to adhere to the policies.
How often must an adviser review its compliance program?
Rule 206(4)-7 requires a registered adviser to review its policies and procedures annually for their adequacy and the effectiveness of their implementation, and the SEC said advisers should consider interim reviews after significant compliance events, business changes and regulatory developments.
What must a fund chief compliance officer report to the board?
Under rule 38a-1 the officer must furnish the board annually with a written report that addresses, at a minimum, the operation of the policies and procedures of the fund and each service provider, any material changes, any recommended material changes arising from the annual review, and any material compliance matters.
What does FINRA Rule 3130 require of a broker-dealer each year?
The chief executive officer must certify annually that the member has processes to establish, maintain, review, test and modify its written compliance policies and supervisory procedures, and that the chief executive has met with the chief compliance officer in the preceding 12 months; the report evidencing those processes must reach the board and audit committee in final form before the certification or within 45 days of its execution.
Sources
- Compliance Programs of Investment Companies and Investment Advisers, U.S. Securities and Exchange Commission
- 3130. Annual Certification of Compliance and Supervisory Processes, FINRA
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.