> ## Content Index
> Fetch the complete content index at: https://www.intercepta.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Annual compliance reviews under Rule 206(4)-7: the SEC Risk Alert of September 2026
- URL: https://www.intercepta.ai/blog/sec-annual-compliance-review-alert/
- Published: 2026-10-08T09:00:00.000Z
- Updated: 2026-10-08T09:00:02.000Z
- Description: The SEC’s September 2026 Risk Alert sets out issues examiners observed regarding adviser annual compliance reviews, including how advisers documented them.
- Author: Edward Sweigart
- Tags: Regulatory, Financial Services, Audit Trail, Compliance, #rail

*At least once a year, every investment adviser registered or required to be registered with the SEC must review its own compliance policies and procedures, including those that govern marketing. In September 2026, the SEC’s examination staff published issues they observed regarding those reviews, among them years for which none was undertaken and annual reviews in which advisers did not identify inconsistencies in areas such as fee and expense billing, proxy voting, custody and marketing. This piece sets out those observations, together with the records of the annual review that Rule 204-2 requires an adviser to make and keep.*

## A staff alert on the Compliance Rule

On 14 September 2026, the Division of Examinations at the Securities and Exchange Commission (SEC) published a Risk Alert, “Examinations Observations Regarding Investment Adviser Annual Compliance Review”. Its subject is the annual review required by Rule 206(4)-7 under the Investment Advisers Act. The rule, known as the Compliance Rule, applies to investment advisers that are, or are required to be, registered with the SEC, and it sets three requirements. An adviser must adopt and implement written compliance policies and procedures, and those policies and procedures must be reasonably designed to prevent the firm and its supervised persons from violating the Act or the SEC’s rules under it. The adviser must review them at least annually, assessing whether they are adequate and whether they are being implemented effectively. The third requirement is for the adviser to designate a chief compliance officer to administer them.

![Diagram of Rule 206(4)-7 setting out three requirements for advisers registered or required to be registered with the SEC, written policies and procedures, an annual review and a chief compliance officer, with Rule 204-2 requiring review records.](https://www.intercepta.ai/blog/content/images/2026/10/fig1-compliance-rule--2400x1400--v7.png)

The Compliance Rule requires written policies and procedures, an annual review of them and a chief compliance officer to administer them, and Rule 204-2 requires the records of that review to be kept.

A Risk Alert sets out the views of the Division’s examination staff, and this alert states that it “is not a rule, regulation, or statement of the Securities and Exchange Commission” and that it “creates no new or additional obligations for any person”. It contains no firm names and no counts of how often each issue was observed. The observations still warrant attention, since the alert states that the Division “often requests information regarding advisers’ annual reviews during examinations”, and the issues it sets out were observed by the staff in recent examinations.

## The staff’s observations

![Grid of the observation headings in the SEC's September 2026 Risk Alert on annual compliance reviews, each paired with one example from the alert, from missed review years to recommended corrective action not taken.](https://www.intercepta.ai/blog/content/images/2026/10/fig2-staff-observations--2400x1400--v9.png)

The observation headings in the body of the alert cover the timeliness of annual reviews, the completeness of policies and procedures for conducting them, their consistency with written procedures, whether compliance policies and procedures fully address and align with practices, the maintenance of documentation made regarding them, and taking corrective actions for issues identified in them.

### Timeliness of the review

In the alert’s opening observations, the staff addressed the timeliness of annual reviews. The staff observed advisers that had gaps in their annual reviews, for example, reviews conducted for 2021 and 2023 and none for 2022\. Other advisers had reviewed periods longer than 12 months, among them first reviews conducted 18 months after registration with the Commission, and extended intervals as a result of changes in their business, operations or personnel, such as the departure of a chief compliance officer. Under the Commission’s 2003 adopting release, cited in a footnote to the alert, an adviser’s first annual review was to be completed no later than 18 months after its compliance policies and procedures were adopted or approved. Under the release, that period was a transition allowance tied to the rule’s compliance date of 5 October 2004, and the footnote states that under the Compliance Rule every later review must be performed at least annually.

Some advisers had performed no annual review and said instead that giving their personnel compliance training, or having personnel attest each year that they had followed the compliance policies and procedures, met the annual review requirement. Others had already received deficiency letters from the staff for missing or late annual reviews and had still not taken corrective action. All of these are listed in the alert under its observation that some advisers had not reviewed the adequacy of their compliance policies and procedures, and the effectiveness of their implementation, at least once a year as the Compliance Rule requires.

### Procedures for conducting the review

The procedures for the review itself are the subject of a second set of observations. The staff observed advisers “that had compliance policies requiring annual reviews, but they did not adopt procedures or had incomplete procedures for their personnel to use when assessing whether the advisers’ policies and procedures were adequate and effectively implemented”. In one of the alert’s examples, the advisers’ compliance policies provided that each annual review was to be documented and was to include testing and validation. Yet the advisers had not written down how that testing and validation was to be performed, how its results were to be used in assessing whether the policies and procedures were adequate and effectively implemented, or what documentation was to be made and kept in support of the review.

### Consistency with written procedures

The staff also observed reviews that were conducted on time but were inconsistent with the firm’s own written procedures. Some advisers did not follow their own policies and procedures, which required them “to cover a defined review period or scope, utilize specified work papers or other documentation, and perform specific tasks and tests”. In other reviews, the wrong documents were assessed, such as versions of the firm’s policies and procedures that had been superseded before the review period began. A review conducted on schedule can therefore still be the subject of an observation if it is not carried out in the manner stated in the firm’s own written procedures.

### Alignment with practice

The alert next describes observations on whether firms’ policies and procedures fully addressed, and were aligned with, what the firms did in practice. The staff observed advisers that had carried out their annual reviews without recognising a shortfall of either kind. Such advisers included those that had not adopted policies and procedures covering the core risk areas of their own businesses, and those that had not taken account of changes in their business activities relevant to the assessment of whether their policies and procedures were adequate and effectively implemented. Among the alert’s examples are advisers that in their annual reviews did not identify fee and expense billing practices inconsistent with their policies and procedures or with their client disclosures; proxy voting policies under which the advisers would vote proxies, although in practice the advisers did not vote proxies and had disclosed to clients that they did not; and custody policies and procedures that lacked steps to ensure that the independent public accountant conducting the surprise examination was informed of which accounts were subject to the adviser’s custody.

The same list includes marketing policies and procedures “that were not updated to reflect the adoption of the marketing rule under the Advisers Act”. Also on that list are regulatory filing procedures not updated for the requirement on advisers with retail clients to file a Client Relationship Summary (Form CRS), and policies under which the execution of services or operations was delegated to others but which set out no means for the adviser to oversee those delegated responsibilities. Further examples are incidents of non-compliance that were found and reported within the review period but that the advisers did not deal with or record as non-compliance in their annual reviews. Advisers have been required to comply with the Marketing Rule since 4 November 2022, and the alert describes the examinations only as recent, without stating when they took place.

![Table of matters not identified in advisers' annual compliance reviews, with rows for fee and expense billing, proxy voting, custody, and marketing policies and procedures not updated for the Marketing Rule, and other examples in the alert noted.](https://www.intercepta.ai/blog/content/images/2026/10/fig3-matters-not-identified--2400x1400--v7.png)

In the alert, marketing policies and procedures that had not been updated for the adoption of the Marketing Rule are among the matters advisers did not identify in their annual reviews, alongside examples from fee and expense billing, proxy voting, custody and other areas.

### Documentation

Documentation is a separate area, and it is directly relevant to the record a firm can produce. Rule 204-2, the books and records rule, requires an adviser to “make and keep true, accurate and current” books and records that include “\[a\]ny records documenting the investment adviser’s annual review” of its compliance policies and procedures. The staff’s examples are of documentation that was made but not kept and of documentation that the firm’s own policies and procedures required but that was not prepared or was only partly completed.

The staff observed advisers “that created documentation when conducting their annual reviews, such as when performing testing and recommending corrective actions, but did not maintain the documentation in their books and records”. In other examples, a written annual review report required by the firm’s own policies and procedures was not prepared, or the firm’s policies and procedures provided that the review was to be documented in a set form, for example “using a series of checklists, workpapers, or templates”, and the advisers did not follow that form in full, in some cases completing only part of it. The Commission’s adopting release is quoted in a footnote to the alert, to the effect that records of this kind are of assistance in “identifying weaknesses in the compliance program if violations do occur or are uncorrected”.

### Corrective action

On corrective action, the staff observed advisers that had not carried out the corrective action recommended in their annual reviews for compliance policies and procedures, disclosures or business practices. In some of these cases the advisers had reported that action as complete, for example in written annual review reports, although the problems found in earlier annual reviews were still present.

## Marketing procedures and the Marketing Rule alerts

Marketing is mentioned once in the body of the alert, as one of the examples among the alignment observations and without a section of its own. Two earlier Risk Alerts on the Marketing Rule, “Initial Observations Regarding Advisers Act Marketing Rule Compliance” of April 2024 and “Additional Observations Regarding Advisers’ Compliance with the Advisers Act Marketing Rule” of December 2025, are cited in a footnote to the example, and the footnote describes them as “sharing staff observations from examinations regarding compliance with the marketing rule amendments”. They are two of the four Risk Alerts on the Marketing Rule that the Division has published since September 2022\. The other two, of September 2022 and June 2023, set out the areas on which examinations would focus.

The December 2025 alert covered the staff’s review of advertisements containing testimonials, endorsements or third-party ratings. Three of the staff’s observations are directly relevant to marketing teams. Advertisements included testimonials or endorsements that lacked one or more of the clear and prominent disclosures the Marketing Rule requires. Some advisers could not show that they had a reasonable basis for believing their testimonials and endorsements complied with the rule, which the alert calls the reasonable basis for belief requirement. Other advisers used third-party ratings without appearing to know enough about how the questionnaires used to prepare the ratings were designed or structured to have a reasonable basis for believing that the questionnaires made favourable and unfavourable responses equally easy to give and were not designed to produce a predetermined result. Rule 204-2(a)(15)(ii), cited in a footnote to the alert, also requires an adviser to make and keep the documentation that substantiates that reasonable basis. For testimonials and endorsements, and again for third-party ratings, the staff observed that many advisers had updated their compliance policies and procedures for that use and that others had not. Advertisements that appeared to the staff not to comply with the Marketing Rule had been disseminated by some of the firms that had not updated their procedures and by some that had updated them but had not implemented them. Footnote 2 of the same alert states that, according to the Commission, advisers should consider whether an interim review of their Rule 206(4)-7 policies and procedures is needed in the light of regulatory developments, and the example named in that footnote is the adoption of the Marketing Rule.

A footnote to the December 2025 alert states that “\[t\]he staff’s observations in this Risk Alert regarding policies and procedures relating to compliance with the Marketing Rule … generally fall under the Compliance Rule”, other than those required for hypothetical performance. The policies and procedures that footnote describes are among those an adviser must review no less frequently than annually under Rule 206(4)-7, and that review is the subject of the September 2026 alert.

![Diagram setting the SEC's December 2025 alert on testimonials, endorsements and third-party ratings beside the September 2026 alert on annual compliance reviews, both linked to Rule 206(4)-7, with footnotes 9 and 2 of the December 2025 alert quoted.](https://www.intercepta.ai/blog/content/images/2026/10/fig4-two-alerts--2400x1400--v9.png)

Footnote 9 of the December 2025 alert states that the staff’s observations in that alert about Marketing Rule policies and procedures are generally Compliance Rule matters, except for observations about the policies and procedures required for hypothetical performance. The annual review required under the Compliance Rule is the subject of the September 2026 alert.

## Considering the alert in the annual review

In its conclusion, the alert states that the Division “encourages advisers to reflect upon their own practices, policies, and procedures, and to implement any appropriate modifications to their annual review processes”. In a passage also quoted in the alert, the Commission’s adopting release states that “\[t\]he review should consider any compliance matters that arose during the previous year, any changes in the business activities of the adviser or its affiliates, and any changes in the Advisers Act or applicable regulations that might suggest a need to revise the policies or procedures”. The same release, cited in the alert’s introduction, provides that advisers should also consider whether an interim review is needed in response to a significant compliance event, a change in business arrangements or a regulatory development.

Neither the rule nor the alert sets out how a firm applies this to marketing. For a firm’s marketing procedures, a practical approach has three parts. The firm tests its marketing procedures in each annual review, on the scope set out in its own written procedures. The documentation of that testing, of any issues identified and of any corrective action recommended is kept, so that the firm can produce it when an examiner requests it. Any corrective action recommended in the review is then carried out, since the staff observed advisers that had not taken the corrective action their own annual reviews recommended, and reported in some cases that the action was already complete.

## Validate before you publish. Keep the record.

The staff’s observations in this alert describe issues in advisers’ compliance programmes and their records. The staff gave examples of policies and procedures that did not fully address, or were not aligned with, firms’ practices. Advisers had not identified these in their annual reviews, and among the examples were marketing policies and procedures that had not been updated for the adoption of the Marketing Rule. Under the Compliance Rule, the adviser remains responsible for its policies and procedures and for their annual review, and its chief compliance officer must administer them.

Intercepta AI supports both the marketing team and the compliance team in that work. For the marketing team, it validates content before publication against the regulatory rules it covers in each jurisdiction where the content is published. For the compliance team, it provides the record of that validation.

The scanner covers 1,100+ regulatory rules across the United States, United Kingdom, European Union, Canada, Australia and New Zealand. For each scan Intercepta AI provides a documented report in which each issue is mapped to the specific regulation concerned, with remediation guidance for your compliance team to review, and every decision on every finding remains in the remit of your compliance team. The alert describes documentation that advisers created during their annual reviews and then did not keep. A firm that keeps its scan reports has a record of the validation performed on its marketing content, and if it uses those reports in its annual review they may form part of the records documenting that review, which Rule 204-2 requires an adviser to make and keep.

[Scan your first piece of content →](https://www.intercepta.ai/?utm%5Fsource=blog&utm%5Fmedium=cta&utm%5Fcampaign=sec-annual-compliance-review-alert-20261008&utm%5Fcontent=cta-button)

## Cross-references

- For the December 2025 alert on testimonials, endorsements and third-party ratings, see [What the SEC’s Fourth Marketing Rule Alert Flagged on Testimonials, Endorsements, and Ratings](https://www.intercepta.ai/blog/sec-marketing-rule-risk-alert-testimonials-endorsements-ratings/?utm%5Fsource=blog&utm%5Fmedium=internal&utm%5Fcampaign=sec-annual-compliance-review-alert-20261008&utm%5Fcontent=cross-reference).

## Sources

### United States regulatory sources

- [SEC Division of Examinations, Risk Alert, Examinations Observations Regarding Investment Adviser Annual Compliance Review (14 September 2026), read at sec.gov on 21 September 2026 and re-read on 29 September 2026 (staff observations; not a rule, regulation or statement of the Commission; no firms named and no counts of how often issues were observed; title as listed on the SEC risk alerts index, the PDF heading reading “Reviews”).](https://www.sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf?ref=intercepta.ai)
- [17 CFR 275.206(4)-7 (the Compliance Rule), paragraphs (a), (b) and (c) (adopt and implement written policies and procedures reasonably designed to prevent violation; review no less frequently than annually; designate a chief compliance officer), read at the eCFR on 21 September 2026.](https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.206%284%29-7?ref=intercepta.ai)
- [17 CFR 275.204-2(a)(17)(ii) (books and records; “\[a\]ny records documenting the investment adviser’s annual review of those policies and procedures conducted pursuant to § 275.206(4)-7(b)”), read at the eCFR on 21 September 2026.](https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2?ref=intercepta.ai#p-275.204-2%28a%29%2817%29%28ii%29)
- [17 CFR 275.204-2(a)(15)(ii) (books and records; “\[d\]ocumentation substantiating the adviser’s reasonable basis for believing that a testimonial or endorsement … complies with § 275.206(4)-1 and that the third-party rating … complies with § 275.206(4)-1(c)(1)”), read at the eCFR on 1 October 2026.](https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2?ref=intercepta.ai#p-275.204-2%28a%29%2815%29%28ii%29)
- SEC Division of Examinations, [Initial Observations Regarding Advisers Act Marketing Rule Compliance (17 April 2024)](https://www.sec.gov/files/exams-risk-alert-marketing-observation-2024.pdf?ref=intercepta.ai) and [Additional Observations Regarding Advisers’ Compliance with the Advisers Act Marketing Rule (16 December 2025)](https://www.sec.gov/files/exams-riskalert-mrkt-rule-2512-508.pdf?ref=intercepta.ai), cited in footnote 14 of the 14 September 2026 Risk Alert; titles and dates as verified at the SEC risk alerts index on 29 September 2026, and the December 2025 alert read in full on 29 September and 1 October 2026.
- SEC Division of Examinations, [Examinations Focused on the New Investment Adviser Marketing Rule (19 September 2022)](https://www.sec.gov/files/exams-risk-alert-marketing-rule.pdf?ref=intercepta.ai) and [Examinations Focused on Additional Areas of the Adviser Marketing Rule (8 June 2023)](https://www.sec.gov/files/risk-alert-marketing-rule-announcement-phase-3-060823.pdf?ref=intercepta.ai), titles and dates as verified at the SEC risk alerts index on 1 October 2026.
- [Investment Adviser Marketing, Advisers Act Release No. 5653 (22 December 2020), compliance date 4 November 2022, as recorded in footnote 14 of the 14 September 2026 Risk Alert.](https://www.sec.gov/files/rules/final/2020/ia-5653.pdf?ref=intercepta.ai)
- [Compliance Programs of Investment Companies and Investment Advisers, Advisers Act Release No. 2204 (17 December 2003), 68 FR 74714 (24 December 2003) (the Compliance Rule adopting release), as cited in the 14 September 2026 Risk Alert’s footnotes at 68 FR 74720 (what the annual review should consider, and interim reviews) and 68 FR 74723 (the first-review period and the value of review records).](https://www.sec.gov/files/rules/final/ia-2204.pdf?ref=intercepta.ai)