Blogs

If you run an RIA, you have probably heard two different things called "the SEC cybersecurity rule." One was proposed, drew heavy comment, and never took effect. The other is amended Regulation S-P, and it is the rule your firm actually has to follow today.

ule 204-2 under the Investment Advisers Act of 1940 sets out exactly what records your firm must create, how long you must keep them, and how fast you must produce them when the SEC asks. Most firms know that much.

Your website is not just a marketing tool. Under the SEC Marketing Rule, it is a live compliance surface that regulators can review at any time.