New RIA Compliance Program Checklist (2026)

The SEC doesn't give newly registered RIAs a grace period. Examiners actively target new registrants in their early years, and they're looking at fiduciary duty, marketing materials, cybersecurity, and books and records from day one. Building your compliance program in the right sequence keeps you exam-ready without turning the whole thing into a full-time project.

TLDR:

• Rule 206(4)-7 requires three things from every RIA: written policies, a designated CCO, and an annual review.
• Your books and records must be kept for five years in WORM format, covering all channels including texts and personal email.
• Reg S-P amendments effective June 3, 2026 require a 30-day breach notification window, and new RIAs are not exempt.
• The SEC targets newly registered advisers early, with 2026 exam priorities covering marketing, cybersecurity, AI use, and books and records.
• Greenboard covers communications archiving, marketing review, employee compliance, and vendor due diligence in one system.

The regulatory foundation of a new RIA compliance program

Rule 206(4)-7 under the Investment Advisers Act of 1940 is where every RIA compliance program starts. The rule requires three things: written policies and procedures reasonably designed to prevent violations of the Advisers Act, a designated chief compliance officer to administer them, and an annual review of the program's adequacy.

Think of it as the skeleton. Your books and records, marketing review workflow, and personal trading controls all attach to this structure. When the SEC shows up for an exam, they're checking whether your policies exist, whether your people actually follow them, and whether you reviewed and updated them in the past year. A program that looks good on paper but runs on autopilot won't hold up.

Designating your CCO

Rule 206(4)-7 requires every RIA to designate a CCO to administer its compliance policies and procedures, but the rule sets no specific credential, exam, or experience requirements. What the SEC expects is someone competent and knowledgeable about the Advisers Act, with enough seniority to actually compel others to follow the firm's policies.

For a brand-new RIA, that last part matters as much as the first. A CCO who lacks authority inside the organization can write excellent policies that nobody follows. The role needs organizational standing; a title alone isn't enough.

Small and newly registered firms often can't support a full-time, dedicated CCO from day one. Many handle this through an outsourced CCO arrangement, sometimes called an OCCO model. That's permissible, provided the designated individual takes real ownership of the program. Consultants can draft policies, run your annual review, and monitor your compliance calendar, but the firm remains accountable for what happens under their watch.

Writing your policies and procedures

Rule 206(4)-7 requires written policies and procedures, but the SEC isn't looking for a generic template download. The rule says your policies must be "reasonably designed to prevent violations" given your specific business. A solo RIA managing individual retirement accounts needs a different program than a multi-strategy firm advising institutions.

The areas the SEC expects you to cover:

• Fiduciary duty and conflicts of interest, including how you identify and disclose situations where your interests might diverge from a client's
• Personal securities trading and pre-clearance, so adviser transactions don't front-run or otherwise disadvantage clients
• Marketing and advertising, including how your firm complies with the SEC Marketing Rule across all channels
• Books and records retention, covering what you keep, how long you keep it, and where it lives
• Proxy voting, if you vote proxies on behalf of clients
• Business continuity and disaster recovery, so clients aren't left exposed if your operations go down

Before writing a single policy, map your actual business activities. If you don't custody assets, a lengthy custody policy adds bulk without adding protection. If your advisers run social media channels, your marketing policy needs real teeth. Policies that don't reflect how your firm operates tend to fail exams because examiners can spot the gap between what a document says and what the evidence shows.

Generic templates can serve as a starting point for structure, but every firm-specific detail, including your fee arrangements, client types, and conflicts, has to be layered in by someone who knows how your business actually runs.

Setting up books and records under Rule 204-2

Rule 204-2 is less glamorous than your policies document, but examiners live in it. Every advisory contract, trade order, account statement, and client communication is a record subject to retention requirements. Most records must be kept for five years, with the first two years in an easily accessible place. Communications tied to a securities recommendation or client transaction must be retained regardless of channel, so a text about a trade carries the same obligation as a formal email.

That last point trips up new firms more than anything else. If your advisers use personal phones, iMessage, WhatsApp, or personal email, those messages are likely in scope, and capturing them requires integrations or policies that redirect those conversations to supervised channels.

The SEC also requires electronic records be stored in a non-rewriteable, non-erasable format known as WORM (Write Once, Read Many). Without it, your archive is just a folder.

Key Books and Records Requirements Under Rule 204-2

Records you need from day one include:

• Signed client advisory agreements
• Trade blotters and order records
• Account statements and custodial data
• All client-facing communications, regardless of channel
• Marketing materials and advertisements
• Financial records of the firm itself

Building your marketing compliance workflow

The SEC's Marketing Rule applies the moment your firm publishes anything that could be read as an advertisement, and the definition is broad. A YouTube video, a LinkedIn post, a pitch deck, a client newsletter, a testimonial on your website: all of it falls under Rule 206(4)-1. For a new RIA, building a marketing compliance software workflow before content goes out is far easier than cleaning up violations after.

The rule's core requirements your workflow needs to handle:

• No misleading statements, including omissions that would make a true statement misleading
• Testimonials and endorsements require specific disclosures, a written agreement if compensation is involved, and cannot be used if the person giving them is disqualified
• Performance results must meet detailed presentation standards, including showing net-of-fee figures and, for hypothetical performance, meeting additional conditions
• Every advertisement must be retained as a record, including the final version and any material changes

The practical question is: who reviews content before it publishes, against what standard, and how fast? The SEC doesn't require pre-approval for every advertisement, but your policies must define your review process. Root Financial, whose content-led growth model generates 15 or more pieces of content per week, found that without a structured review workflow, the CCO was spending half the work week on marketing review alone. Workflow design matters as much as the rules themselves.

Supervising employee communications and personal trading

Two areas consistently generate exam findings: employee communications supervision and personal trading controls. Both require real infrastructure, beyond policy language alone.

Every RIA must adopt a code of ethics under Rule 204A-1, using personal trading compliance software to cover personal securities reporting, pre-clearance of certain trades, and access person reporting. Access persons, broadly advisors and others with access to client trading information, must report their personal holdings on hire and annually, and report transactions quarterly.

Pre-clearance matters because the SEC looks for patterns, not isolated trades. If an adviser bought a security shortly before a client, the burden falls on your documentation to show it wasn't coordinated.

On communications, the SEC looks at whether your supervision is substantive. Reviewing a random 5% sample of emails and logging it as "reviewed" won't satisfy an examiner who asks what you actually found. Your communications archiving and supervision system needs to cover the channels advisors use, flag issues in context, and produce a defensible record of what was reviewed, when, and by whom.

Managing cybersecurity and data privacy under Regulation S-P

As of June 3, 2026, smaller RIAs must comply with the 2024 amendments to Regulation S-P, and the SEC has signaled that Reg S-P compliance is an exam priority. If you're registering now, these requirements apply to you from day one.

Your program must document four things:

• Written incident response procedures for unauthorized access to customer information
• Notification to affected individuals within 30 days of identifying a breach
• Oversight of service providers that handle customer data on your behalf
• Defined policies for disposing of consumer report information

As cybersecurity becomes a core compliance risk, the 30-day breach notification window is the biggest practical lift. That clock moves fast when you're also managing the incident itself, so your procedures need to exist before anything goes wrong, including who gets notified internally, who drafts the client notice, and who owns the timeline.

Managing third-party and vendor risk

Most RIAs launch with a stack of outside vendors before they've written their first policy: a custodian, a portfolio management system, a CRM, maybe a data aggregator. Each one touches client data, and under the amended Regulation S-P, that creates a direct compliance obligation. Your service provider oversight program needs written contracts requiring vendors to notify you of a breach within 30 days, so you can meet your own notification deadline to affected clients.

Beyond the contractual language, vendor due diligence means reviewing what each provider does with your data, how they secure it, and who they share it with. That review needs to be documented and repeated; a one-time check at onboarding isn't sufficient. The key elements:

• Due diligence questionnaires sent to each vendor covering data handling, security practices, and subprocessor use
• Contracts with explicit breach notification requirements tied to the 30-day Reg S-P window
• Annual re-review of each vendor, especially those with access to nonpublic client information
• A written inventory of which vendors hold what categories of client data

Examiners ask for the documentation. A vendor review that lives only in someone's memory, or in a spreadsheet that hasn't been updated in two years, won't hold up.

Conducting your annual compliance review

Rule 206(4)-7 requires an annual review, but the SEC's standard is substantive, not ceremonial. Examiners ask whether the review actually assessed how your program performed, not whether someone signed a document saying it happened.

A meaningful review covers four things:

• Compliance events from the prior year, including any violations, near-misses, or client complaints, and what they revealed about gaps in your policies or controls
• Regulatory changes that affected your business, such as updated Marketing Rule FAQs, new Reg S-P requirements, or updates to exam priorities
• Business changes at your firm, including new advisers, new strategies, new marketing channels, or new vendors that your current policies don't yet reflect
• Policy updates made in response to any of the above, with documented rationale for what changed and why

The SEC recommends the review consider "any compliance matters that arose during the previous year, any changes in the business activities of the adviser or its affiliates, and any changes in the Advisers Act or applicable regulations." Examiners look for evidence the review was grounded in your firm's actual activity, not a generic template refreshed annually with a new date.

Document the review in writing. A memo summarizing what was assessed, what changed, and who approved the updates gives examiners something to read. Without it, you're asking them to take your word for it.

Preparing for an SEC examination

The SEC's Division of Examinations routinely targets newly registered advisers in their early years, treating new registrants as a distinct examination category. The 2026 exam priorities call out fiduciary duty, marketing rule compliance, cybersecurity, AI use, and books and records as specific areas of focus. If you're registering now, don't assume you have a grace period.

An exam typically starts with a document request list covering advisory agreements, ADV filings, marketing materials, trade blotters, personal securities reports, vendor contracts, and your written policies. Examiners then conduct staff interviews to test whether your people understand the controls and actually follow them. A policy manual no one has read is a liability, not a defense.

The right frame is ongoing readiness, not last-minute exam prep. Keep your records current, your policies updated with firm compliance software, and your review documentation dated and signed. When an examiner asks what changed in your program last year, the answer should be in writing, not in someone's memory.

Using AI in your compliance program compliantly

The SEC's 2026 exam priorities name AI as a distinct area of focus, so using AI tools in your compliance or client-facing workflows is something you need to get right from the start.

A practical checklist for new RIAs:

• Disclose AI use to clients where it materially affects advice or recommendations, and reflect that disclosure in your Form ADV.
• Retain records of AI-assisted decisions the same way you'd retain any other advisory record.
• Supervise AI outputs for accuracy; your firm is responsible for what an AI tool produces, not the vendor.
• Apply the Marketing Rule to AI-generated content with the same rigor as anything a human wrote.
• Document your AI governance policies in writing, including which tools are approved, how outputs are reviewed, and who is accountable.

The SEC isn't opposed to AI use. What examiners look for is whether you've thought through the risks, disclosed appropriately, and built human review into the process. Using AI without those controls is the exam finding, not the AI itself.

How Greenboard supports new RIAs building their compliance programs

Building a compliant program from scratch means running several workstreams at once, and most new RIAs don't have the headcount to treat each one as a separate project. Greenboard is built for exactly that situation. More than 600 financial firms run their compliance programs on it, covering every core requirement discussed in this article: communications archiving and supervision, employee compliance (personal trading, pre-clearance, attestations, code of ethics workflows), marketing review checked against the SEC Marketing Rule and custom firm rules, firm compliance calendars and policy management, and third-party vendor due diligence.

The results reported by Greenboard customers are worth noting:

• FSG reduced vendor due diligence from a full week to one to two hours, freeing compliance staff for higher-judgment work.
• JMG Financial Group saw a 60%+ reduction in compliance onboarding time after consolidating three legacy systems onto one.
• Root Financial saves an estimated 24 hours per week on marketing review, with AI doing the first pass and compliance professionals making the final calls.

For a new RIA, the case for starting on unified infrastructure is straightforward. Building on point solutions means rebuilding coordination workflows as you grow. Starting on one system means your books and records, supervision logs, attestations, and vendor reviews all live in the same place from day one.

Final thoughts on new RIA compliance setup

The firms that handle SEC exams well are usually the ones that built their programs with real procedural detail from the start. Your policies, records, and supervision logs should reflect how your firm actually runs, not how a generic template says it should. Build that foundation now, and the annual upkeep gets a lot more manageable over time.

FAQ

How do I set up a compliance program for a new RIA from scratch?

Start with the three requirements under Rule 206(4)-7: written policies and procedures tailored to your actual business activities, a designated CCO with real organizational authority, and a process for conducting an annual review. From there, layer in your books and records infrastructure under Rule 204-2, a marketing review workflow that covers every channel your firm uses, personal trading controls, and vendor oversight documentation before you onboard your first client. Getting this structure in place before registration, not retroactively, is what makes your program defensible when examiners arrive.

What's the right way for a new RIA to use AI in its compliance program without creating exam risk?

Use AI tools with documented governance in place: a written policy naming which tools are approved, how outputs are reviewed, and who is accountable for decisions. Disclose material AI use to clients in your Form ADV, retain records of AI-assisted decisions the same way you'd retain any other advisory record, and apply the SEC Marketing Rule to AI-generated content with the same rigor as anything a human wrote. The SEC's 2026 exam priorities name AI as a specific area of focus, so the exam finding is using AI without those controls, not using AI itself.

Can I outsource my CCO role as a new RIA, or does the SEC require an in-house hire?

You can outsource the CCO role through an OCCO arrangement, and many new RIAs do. The SEC requires the designated individual to take real ownership of the program, meaning an outside consultant who drafts policies and runs your annual review still leaves your firm fully accountable for what happens under their watch. The practical test is whether that person has enough seniority and standing inside your organization to compel others to follow the firm's policies.

RIA compliance program Rule 206(4)-7 vs. just using a generic policy template: what's the difference in exam risk?

Rule 206(4)-7 requires policies "reasonably designed to prevent violations" given your specific business, so a generic template that doesn't reflect your fee arrangements, client types, conflicts, and actual communication channels creates a visible gap between what your documents say and what the evidence shows. Examiners are trained to spot that gap. A template can give you a structural starting point, but every firm-specific detail has to be worked in by someone who knows how your business actually runs.

How does Greenboard compare to RIA in a Box for a firm starting an RIA compliance program?

Greenboard is built as a unified compliance operating system, so archiving, marketing review, personal trading controls, attestations, and vendor due diligence all run on the same infrastructure from day one. RIA in a Box offers compliance support tools, but firms that consolidate from multiple point solutions onto Greenboard (JMG Financial Group being one example) report meaningful reductions in compliance onboarding time. For a new RIA without legacy systems to unwind, starting on unified infrastructure means your books and records, supervision logs, and vendor reviews are in one place from the start, which matters when an examiner asks you to produce documentation across all of them at once.