Checked against primary sources on 4 November 2026.
Who it applies to
Advisers registered, or required to register, with the SEC under section 203 of the Advisers Act, which must have the rule's written policies in place before they give advice to clients.
Who checks
SEC Division of Examinations staff, who ask for the policies in effect, the annual review records and the code of ethics materials when they examine an adviser.
How often
At least once a year; the adopting release also says advisers should consider interim reviews after significant compliance events, business changes or regulatory developments.
Current edition
17 CFR 275.206(4)-7, as amended November 19, 2024 (89 FR 91252), 2024-11-19. Free to read.
Dates to know
Dates for RIA compliance manual
Date
What happens
Status
2003-12-17
SEC adopts the compliance rule and issues release IA-2204, effective February 5, 2004
Done
2026-09-14
SEC staff risk alert on investment adviser annual compliance reviews
Done
What an RIA compliance manual covers
Each one needs an owner, an approval, and proof it reached the people it covers.
Adopting release IA-2204, 68 FR 74714
Portfolio management and trading
The release expects policies on portfolio management processes, including how investment opportunities are allocated among clients, and on trading practices, including best execution, client brokerage used for research and other services, and allocating aggregated trades.
How opportunities are allocated among clients
How portfolios are kept consistent with client objectives and the adviser's disclosures
Best execution, soft dollar and trade allocation procedures
IA-2204; 17 CFR 275.204A-1
Personal and proprietary trading
Policies on the adviser's own trading and the personal trading of supervised persons, which the code of ethics rule also requires in the form of reporting.
Access person holdings and quarterly transaction reports
Exemptions granted and who approved them
IA-2204, 68 FR 74714
Accuracy of disclosures and marketing
Policies that keep what the adviser tells investors, clients and regulators accurate, including account statements and advertisements, and policies on marketing advisory services, including the use of solicitors.
Who reviews disclosures and advertisements before they go out
Procedures for the use of solicitors
IA-2204, 68 FR 74714
Safeguarding client assets, valuation and fees
Policies that stop staff taking or misusing client assets, and set how holdings are valued and fees worked out from those valuations.
Who can touch client assets and how it is checked
How holdings are valued and fees calculated
IA-2204; 17 CFR 275.204-2
Books and records
Procedures for creating the records the rules require and for storing them so nobody can change them without authority or destroy them early.
Every version of the policies in effect during the past five years
Records documenting the annual review
IA-2204; 17 CFR 248.30
Privacy safeguards and business continuity
How client records stay private, and how the firm keeps running through a disruption.
Safeguard procedures and responsible owners
The continuity plan and who maintains it
17 CFR 275.204A-1(a)
Code of ethics and acknowledgments
The code of ethics rule asks for a written code and, from every supervised person, a written acknowledgment that they received it and each amendment to it.
Person, code version and date acknowledged
An acknowledgment for each amendment
17 CFR 275.206(4)-7(b); 275.204-2(a)(17)(ii)
Annual review records
The rule requires a review, at least once a year, of whether the policies are adequate and being carried out effectively, and the books and records rule asks the adviser to keep any records that document that review.
Review period covered, with no gaps
Policy versions the review assessed
Citations are to the standard or regulation; wording is ours. The policy areas are summarized from the SEC adopting release for Rule 206(4)-7 (IA-2204, 68 FR 74714), in our own words.
What gets asked for on the day
What reviewers sample about these documents and the people they cover.
The manual as it stood during the exam period
The staff's typical first request asks for the compliance policies and procedures in effect during the period under examination, so a manual that was rewritten mid-period needs every version that applied.
Reviews of that manual
Staff also ask for annual and interim reviews and any reports prepared, and the September 2026 risk alert names reviews of policy versions that had already been replaced as something it observed.
The policy and acknowledgment layer for an RIA compliance manual.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Approved before it goes outUp to four steps, with any or all approvers.
Acknowledged by nameName, email, date, time and version on every record.
Asked again on every changeEach new version goes out again to everyone it applies to.
The record on requestA PDF or CSV export, or Viewer access to the documents their tags allow.
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
The rule asks for written policies and procedures, adopted and implemented, reasonably designed to prevent violations of the Advisers Act. The adopting release says they should address, to the extent relevant to the adviser, portfolio management processes, trading practices, proprietary and personal trading, the accuracy of disclosures, safeguarding client assets, accurate records, marketing, valuation and fees, privacy and business continuity.
Can a template manual satisfy the rule?
The adopting release says each adviser should adopt policies and procedures that take into consideration the nature of that firm's operations, and that a smaller firm without conflicting business interests would need much simpler policies. A template is a starting point; the finished manual has to describe how your firm works.
How often must the manual be reviewed?
At least once a year under Rule 206(4)-7(b). The adopting release adds that advisers should consider interim reviews after significant compliance events, changes in the business or regulatory developments.
