Mid-size RIAs are in a tricky spot. You've outgrown the informal oversight that works at a small firm, but you're probably not staffed like a large institution either. Vendor due diligence and marketing review tend to be where that gap shows up first, and right now, they're two of the SEC's stated exam targets for 2026.
TLDR:
- Delegation doesn't transfer accountability: your RIA owns the regulatory exposure even when a vendor causes the breach.
- Reg S-P now requires client notification within 30 days of a breach, whether it originates with your firm or a third party.
- The SEC Marketing Rule covers every format: LinkedIn posts, podcasts, award badges, and advisor conference presentations all count as advertising.
- Your vendor oversight and marketing policies need to connect: the rating provider behind your award badge is also a vendor requiring due diligence.
- Greenboard runs vendor due diligence and marketing compliance review inside the same system, with a shared audit trail for exam requests.
Why third-party and marketing compliance demand equal attention at mid-size RIAs
Mid-size RIAs sit in an awkward spot. They've outgrown the handshake oversight that works for a five-person shop, but they rarely have the dedicated compliance staff that a large institution can field, a gap that often becomes a compliance bottleneck as firms grow. That gap shows up most clearly in two areas: the vendors they rely on and the marketing content they publish.
The SEC's 2026 examination priorities call out vendor oversight and Marketing Rule compliance as recurring exam targets. For a mid-size RIA, that's not an abstract warning. It means examiners are showing up with specific questions about your third-party relationships and your content review workflows, and "we're working on it" is not a defensible answer.
What "third-party compliance" actually means for an RIA
Third-party compliance covers every service provider that touches your firm's regulatory obligations, whether they're executing trades, storing client data, or running your CRM. Custodians, sub-advisers, portfolio accounting vendors, cybersecurity providers, and outsourced compliance consultants all fall within scope.
The key principle: delegation doesn't transfer accountability. If a vendor mishandles client data or executes a function improperly, the RIA still owns the regulatory exposure. The SEC has made clear that firms must conduct due diligence before onboarding a service provider and continue monitoring them on an ongoing basis. The third-party relationship changes who does the work. It doesn't change who answers for it.
The regulatory framework behind vendor oversight
The obligation to oversee vendors doesn't come from one tidy rule. It's built from several overlapping requirements.
Rule 206(4)-7 requires RIAs to maintain written policies and procedures reasonably designed to prevent securities law violations, which regulators interpret to include how you manage third parties. The Investment Advisers Act of 1940 reinforces fiduciary obligations that don't pause when you hand a function to a vendor.
The 2024 amendments to Regulation S-P added the most concrete requirements. As of June 3, 2026, smaller firms must now formally oversee vendors that access or process customer data, and if a breach occurs, whether it originates with the firm or a third party, clients must be notified within 30 days. Documentation of due diligence and ongoing monitoring is expected, not optional.
How to build an RIA vendor due diligence program
A defensible vendor due diligence program starts with risk tiering. Not every vendor warrants the same scrutiny. A firm providing office supplies is different from one hosting client data or executing compliance functions. The SEC expects you to identify which vendors pose material risk and document how you assessed them before onboarding.
For higher-risk vendors, your review should cover:
- Security controls and certifications, including SOC 2 reports and encryption standards
- Data handling practices and privacy policies
- Financial stability and business continuity planning
- Contractual provisions, including incident notification timelines aligned with Reg S-P's 30-day requirement
- References and regulatory history
The documentation matters as much as the review itself. Examiners want to see that you asked the right questions, received answers, and made a reasoned decision. A checklist buried in email threads doesn't hold up. A structured questionnaire with retained responses does.
Ongoing vendor monitoring after onboarding
Onboarding review is the entry exam. Ongoing monitoring is the actual course.
For most mid-size RIAs, the practical challenge is deciding how often to revisit each vendor relationship. Many firms use annual reviews as a baseline for high-risk vendors and move higher-risk providers to an 18-month or two-year cycle for lower-risk ones. What matters is that the cadence is written down and followed consistently, not improvised when an exam approaches.
Certain events should trigger an off-cycle review regardless of where a vendor falls in your schedule:
- A reported data breach or security incident
- An acquisition or ownership change at the vendor
- Material changes to their data handling or subcontractor relationships
- A regulatory action against the vendor
Ownership is where lean compliance teams usually slip. If monitoring is everyone's job, it becomes no one's. Assign specific vendors to specific people, even if that person is the CCO wearing three hats. A simple log showing reviewer, review date, findings, and any follow-up actions gives you something defensible when examiners ask how your program actually runs.
The SEC Marketing Rule and what it requires of RIAs
SEC Rule 206(4)-1 consolidated the prior advertising and cash solicitation rules into one framework, fully enforceable since November 2022. It governs testimonials, endorsements, third-party ratings, performance advertising, and where required disclosures must appear.
A December 2025 SEC Risk Alert signaled continued examiner scrutiny of these exact areas heading into 2026. The recurring deficiencies were specific: missing written agreements with promoters, inadequate oversight documentation, and disclosures that were technically present but poorly timed or buried. Firms using client testimonials, award badges, or influencer-style referral arrangements are on notice that those materials will get a hard look.
Marketing compliance is no longer a light review before you hit publish. It requires written policies, documented pre-approval workflows, and retention of every version of every piece of content you put in front of a prospect.
Marketing compliance across content types
The Marketing Rule applies to your YouTube channel, your advisor's LinkedIn post, your quarterly newsletter, and the podcast episode you uploaded last Tuesday. Each format carries real disclosure and substantiation requirements, and "we didn't know that counted as advertising" is not a defense examiners accept.
For firms running distributed content programs, the supervision burden compounds fast. An advisor posting independently, a marketing team publishing weekly newsletters, and a founder with a YouTube channel all create separate review queues that need documented workflows behind them.
A few channel-specific points worth keeping in mind:
- Video and podcast content requires the same disclosure checks as print, including balanced presentation of performance and proper handling of any client testimonials
- Social media posts, even short-form ones, are advertisements under the rule if they promote services or reference results
- Third-party ratings shared in any format require a written agreement with the rating provider and specific accompanying disclosures
- Advisor-authored content, including conference presentations, falls under firm supervision requirements tied to broader employee compliance obligations, regardless of whether the firm's brand appears on it
Supervision of electronic communications
Rule 204-2 requires RIAs to retain records of all written communications relating to recommendations, receipt of funds, and performance. In practice, that means email, text, Slack, and any other channel your advisors use with clients.
The supervision obligation goes further than retention. Firms must show that someone is reviewing those communications and acting on issues. Examiners want a workflow, an assigned reviewer, and a log of what was flagged and what happened next.
Most communications archive vendors handle retention adequately. Supervision is where the gaps appear. Lexicon-based tools flag every message containing words like "guarantee" or "promise," regardless of context, generating volume without signal. Reviewers wade through false positives and miss the conversations that actually carry risk.
Contextual AI supervision is designed to read messages the way a reviewer would, weighting meaning over keyword pattern-matching. At JMG Financial Group, which doubled headcount over five years, switching to contextual supervision produced "solid time savings in those eComms reviews week over week" with fewer false flags than their prior provider.
AI surfaces what's worth reviewing. Compliance professionals make the call.
Building written policies and procedures that connect vendor and marketing risk
Most RIA compliance policies treat vendor oversight and marketing review as separate chapters with no connection between them. Examiners notice that gap.
Third-party relationships and marketing activity intersect constantly. The rating provider behind your award badge is a vendor. The promoter running your referral program needs a written agreement and due diligence documentation. Your email archiving vendor is a covered service provider under Reg S-P. Writing policies in silos means those intersections go unmanaged.
Rule 206(4)-7 requires policies designed to prevent violations across all material risk areas as part of broader firm compliance programs, which regulators read broadly. A policy that describes your vendor review process but says nothing about how vendor changes trigger a marketing content audit is incomplete. Neither is a marketing policy that ignores what happens when a third-party rating you've been displaying loses its written agreement.
The harder discipline is keeping policies current. Assign someone ownership of each policy, set a review cadence tied to actual firm activity, and build a trigger list:
- New vendor onboarded
- New content channel launched
- Regulatory change issued
Those events should prompt a policy review, not wait for it. Policies should also describe what your firm actually does. If your marketing review runs through a specific workflow with named roles and retention steps, write that down. Vague language like "as appropriate" or "periodically" creates ambiguity that examiners will fill in against you.
Preparing for an SEC exam when third-party and marketing compliance are both in scope
Examiners don't announce which area they'll focus on first. They often pull vendor documentation and marketing materials in the same request, which means gaps in either area surface quickly.
For vendor oversight, have these ready:
- A current vendor inventory with risk tier designations
- Due diligence questionnaires with responses retained by vendor
- Written contracts that include data handling terms and incident notification timelines
- A monitoring log showing reviewer, date, findings, and any remediation steps
For marketing compliance, examiners will typically request a sample of recent advertisements across formats, the written policies and pre-approval workflows behind them, and records showing who reviewed each piece and when. Written agreements with any testimonial providers, endorsers, or rating sources belong in that same folder.
| Vendor Oversight | Marketing Compliance |
|---|---|
| Current vendor inventory with risk tier designations | Recent advertisements across all formats (video, social, newsletters) |
| Due diligence questionnaires with retained responses, by vendor | Written pre-approval policies and documented workflows |
| Written contracts covering data handling and incident notification timelines | Review records showing who approved each piece and when |
| Monitoring log: reviewer, date, findings, and remediation steps | Written agreements with testimonial providers, endorsers, and rating sources |
The common gaps at mid-size RIAs tend to cluster around the same problems: vendor inventories that haven't been updated in 18 months, marketing approvals documented in email threads instead of a structured log, and written agreements with promoters or rating providers that are missing entirely. If your disclosure appears in small print at the bottom of a video description instead of upfront in the content itself, expect that to be flagged.
Run a pre-exam self-assessment at least annually where you pull the same materials an examiner would request and look for what's missing or stale. It's a straightforward exercise that surfaces problems while you still have time to fix them.
How Greenboard approaches third-party and marketing compliance for RIAs
At Greenboard, we built third-party compliance and marketing compliance into the same system, not as separate problems. More than 600 financial advisors and firms run their compliance programs with us, and over 99% stay year over year.
For vendor due diligence, our AI pre-fills questionnaires from public sources and automates the research process. At FSG, that dropped vendor review from a full week to one to two hours per cycle, their team's result after switching to Greenboard. As Steve Robinson put it:
"We would do vendor due diligence for a week, and now a single person can get it done within an hour or two." Steve Robinson, Director of Technology and Logistics, Financial Strategies Group
For marketing compliance, AI reviews ads, social posts, newsletters, and videos up to 5GB against the SEC Marketing Rule and your firm's own guidelines. It flags the specific rule triggered, suggests reworded language, and logs every decision in a 17a-4 and WORM-compliant audit trail. Both modules run inside the same permissions structure, so when examiners ask for documentation across vendor oversight and marketing review, it's all in one place.
Final thoughts on managing third-party and marketing risk at your RIA
Most exam problems at mid-size RIAs trace back to the same root: things were handled, just not documented. Your vendor reviews may be thorough, your content approvals may be careful, but if the records are scattered across email threads and spreadsheets, that work is hard to show. Tightening the documentation is often the biggest move you can make.
FAQ
What does vendor due diligence actually require from an RIA under the 2024 Reg S-P amendments?
Under the 2024 Reg S-P amendments, RIAs must formally document due diligence for any vendor that accesses or processes customer data, and contracts must include incident notification timelines aligned with the 30-day client notification requirement. That means a structured questionnaire with retained responses, not a checklist buried in email. Examiners want evidence you asked the right questions, received answers, and made a reasoned decision before onboarding.
What's the fastest way for a mid-size RIA to get vendor due diligence done without hiring more compliance staff?
The bottleneck is usually research, not review. AI that pre-fills due diligence questionnaires from public sources and automates vendor research with cited sources can materially reduce the time spent on each vendor cycle, as shown in the FSG case study above. That lets a lean compliance team run a defensible RIA third-party compliance program without adding headcount.
How does RIA marketing compliance work across distributed content like advisor LinkedIn posts, YouTube channels, and newsletters?
Each format is an advertisement under SEC Rule 206(4)-1 if it promotes services or references results, so each requires its own documented pre-approval workflow and retention record. The supervision burden compounds when advisors post independently, a marketing team publishes newsletters, and a founder runs a YouTube channel, because each creates a separate review queue. Written policies need to name the specific roles and steps in your review process; language like "as appropriate" gives examiners room to fill in the gaps against you.
How do I structure written compliance policies so that vendor oversight and RIA marketing compliance aren't siloed from each other?
Write your policies to reflect where the two areas actually intersect: the rating provider behind your award badge is a vendor, the promoter running your referral program needs both a written agreement and due diligence documentation, and your email archiving vendor is a covered service provider under Reg S-P. A vendor policy that says nothing about how a vendor change triggers a marketing content audit is incomplete, and vice versa. Assign ownership of each policy to a named person, set a review cadence tied to firm activity, and build a trigger list so that new vendors, new content channels, and regulatory changes prompt a policy review proactively, not after the fact.
What should a mid-size RIA have ready before an SEC exam that covers both vendor oversight and marketing compliance?
For vendor oversight, have a current vendor inventory with risk tier designations, due diligence questionnaires with retained responses, written contracts covering data handling and incident notification, and a monitoring log showing reviewer, date, findings, and any follow-up. For marketing compliance, examiners will typically request recent advertisements across formats, written pre-approval workflows, records showing who reviewed each piece and when, and written agreements with any testimonial providers, endorsers, or rating sources. Running an annual self-assessment where you pull the same materials an examiner would request is the most straightforward way to surface gaps while there's still time to fix them.
