Rule 206(4)-7 under the Investment Advisers Act of 1940, usually called the Compliance Program Rule, makes it unlawful for an SEC-registered investment adviser to advise clients unless it does three things: adopts and implements written policies and procedures reasonably designed to prevent violations of the Advisers Act, reviews those policies at least annually for adequacy and effectiveness, and designates a chief compliance officer to administer them.
The rule has been in place since 2004 and is the backbone of every RIA compliance manual.
What an adviser needs in writing is the compliance manual itself, tailored to its business (portfolio management, trading and allocation, marketing, custody, books and records, privacy, code of ethics, business continuity, and so on), the CCO designation, and records that show the annual review happened.
The SEC's 2023 amendment that would have required the annual review to be documented in writing was vacated by the Fifth Circuit on June 5, 2024, so there is no rule text requiring a written review report; examiners still ask how the review was done and what changed as a result.
The code of ethics sits under a companion rule adopted in 2004, Rule 204A-1, and this page covers both.
Every adviser registered or required to be registered with the SEC must adopt, maintain and enforce a written code of ethics that sets a standard of business conduct, requires compliance with the federal securities laws, requires access persons to report their holdings and transactions, requires pre-approval before access persons buy into an IPO or a limited offering, requires prompt internal reporting of violations, and requires each supervised person to acknowledge the code in writing.
Investment advisers registered or required to be registered with the SEC. State-registered advisers follow parallel state rules that are usually modeled on the same three elements.
Documents on this site that SEC 206(4)-7 requires or expects, each with who must have it, the review cycle and the obligations that cite it.
Examiners typically request the compliance manual and code of ethics with revision history, the CCO designation and reporting line, evidence of the most recent annual review and any changes made, Form ADV and marketing materials, trading and allocation records, custody and fee billing records, personal trading reports, business continuity plan, cybersecurity policies, vendor oversight records, books and records under Rule 204-2, and training records.
Where the requirement sits: Rule 206(4)-7(a)-(c); Rule 204A-1(a)(5) written acknowledgment of receipt; Rule 204-2(a)(17) records of policies and annual review
The SEC's August 2023 Private Fund Adviser Rules included an amendment to Rule 206(4)-7 requiring written documentation of the annual review. On June 5, 2024 the Fifth Circuit vacated those rules in full, including that amendment, so the rule text reverted to the original three requirements. The SEC's own notice confirms the vacated amendments are not in effect.
AllyMatter is a full system for every internal policy your company keeps, including the ones SEC 206(4)-7 turns on. Build the whole library in one place, across every department, and prove who has read what.
Policies you can run here
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
Most of what an assessor reads for this standard is written policy and proof that people acknowledged it. That is the layer AllyMatter owns.
A large ecosystem of RIA compliance consultants, outsourced and fractional CCO providers, and securities law firms. Common engagements are the annual compliance review, a mock SEC exam, manual rewrites after new rules (for example the Marketing Rule), and registration support.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
SEC Division of Examinations staff conduct examinations; state securities regulators examine state-registered advisers. There is no certification or third-party audit requirement.
Assessors
This page is read by the organizations looking for someone to certify them.
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteIndependent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
eCFR: 17 CFR 275.206(4)-7 Compliance procedures and practiceseCFR: 17 CFR 275.204A-1 Investment adviser codes of ethicsSEC: Compliance Programs of Investment Companies and Investment Advisers (2003 adopting release)SEC: announcement regarding private fund advisers rulesMorrison Foerster: Fifth Circuit vacates SEC private fund adviser rules
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Approve the policies SEC 206(4)-7 asks for, keep every version, and record a named acknowledgment from each person who has to read them.