Compliance Regulations by Industry: What Applies to RIAs in 2026

For registered investment advisers (RIAs), compliance rests on a layered set of rules that depend on how a firm registers, who it serves, and what technology it uses. An RIA registered with the SEC answers to different filing obligations than one registered with a state regulator, though both carry fiduciary duties to clients.

Registered investment advisers face heightened scrutiny in 2026 as examiners focus on cybersecurity incident response, vendor oversight, and marketing claims.

An RIA's compliance obligations come primarily from the Investment Advisers Act of 1940, SEC rules under that Act, and — for state-registered firms — the Uniform Securities Act as adopted by each state, with additional cybersecurity, recordkeeping, and marketing requirements layered on top. Firms that get the fundamentals right tend to treat compliance as a system of written policies, tested controls, and retrievable evidence rather than a one-time registration task. Secure Wealth IT works with RIAs across the Southeast on the technology side of that system, from monitoring to encrypted backups, so firms can show examiners the records behind their policies.

Key Takeaways:

• RIA compliance draws from federal and state securities law, not a single uniform rulebook, so registration status shapes which rules actually apply.

• A compliant program turns written policies into tested controls — a designated CCO, annual reviews, recordkeeping, and recoverable backups all have to work in practice, not just on paper.

• Cybersecurity, marketing, and custody rules carry some of the sharpest audit risk in 2026, and documentation is what separates a defensible program from a vulnerable one.

Which Regulators and Standards Govern an RIA?

An RIA's primary regulator depends on its size and business model: the Securities and Exchange Commission (SEC) oversees larger firms under the Investment Advisers Act of 1940, while state securities regulators oversee smaller firms under each state's version of the Uniform Securities Act.

Operating as a registered investment advisor (RIA) requires navigating dual layers of federal and state oversight. Every registered investment adviser, regardless of registrant type, owes clients a fiduciary standard that requires putting client interests first and disclosing conflicts

of interest.

How Do SEC and State Securities Regulators Differ?

Eligibility for SEC registration generally follows assets under management (AUM): firms crossing roughly $100 million typically register with the SEC, while smaller firms register with one or more state securities regulators.

SEC-registered advisers answer to the Advisers Act and its specific rules, while state-registered advisers follow the Uniform Securities Act as adopted in their home state, according to Kitces's comparison of SEC and state-registered adviser compliance rules. The practical difference shows up in exam frequency, filing forms, and which specific rules apply to recordkeeping and advertising.

What Does an RIA's Fiduciary Duty Require?

Fiduciary duty requires an RIA to act in the client's best interest at all times, disclose material conflicts of interest, and seek best execution on trades. This standard applies whether a firm registers with the SEC or a state, and it shapes how compliance programs are built — disclosures, trading policies, and fee structures all trace back to this duty. Examiners reviewing fiduciary conduct in 2026 are expected to focus closely on conflicts of interest and the consistency between advice given and disclosures made, according to iQ-EQ's summary of SEC 2026 examination priorities.

When Do FINRA Rules Apply?

FINRA rules govern broker-dealers directly, not RIAs that operate purely as investment advisers. An RIA only becomes subject to FINRA oversight when it is also registered as (or dually affiliated with) a broker-dealer, so firms should confirm their registration status before assuming a FINRA rule applies to their advisory business.

What Must an RIA Compliance Program Include?

Foundational RIA compliance requirements mandate that an RIA compliance program include written policies and procedures reasonably designed to prevent securities violations, a designated chief compliance officer (CCO), and an annual review under Rule 206(4)-7 of the Advisers Act.

These three components form the backbone that SEC examiners inspect first. They must reflect how the firm actually operates day to day rather than relying on a generic template.

Written Policies, a Designated CCO, and an Annual Review

Rule 206(4)-7 requires a written compliance manual covering the firm's specific business lines, risks, and conflicts, administered by a named CCO with the authority to enforce it. The annual compliance review has to test whether those policies actually worked over the past year, not just restate them, as explained in Innreg's breakdown of Rule 206(4)-7 requirements. Firms that skip documented testing often discover gaps only when an examiner points them out.

A Code of Ethics and Personal Trading Controls

Rule 204A-1 requires every RIA to adopt a written code of ethics covering standards of conduct, personal securities trading, and reporting of employee trades. The code has to include a process for pre-clearing certain personal trades and collecting periodic holdings reports from access persons. This control works alongside the broader compliance manual rather than replacing it.

Risk Assessments That Reflect the Firm's Actual Business

A risk assessment should map a firm's specific services, client types, and operational dependencies against where violations or client harm are most likely. Each registered investment advisor must ensure that internal controls, from trade reviews to access permissions, trace directly back to identified risks. A risk assessment copied from another firm rarely holds up under examination.

Which Registration Filings and Client Disclosures Must Stay Current?

Form ADV is the core registration and disclosure document every RIA must file with the SEC or applicable state regulator, and Rule 204-1 sets the deadlines for amending it when information changes. Firms also need to track when Form CRS delivery obligations and individual representative registration — including Series 65 exam requirements — apply to their specific personnel.

Form ADV Amendments and Delivery Obligations

Form ADV Part 1 covers business structure and disciplinary history, while Part 2A and Part 2B are the narrative brochures delivered to clients describing fees, strategies, and conflicts of interest. An annual amendment is due within 90 days of the firm's fiscal year end, and material changes — a new conflict, a fee change, a disciplinary event — require faster updates under Rule 204-1, as described in CoreCLS's guide to Form ADV disclosure

obligations. Firms should also keep Part 2A Appendix 1 current for any wrap fee programs they sponsor.

When Form CRS and Representative Registration Apply

Firms that serve retail investors must deliver Form CRS, a short relationship summary covering services, fees, and conflicts, and keep it updated alongside Form ADV.

Individual investment advisor representatives (IARs) who meet with clients generally need state registration and a passing Series 65 exam score before giving advice. Supervising these investment advisor representatives becomes more complex as firms add remote staff across state lines.

What Books, Records, and Communications Must RIAs Preserve?

RIAs must maintain a specific set of books and records under Rule 204-2, covering everything from financial statements to client communications, generally for a minimum of five years, with the most recent two years kept in an easily accessible location. Communications compliance has become one of the harder parts of this rule to satisfy as advisers increasingly use messaging apps and AI note-taking tools alongside email.

Records Covered by Rule 204-2

Under SEC Rule 204-2, firms must preserve trial balances, trading records, client agreements, advertising materials, and the compliance manual itself, according to Cornell Law School's text of 17 CFR § 275.204-2. Rule 204-2 applies to records "relating to" the advisory business, a phrase examiners interpret broadly.

A detailed walkthrough of what the rule covers and common retention pitfalls appears in this books and records rule retention guide.

Email, Messaging, and Off-Channel Communications

Business communications sent through personal phones, encrypted messaging apps, or other off-channel communications tools fall under the same recordkeeping duty as email, even when they happen outside firm-issued systems. Advisers are increasingly cautious about AI tools that transcribe client calls, since those transcripts can themselves become records subject to retention, as reported by AdvisorPerspectives on AI transcription risks for RIAs. Firms building or refreshing an archiving approach can review practical steps in this email archiving compliance guide for RIAs.

Retention, Retrieval, and Evidence of Supervision

Retention alone is not enough; records need to be retrievable quickly and show evidence.

that someone supervised the communications for red flags. The books and records rule requires preservation for no less than five years, with the most recent two years readily accessible, according to Comply's guide to RIA communications archiving. Firms evaluating their current setup can also review this email security guide for RIA firms for related controls.

How Do Privacy and Cybersecurity Rules Affect RIAs?

Regulation S-P, issued under the Gramm-Leach-Bliley Act, requires RIAs to safeguard client information and respond to data breaches within defined timeframes, with large advisers (over $1.5 billion in AUM) required to comply by December 2025 and smaller firms given until June 2026, according to Suntera's overview of U.S. regulatory developments for RIAs. Firms also need to assess whether anti-money laundering (AML) obligations apply to their specific business model.

Regulation S-P, Client Information, and Incident Response

Amended Reg S-P requires covered institutions to maintain a written incident response program and to notify affected individuals within 30 days of discovering unauthorized access to sensitive client information, according to Insura's summary of Reg S-P cybersecurity compliance. Firms should also document vendor oversight, since vendors handling client data can trigger notification duties of their own.

A full walkthrough of the rule's requirements is available in this Reg S-P guide for RIAs, and firms preparing for the compliance deadline can use this Reg S-P compliance checklist.

Access Controls, Monitoring, and Secure Backups

Written compliance policies and procedures for cybersecurity typically call for multi-factor authentication, access reviews tied to job role, and continuous monitoring for unusual activity. Encrypted, tested backups matter just as much as prevention, since a ransomware incident still needs a recovery path that satisfies both clients and examiners.

Secure Wealth IT supports RIAs with this layer directly — monitoring, access management, and encrypted backups — while leaving legal determinations about what the rule requires to the firm's CCO or counsel.

Assessing Applicable AML Obligations

The SEC and FinCEN have proposed anti-money laundering and customer identification program rules specifically for investment advisers, a notable shift since AML obligations have historically applied more directly to broker-dealers and banks, according to K&L Gates's analysis of the proposed AML rule. Firms should track this rulemaking rather than assume it does not apply simply because it has not yet taken final effect.

What Rules Apply to RIA Marketing?

The SEC Marketing Rule (Rule 206(4)-1) governs how RIAs advertise, requiring firms to review every advertisement for fair and balanced presentation before it goes out, and placing specific conditions on testimonials, endorsements, third-party ratings, and performance advertising. Firms that treat marketing review as a one-time compliance manual entry, rather than an ongoing approval process, tend to draw the most scrutiny.

Reviewing Advertisements Under the SEC Marketing Rule

The Marketing Rule applies broadly to communications that offer the firm's advisory

services, including website content, social media posts, and client newsletters, according to the SEC's small business compliance guide on investment adviser marketing. Firms should document who reviewed each advertisement and what they checked.

A practical self-check for website content specifically is covered in this SEC Marketing Rule website compliance check.

Testimonials, Endorsements, and Third-Party Ratings

Testimonials, endorsements, and third-party ratings are permitted under the rule but require specific disclosures, including whether the person was compensated and any material conflicts involved. A recent SEC risk alert focused specifically on these areas, signaling continued examiner attention, according to RIA Compliance's summary of the SEC's risk alert on the Marketing Rule.

Performance Claims and Supporting Records

Any marketing and performance advertising, including hypothetical performance, must be supported by records showing how the figures were calculated and must meet conditions tied to the intended audience. Firms must ensure all performance advertising is verifiable by retaining backup documentation for every claim made.

How Do RIAs Manage Custody and Investment Conduct?

An RIA has custody of client assets whenever it holds client funds or securities directly, has the ability to withdraw them, or has certain forms of access through fee deduction arrangements, and custody triggers a requirement to use a qualified custodian and undergo an independent verification. Firms also need to document best execution reviews and address pay-to-play restrictions under Rule 206(4)-5 where applicable.

Identifying Custody and Working with a Qualified Custodian

Custody determinations are often misunderstood because they can be triggered unintentionally — for example, through a power of attorney or online access to client accounts — according to Kitces's guide to hidden custody rule triggers. Once custody is established, assets must be held with a qualified custodian, and the firm typically needs a surprise examination by an independent accountant.

One enforcement case resulted in a $75,000 payment to the SEC over custody rule violations, according to ThinkAdvisor's coverage of the Northeast Financial Group settlement, illustrating the exposure firms face when custody triggers go unaddressed.

Documenting Best Execution and Managing Conflicts

Best execution requires an RIA to seek the most favorable terms reasonably available for client transactions, a duty that flows directly from fiduciary obligations. Firms should periodically review trading costs and execution quality across custodians and brokers, and keep that review on file.

Addressing Pay-to-Play Restrictions

Rule 206(4)-5 restricts advisers and their covered associates from making certain political contributions to officials who could influence the selection of an adviser for government business. Firms with any public-fund clients should confirm which staff count as covered

associates under the rule.

What Should Business Continuity and Vendor Oversight Cover?

Comprehensive business continuity planning helps firms keep operating, protect client assets, and communicate with clients during unexpected events. A business continuity plan must address disruptions such as natural disasters, cyberattacks, or critical vendor outages.

Testing business continuity plans regularly ensures they work in practice, especially when combined with reviews of vendors supporting critical systems.

Testing Recovery Plans for Disruptions and Cyber Incidents

Firms that regularly test recovery procedures and assess operational risk are better positioned to limit downtime, according to 11th's guide to building a business continuity plan for RIAs. A documented test — showing what worked, what failed, and what changed afterward — carries far more weight with an examiner than a plan that has never been exercised.

Immutable, encrypted backups are a practical foundation for this testing, and firms can review backup-specific guidance in this immutable backup guide for RIAs.

Reviewing Vendors That Handle Client Data or Critical Systems

Vendor oversight has become a distinct regulatory expectation under amended Reg S-P, which requires written policies for selecting and monitoring service providers that handle customer information. Firms should maintain an inventory of vendors with access to client data, along with evidence of periodic risk reviews, as described in Continuity Strength's guide to Reg S-P vendor oversight documentation.

A single unreviewed vendor can become the weakest link in an otherwise solid compliance program.

How Can Firms Stay Ready for an Examination?

Firms stay ready for SEC examinations by converting the annual compliance review into documented testing and tracking recurring deadlines systematically. Maintaining an RIA compliance checklist helps compliance teams organize evidence of policy exceptions and remediation before examiners arrive.

The SEC's 2026 examination priorities specifically call out fiduciary standards, cybersecurity, and disclosure consistency, according to Kroll's summary of the SEC's 2026 investment adviser examination priorities.

Turning the Annual Review into Documented Testing

An annual review should produce a written record of what was tested, what was found, and what changed as a result — not simply a statement that policies were reviewed. Sampling client files, testing trade allocations, or reviewing a set of advertisements all count as concrete testing activities examiners look for.

Organizing Policies, Exceptions, and Remediation Evidence

Examiners expect to see not just policies but evidence of how the firm handled exceptions to them, including who approved deviations and what remediation followed. A compliance manual that never records an exception can look less credible than one that shows the firm catching and correcting its own mistakes.

Using a Calendar to Track Recurring Obligations

A compliance calendar tracking Form ADV amendment deadlines, code of ethics reporting dates, and the annual review keeps recurring tasks from slipping, as outlined in RecaldeLaw's guide to the RIA annual compliance calendar. Firms that build this calendar once and update it annually tend to handle exam requests with far less scrambling.

Where Can Technology Strengthen Compliance Controls?

Compliance technology strengthens an RIA's program by connecting written policies to the monitoring logs, access records, and training evidence that prove those policies work day to day. A chief compliance officer still owns the program and its judgment calls, but reliable systems make the evidence behind that judgment easier to produce.

Connecting Policies to Monitoring, Access, and Training Records

A written access control policy means little without logs showing who accessed client data and when, or training records showing staff completed required cybersecurity awareness sessions. Linking these records to the underlying policy turns a document into something an examiner can verify.

Firms exploring this connection in more depth can review this guide to IT compliance best practices for RIAs.

Keeping the CCO Accountable While IT Partners Support Execution

Internal controls work best when the CCO retains ownership of policy decisions while a technology partner handles the operational execution — monitoring, patching, backups, and access provisioning. Secure Wealth IT, which works exclusively with RIAs, broker-dealers, and financial advisors, supports this division by maintaining the systems and documentation CCOs rely on for audit evidence, without making the compliance determinations themselves. Firms weighing how much of this to bring in-house versus outsource can review this overview of IT support services for RIAs.

Making RIA Compliance an Ongoing, Verifiable Practice

RIA compliance works best as a living system — written policies tested through annual

reviews, records retained and retrievable under Rule 204-2, client disclosures kept current through Form ADV and Form CRS, and cybersecurity controls documented under Regulation S-P. Marketing claims, custody arrangements, and business continuity plans all carry their own specific rules, and FINRA obligations apply only to the subset of RIAs also registered as broker-dealers.

The firms that handle examinations with the least friction are usually the ones that treated documentation as an ongoing habit rather than a pre-exam scramble. Building that habit starts with a clear compliance calendar, a CCO empowered to test policies rather than just write them, and technology systems that can produce evidence on request.

Next Steps for Your RIA or Broker-Dealer Firm

Secure Wealth IT helps Registered Investment Advisors, broker-dealers, and financial advisors stay secure, compliant, and audit-ready.

Explore these free tools and resources:

Free Financial Calculators: calculator.securewealthit.com

Compliance Self-Assessment Tool: regulations.securewealthit.com

Resource Library: Browse free RIA and broker-dealer guides

Watch on YouTube: Secure Wealth IT YouTube channel.

Talk to a Specialist: Schedule a free consultation

For more information about this topic, visit us at https://www.securewealthit.com