Financial Advisor Compliance: Duties, Disclosures, and Records

Financial advisor compliance requirements in the United States depend on how you’re registered. Registered investment advisers (RIAs) answer to the SEC or a state regulator under the Investment Advisers Act of 1940 and owe clients a fiduciary duty. Broker-dealers answer to FINRA and the SEC under the Securities Exchange Act of 1934 and must satisfy Regulation Best Interest. Both groups face detailed rules covering disclosures, supervision, recordkeeping, marketing, custody, anti-money laundering, and cybersecurity. Missing any of them can produce fines in the tens or hundreds of millions of dollars, individual suspensions, or a permanent industry bar.

Which Regulator You Answer To

The SEC oversees RIAs that manage $100 million or more in client assets. Those firms register through Form ADV and are governed primarily by the Investment Advisers Act of 1940.¹ RIAs charge fees for ongoing advice rather than commissions on transactions.

FINRA is the self-regulatory organization for broker-dealer firms and their registered representatives. Broker-dealers earn commissions executing securities transactions and follow the Securities Exchange Act of 1934 along with FINRA’s own rulebook covering sales practices, advertising, and supervision.² FINRA operates under SEC oversight.

State securities regulators handle RIAs managing less than $100 million and share jurisdiction with FINRA over broker-dealer agents who sell securities within their borders. If you’re a smaller advisory firm, your primary compliance relationship runs through the state, not the SEC.

Many firms are dually registered as both an RIA and a broker-dealer, which means satisfying both sets of rules at once. The SEC’s 2026 examination priorities specifically flag dually registered advisors as a focus area.³

The Standard of Care You Owe Clients

Fiduciary Duty for RIAs

An RIA owes clients a fiduciary duty under the Investment Advisers Act of 1940. You must act in the client’s best interest at all times, not only when making a specific recommendation. Conflicts of interest must either be eliminated or fully disclosed and mitigated so they don’t taint the advice. The SEC’s 2026 exam priorities state that examiners will scrutinize how advisors’ financial conflicts affect the impartiality of their recommendations.³

The duty is continuous. It covers the entire advisory relationship, and recommendations must line up with the client’s goals, risk tolerance, and financial situation. If a lower-cost index fund serves the client as well as a higher-fee proprietary product, the fiduciary standard makes the proprietary product a hard sell.

Regulation Best Interest for Broker-Dealers

Broker-dealers were historically held to a lower “suitability” standard under FINRA Rule 2111, which only required a reasonable basis to believe a recommendation was appropriate.⁴ Regulation Best Interest, effective June 2020, raised that bar. Reg BI requires broker-dealers and their representatives to act in the “best interest” of retail customers when making any recommendation.⁵ Compliance requires satisfying four obligations at the same time.

The Disclosure Obligation requires written disclosure of all material facts about the recommendation and the relationship before or at the time of the recommendation. The Care Obligation requires reasonable diligence and skill in understanding the risks, rewards, and costs of a recommendation, and a reasonable basis to believe it’s in that particular customer’s best interest.⁶ The Conflict of Interest Obligation requires written policies to identify, disclose, and mitigate conflicts; sales contests and quotas tied to specific products must be eliminated. The Compliance Obligation requires written policies designed to achieve compliance with Reg BI overall.

The practical gap between fiduciary duty and Reg BI comes down to conflicts. A fiduciary generally must eliminate conflicts or reduce them until they no longer influence the advice. Reg BI requires mitigation and disclosure but not elimination. A broker-dealer can still recommend a proprietary fund with higher internal costs if they can demonstrate it’s genuinely the best option for that customer.

Disclosures You Must Deliver

Form ADV and the Firm Brochure

Every RIA files Form ADV with the SEC or the appropriate state regulator. Part 2A is the “firm brochure,” describing services, fees, conflicts of interest, and disciplinary history.¹ Clients must receive the brochure before or at the time they sign an advisory contract, and RIAs must offer an updated version to existing clients annually.

Part 2B is the “brochure supplement,” a separate document for each individual who provides advice to a given client. You deliver the supplement when a client first begins working with a specific advisor, and again if an existing client is reassigned to someone new. Supplement updates are event-driven; you must amend and deliver when the information becomes materially inaccurate.

Form CRS

Both RIAs and broker-dealers must deliver a Customer Relationship Summary, Form CRS, to retail investors. It’s a short document summarizing the relationship, fees, conflicts, and disciplinary history. Broker-dealers must deliver it before recommending an account type, a transaction, or an investment strategy.⁷ RIAs deliver before or at the time of entering into an advisory contract.⁸

Existing clients must receive an updated Form CRS when specific events occur, such as opening a different type of account or receiving a rollover recommendation. If you amend Form CRS, you have 60 days to communicate the changes to existing clients. Clients who request a copy must receive one within 30 days.⁸

Written Compliance Program and Supervision

Every SEC-registered RIA must designate a Chief Compliance Officer responsible for administering the firm’s policies and procedures. The firm must review the adequacy of those policies, and how they’re implemented, at least once a year.⁹ The annual review should identify gaps created by new business activities, regulatory changes, or past compliance failures. Examiners evaluate the quality of the program during inspections.

On the broker-dealer side, FINRA Rule 3110 requires each firm to establish a supervisory system designed to prevent and detect violations. The firm must designate registered principals to supervise each type of business activity and each branch office, and every registered representative must be assigned to a supervisor.¹⁰ Written procedures must describe who reviews customer accounts, trade activity, and correspondence, how often, and how each review is documented. Branch offices require periodic inspections that include reviewing business records and electronic communications.²

Recordkeeping and Off-Channel Communications

Under SEC rules, broker-dealers must preserve certain core records, such as trade blotters, ledgers, and account statements, for at least six years, with the first two years easily accessible. Other categories, including order tickets and communications, carry a minimum three-year retention period.¹¹ FINRA’s own rules impose a six-year minimum for records that don’t have a different retention period specified elsewhere.¹² Electronic records must be stored in a format that prevents alteration, either through a write-once, read-many format or a compliant audit trail.¹³

No single compliance issue has generated more enforcement dollars in recent years than off-channel communications. When employees use personal phones, WhatsApp, Signal, or other unapproved apps to discuss business, the firm loses the ability to archive and review those conversations, which undermines the entire supervisory system.

The SEC fined 26 firms a combined $392.75 million in 2024 for failing to preserve electronic communications on unapproved channels.¹⁴ In early 2025, another 12 firms paid over $63 million in combined penalties for the same type of violation, with individual fines ranging from $600,000 to $12 million.¹⁵ The 2025 group included Charles Schwab, Blackstone, KKR, and Carlyle.

FINRA’s 2026 Regulatory Oversight Report highlights common failures: not archiving non-email electronic communications on approved channels, missing emails sent through third-party vendor addresses, and failing to detect when associated persons use personal accounts for business.¹³ Firms that get this right tend to watch for signs employees have shifted off approved channels, such as a sudden drop in messaging volume, and regularly update the keyword searches they use to detect off-channel activity.

Marketing and Advertising

The SEC’s Marketing Rule, codified as Rule 206(4)-1, overhauled advertising regulations for investment advisers. Under the old rules, RIAs were flatly prohibited from using client testimonials. That blanket ban is gone. RIAs can now include testimonials from current clients and endorsements from non-clients, provided they meet specific conditions.¹⁶

The conditions are not trivial. The firm must disclose whether the person giving the testimonial is a current client, whether compensation was provided, and any material conflicts of interest. Compensated testimonials require a written agreement describing scope and terms. The firm must have a reasonable basis for believing each testimonial complies with the rule, and anyone disqualified under the rule’s “bad actor” provisions cannot be paid for one. Performance advertising has its own presentation requirements, including showing net-of-fee returns. Marketing Rule compliance is a core SEC examination area for 2026.³

Broker-dealer communications fall under FINRA Rule 2210. A registered principal must approve each retail communication before it’s used or filed with FINRA’s Advertising Regulation Department. Retail communications are defined as any written material distributed to more than 25 retail investors within a 30-day period.¹⁷ Certain items, like posts on interactive online forums or materials that don’t make investment recommendations, can go through general correspondence supervision instead of pre-approval.

Custody of Client Assets

If your RIA has custody of client funds or securities, you’re subject to one of the most detailed compliance requirements in the industry. The SEC’s custody rule, Rule 206(4)-2, requires that a qualified custodian hold all client assets. A qualified custodian is typically a bank with FDIC-insured deposits or a registered broker-dealer.¹⁸

Four obligations sit at the center of the rule. Client funds and securities must be held in separate accounts under each client’s name or in accounts containing only client assets under the adviser’s name as agent. When you open a custodial account, you must promptly notify the client in writing of the custodian’s name, address, and how the assets are maintained. You must have a reasonable basis for believing the custodian sends account statements to each client at least quarterly, showing all holdings and transactions. And an independent public accountant must verify client assets through an unannounced examination at least once per calendar year, at an irregular time chosen by the accountant, with results filed with the SEC on Form ADV-E within 120 days. If the accountant discovers material discrepancies, they must notify the SEC within one business day.¹⁸

Anti-Money Laundering and Cybersecurity

The Bank Secrecy Act requires financial institutions, including broker-dealers, to maintain anti-money laundering programs. These must include procedures to verify the identity of every new client, ongoing monitoring for suspicious activity, and reporting when transactions exceed $10,000 or appear to involve illegal activity.¹⁹ The program must designate a compliance officer, provide staff training, and include independent testing by internal personnel or an outside party.²⁰

Regulation S-P requires every covered financial institution to develop, implement, and maintain written policies addressing administrative, technical, and physical safeguards for client information.²¹ That includes encryption, access controls, data loss prevention, and written breach-response procedures. The SEC’s 2026 examination priorities treat cybersecurity as a dedicated focus area. Examiners will assess governance practices, data loss prevention, account management, and how firms respond to and recover from incidents, including ransomware attacks. Firms are also expected to have training and security controls covering risks from artificial intelligence and new forms of malware.³

Artificial Intelligence in Advice

FINRA’s 2026 Regulatory Oversight Report identifies several risks firms must account for when deploying AI, particularly generative AI “agents” that autonomously perform tasks for users.²² The concerns are practical: an AI agent might act beyond its intended scope, produce recommendations that can’t be audited or explained, or mishandle sensitive client data.

FINRA doesn’t treat AI tools differently from other business activity. If an AI system generates investment recommendations, supervisory obligations still apply. Someone must be able to trace how the recommendation was made and verify it meets applicable standards. The SEC’s 2026 exam priorities add that examiners will review whether firms’ claims about AI capabilities are accurate and whether AI tools are being used in ways consistent with the firm’s fiduciary or Reg BI obligations.³ Firms that market themselves as using AI-driven advice face heightened scrutiny on whether the reality matches the marketing.

Continuing Education

Compliance doesn’t end at initial registration. FINRA’s continuing education program has two mandatory components. The Regulatory Element is an annual computer-based training requirement administered directly by FINRA. The Firm Element requires each broker-dealer to design and deliver its own annual training tailored to its business activities and to the roles of its registered persons. Firms can develop their own content or use FINRA’s centralized platform, called the Financial Learning Experience (FLEX).²³

For investment adviser representatives, the North American Securities Administrators Association (NASAA) has adopted a model rule requiring 12 credits of approved training annually in states that have implemented it. The number of participating states continues to grow, so IARs should verify their own state’s requirements. FINRA qualification exams, such as the Series 7 for general securities representatives, remain prerequisites for registration; continuing education builds on top of those initial licensing requirements.

Examinations and Enforcement

The SEC examines RIAs on a risk-based schedule. Larger firms, those with custody of client assets, and those flagged by complaint patterns or unusual activity face more frequent inspections. Routine exams cover fiduciary conduct, conflicts of interest, custody practices, marketing materials, and the overall adequacy of the compliance program. For 2026, the SEC has identified additional focus areas including alternative and complex investment products, advisors serving older investors and those approaching retirement, and firms that have recently merged or been acquired.³

FINRA’s examination program targets broker-dealer sales practices, supervisory systems, and financial stability. Examiners review electronic communications, trade records, and supervisory logs. Targeted exams can be triggered by spikes in customer complaints or unusual trading patterns.¹³

When an examination uncovers potential violations, the matter may be referred for formal investigation. For firms, penalties commonly include monetary fines that can reach hundreds of millions of dollars, as the off-channel communications cases demonstrate. The SEC can also issue cease-and-desist orders requiring immediate corrective action. For individuals, consequences run from temporary suspension to a permanent industry bar. Administrative proceedings and civil actions can be brought against the firm and the individual advisor separately.

Where Clients Can Verify Your Record

Regulators maintain free databases that let anyone check an advisor’s background. FINRA BrokerCheck covers broker-dealers and their registered representatives, showing registration status, employment history, qualification exams, disciplinary actions, and customer complaints.²⁴ The SEC’s Investment Adviser Public Disclosure (IAPD) database contains the Form ADV filings for all registered investment advisers and cross-references BrokerCheck to indicate whether a firm is also registered as a broker-dealer.²⁵ Anything a client can see there, an examiner can see too, which makes keeping those filings accurate a compliance task in its own right.

1
Securities and Exchange Commission. Form ADV General Instructions
2
Financial Industry Regulatory Authority. Supervision
3
U.S. Securities and Exchange Commission. Fiscal Year 2026 Examination Priorities
4
Financial Industry Regulatory Authority. FINRA Rule 2111 – Suitability
5
U.S. Securities and Exchange Commission. Regulation Best Interest
6
eCFR. 17 CFR 240.15l-1 – Regulation Best Interest
7
eCFR. 17 CFR 240.17a-14 – Form CRS
8
eCFR. 17 CFR 275.204-5 – Delivery of Form CRS
9
eCFR. 17 CFR 275.206(4)-7 – Compliance Procedures and Practices
10
Financial Industry Regulatory Authority. FINRA Rule 3110 – Supervision
11
eCFR. 17 CFR 240.17a-4 – Records to Be Preserved
12
Financial Industry Regulatory Authority. FINRA Rule 4511 – General Requirements
13
Financial Industry Regulatory Authority. 2026 Annual Regulatory Oversight Report
14
U.S. Securities and Exchange Commission. Twenty-Six Firms to Pay More Than $390 Million
15
U.S. Securities and Exchange Commission. Twelve Firms to Pay More Than $63 Million Combined
16
eCFR. 17 CFR 275.206(4)-1 – Investment Adviser Marketing
17
Financial Industry Regulatory Authority. FINRA Rule 2210 – Communications with the Public
18
eCFR. 17 CFR 275.206(4)-2 – Custody of Funds or Securities of Clients
19
FinCEN.gov. The Bank Secrecy Act
20
FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program
21
eCFR. 17 CFR 248.30 – Procedures to Safeguard Customer Information
22
Financial Industry Regulatory Authority. FINRA Publishes 2026 Regulatory Oversight Report
23
FINRA.org. Continuing Education
24
Financial Industry Regulatory Authority. About BrokerCheck
25
Investment Adviser Public Disclosure. About the Investment Adviser Public Disclosure Website