The end of the year is a natural checkpoint for investment advisers to take stock of what has changed, what still needs attention, and what should be carried into 2027. Regulatory expectations continue to evolve, while firms themselves may be changing through new technology, expanded services, acquisitions, staffing changes, new compensation arrangements, or shifts in their client base and investment strategies.
Rather than treating year-end compliance as a list of routine administrative tasks, advisers should use this time to make sure their compliance program reflects the business they are actually operating today. This includes revisiting areas that can create heightened regulatory or fiduciary risk, confirming that required disclosures and filings remain accurate, and making sure policies, procedures, records, and practices are aligned.
To help investment advisers take a holistic look at their compliance programs, identify any remaining year-end tasks, and prepare for 2027, we’ve put together a high-level checklist. Throughout this guide, you’ll find reminders and areas to double-check before year-end to help ensure your firm’s compliance program, policies, disclosures, and operations remain current, appropriately designed to prevent violations, and exam-ready.[1]
Key Areas to Address Before Year-End
As you work through your year-end checklist, consider whether your compliance program has kept pace with the firm throughout 2026. As part of the overall review, make sure to:
- Update for Changes: Identify changes to the firm’s business, personnel, clients, services, technology, vendors, and operations that may require updates to policies, procedures, agreements, disclosures, or filings.
- Look Beyond the Written Program: Policies are only effective when they reflect actual practices. Confirm that employees and executives understand their responsibilities and that the firm is following the processes it has established.
- Prioritize Higher-Risk Areas: Give additional attention to areas higher-risk areas, including those involving conflicts of interest, compensation, custody, fee billing, trading, marketing, cybersecurity, artificial intelligence, and other activities that can directly impact clients.
- Create a Clear Path Into 2027: Document outstanding compliance items, upcoming regulatory deadlines, planned business changes, and other priorities so the new year can begin with a clear compliance roadmap.
1. Governance, Policies & Risk Management
- Review Policies and Procedures – Confirm that the firm’s policies and procedures continue to reflect its current business activities, regulatory obligations, and risk profile. Pay particular attention to changes made during 2026, including new products or services, affiliates, acquisitions, technology, personnel, or operational responsibilities.
- Update the Risk Assessment – Confirm that the firm’s risk assessment addresses current and emerging risks, including cybersecurity, artificial intelligence, third-party vendors, new investment products, and operational changes.
- Confirm Compliance Oversight – Ensure that compliance responsibilities, escalation procedures, reporting lines, and available compliance resources remain appropriate for the firm’s size and complexity. Compliance Step: Consider whether the firm’s compliance program reflects how the business actually operates today, not simply how it operated when the policies were last updated.
2. Fiduciary Duty, Conflicts & Compensation Arrangements
- Review Compensation and Affiliate Arrangements – Review direct and indirect compensation arrangements, including revenue sharing, insurance commissions, payments from custodians or broker-dealers, and affiliate relationships to ensure appropriate controls and detailed disclosures are in place.
- Review Material Conflicts – Identify new or changed conflicts arising from products, services, relationships, or compensation arrangements and confirm they are appropriately managed and disclosed.
- Review Dually Registered Personnel – Where applicable, review compensation arrangements and account recommendations involving dually registered firms for potential conflicts between advisory and brokerage services. Compliance Step: Confirm that disclosures describe the conflicts that actually exist and that appropriate controls are being used to manage them.
3. Portfolio Management & Investment Recommendations
- Review Investment Strategy and Recommendations – Confirm that portfolios are being managed consistently with client objectives, investment strategies, mandates, restrictions, and the firm’s stated investment process.
- Review Allocation and Conflicts – Evaluate side-by-side management, allocation of limited opportunities, alternative or complex investments, and other situations where clients could receive different treatment.
- Review Higher-Risk Recommendations – Confirm that retirement rollover recommendations, proxy voting, and other areas presenting heightened fiduciary risk are appropriately analyzed, documented, and overseen. Compliance Step: Compare actual portfolio management practices with the firm’s Form ADV and written policies. Changes in strategies or products should be reflected consistently across all three.
4. Trading, Best Execution & Personal Trading
- Review Best Execution and Broker Selection – Confirm that broker and custodian selection and best execution reviews remain substantive, timely, and appropriately documented.
- Test Trade Allocation and Conflicted Transactions – Review trade aggregation and allocation, cross trades, affiliated transactions, directed brokerage, and soft-dollar or commission-sharing arrangements, as applicable to ensure adherence to regulatory requirements and firm policies and procedures.
- Review Personal and Insider Trading Controls – Confirm that employee trading, holdings reports, certifications, restricted/watch lists, and other required controls have been completed and remain effective. Compliance Step: Best execution should be evaluated based on current circumstances and relevant factors, not simply because a broker has historically been used by the firm.
5. Custody & Client Asset Controls
- Reassess Custody – Review the firm’s current activities and identify arrangements that may create custody, including SLOAs, trustees or executors, private fund managing member relationships, concierge services, and access to client accounts.
- Review Client Asset Controls – Confirm appropriate controls are in place for receiving or forwarding client checks, securities, or other assets and for monitoring arrangements that could result in custody.
- Confirm Required Custody Procedures – Where applicable, confirm that surprise examinations, related filings, and other custody requirements have been completed. Compliance Step: Do not limit the custody review to traditional account access. Operational services involving client assets can also create custody considerations.
6. Valuation & Fee Billing
- Test Fee Calculations and Valuation – Sample client accounts and confirm that fees and valuations are calculated accurately and in accordance with established methodologies.
- Reconcile Billing to Agreements and Disclosures – Confirm that fees charged are consistent with advisory agreements, Form ADV, and actual billing practices, including householding, performance fees, and treatment of terminated accounts.
- Review Fee Reasonableness – Consider whether advisory fees remain reasonable in light of the services provided, investment strategies, and other relevant factors. Compliance Step: Review industry reports and surveys on advisory fee arrangements for benchmark comparisons.
7. Marketing & Advertising
- Review Performance and Other Advertising Claims – Confirm that performance information, hypothetical performance, rankings, awards, and other claims are appropriately calculated, substantiated, presented, and retained.
- Review Testimonials, Endorsements & Social Media – Confirm that testimonials, endorsements, social media activity, and other communications comply with the Marketing Rule[2] and the firm’s policies and procedures.
- Confirm Marketing Oversight – Review materials actually distributed during 2026 and confirm that required approvals and supporting documentation were maintained. Compliance Step: Reviewing what was actually published or distributed can reveal gaps that a review of the written marketing policy alone may not identify.
8. Privacy, Cybersecurity & Regulation S-P
- Review Regulation S-P Compliance – Confirm that the firm’s policies, procedures, privacy notices, incident response procedures, and safeguards have been updated for the amended Regulation S-P[3] requirements applicable to the firm.
- Test Cybersecurity and Incident Response – Complete appropriate cybersecurity testing and conduct a tabletop or functional incident-response exercise, documenting identified deficiencies and remediation.
- Review Third-Party and Data Risks – Evaluate vendors with access to sensitive information or critical systems and confirm that data retention, disposal, and safeguarding practices remain appropriate. Compliance Step: Document not only that cybersecurity testing occurred, but what it identified, who was responsible for remediation, and what remediation was completed.
9. Artificial Intelligence & Emerging Technology
- Identify AI Use – Determine what AI tools the firm and its employees are using, what functions they support, and what information is being provided to those tools.
- Review AI Controls – Confirm that policies and procedures address approved and prohibited uses, privacy and confidentiality, vendor risks, human oversight, accuracy, bias, intellectual property, and other applicable concerns.
- Review Disclosures and Contracts – Determine whether AI use has implications for disclosures in Form ADV, client agreements, privacy policies, or other compliance documents. Compliance Step: The key question is not simply whether the firm uses AI, but whether it understands what the technology is doing, what information it receives, what it produces, and who is responsible for reviewing the output.
10. Books, Records & Communications
- Review Recordkeeping – Confirm that required books and records are maintained, retained, indexed, and readily retrievable.
- Review Electronic Communications – Confirm that employees are using approved communication channels and that business communications, including applicable text, collaboration, social media, and other electronic communications, are appropriately captured and archived.
- Test Record Retrieval – Consider whether the firm could quickly produce records an SEC examiner might request, including trading, marketing, fee billing, approvals, and compliance testing documentation. Compliance Step: If a requested record would be difficult to locate, determine why and address the gap before it becomes an examination issue.
11. Vendor Due Diligence & Outsourcing
- Review Critical Vendors – Complete appropriate due diligence on material service providers, with particular attention to cybersecurity, data access, business continuity, and financial or operational risks.
- Review Vendor Performance and Contracts – Identify any significant vendor issues during 2026 and confirm that contracts appropriately address confidentiality, data protection, cybersecurity, and breach notification.
- Reassess New or Higher-Risk Technology – Give additional attention to AI, compliance, portfolio management, and data-processing vendors. Compliance Step: Consider whether a vendor’s role, access to information, or importance to the firm’s operations has changed the firm’s risk profile.
12. Business Continuity & Succession Planning
- Test the BCP – Perform and document appropriate business continuity testing and incorporate lessons learned from any disruptions experienced during 2026.
- Review Key-Person Dependencies – Identify individuals and vendors whose absence could materially affect the firm’s ability to operate or serve clients.
- Review Succession Plans – Confirm that plans address unexpected departure, incapacity, or death of key personnel and, where applicable, ownership succession. Compliance Step: A succession plan should address more than ownership. Consider how the firm would continue serving clients, managing portfolios, communicating, and meeting regulatory obligations if a key person suddenly became unavailable.
13. Training, CE & Compliance Culture
- Complete Required Training and Certifications – Confirm that annual compliance training, employee certifications, and applicable IAR continuing education requirements have been completed and documented.
- Provide Targeted Training – Address areas of heightened risk relevant to the firm’s business, such as cybersecurity, Regulation S-P, custody, conflicts, trading, marketing, communications, and AI.
- Reinforce Tone from the Top – Senior management should reinforce employees’ responsibility to understand policies, identify potential issues, and escalate concerns. Compliance Step: Training should explain not only what the policy says, but how it applies to employees’ day-to-day responsibilities.
14. Disclosures, Registrations & Regulatory Filings
- Review Regulatory Disclosures – Confirm that Form ADV Parts 1 and 2, Form CRS, Form ADV Part 2Bs, and other applicable disclosures accurately reflect the firm’s current business.
- Review Registrations and Filings – Confirm that firm and IAR registrations remain appropriate and that required federal and state filings, including Form PF, Form 13F, Form N-PX, Form D, and other applicable filings, have been completed.
- Review Client Agreements – Confirm that agreements remain consistent with current services, fee arrangements, and disclosures. Compliance Step: Compare the firm’s operations, Form ADV, client agreements, and marketing materials. A change to one should prompt consideration of whether the others also need to be updated.
15. Business Changes, Acquisitions & Expansion
- Review Changes to the Business – Identify new services, products, markets, affiliates, acquisitions, or other material changes made during 2026.
- Confirm Integration – For acquisitions or business integrations, confirm that policies, procedures, disclosures, agreements, technology, and operations have been appropriately incorporated.
- Update Compliance Materials – Confirm that material business changes have been reflected in Form ADV, client documents, policies, and other applicable disclosures. Compliance Step: When the business changes, ask three questions: Do our policies need to change? Do our disclosures need to change? Did our operations protocols change?
16. Regulatory Examination Preparation
- Review Current Regulatory Priorities – Consider the SEC’s current examination priorities[4] and Risk Alerts and identify areas particularly relevant to the firm’s business.
- Organize Examination Materials – Confirm that policies, testing, training, risk assessments, vendor due diligence, approvals, and other compliance documentation are centralized and readily retrievable.
- Prepare Key Personnel – Ensure that key personnel understand the firm’s business, compliance responsibilities, and material risk areas. Compliance Step: Consider a mock examination or interview exercise to identify gaps in documentation or employee understanding before an actual examination.
17. Close Out 2026 & Prepare for 2027
- Close Outstanding Compliance Items – Review the 2026 compliance calendar and document any unresolved items, responsible parties, and anticipated completion dates.
- Build the 2027 Compliance Calendar – Add upcoming regulatory deadlines, testing, training, renewals, filings, and recurring compliance obligations.
- Plan for Changes Ahead – Review regulatory developments, planned business changes, technology needs, and compliance resources for 2027. Compliance Step: Start the new year with a prioritized list of compliance initiatives rather than carrying unresolved issues forward without a clear owner or deadline.
Conclusion
By working through this checklist, investment advisers can close out 2026 with greater confidence that their compliance programs, operations, disclosures, and regulatory obligations are current and ready for the year ahead.
As advisers look toward 2027, taking the time now to identify gaps, address outstanding items, and plan for upcoming regulatory and business changes can help establish a stronger foundation for the new year.
Core Compliance can help with year-end compliance activities and ensure that you have peace of mind in your compliance program as you move into the new year. Contact us at (619) 278-0020 to learn more.
Author: Anna Schnitkey, Operations Manager; Editor: Tina Mitchell, Managing Director of Consultation Services, Core Compliance & Legal Services (“Core Compliance”). Core Compliance works extensively with investment advisers, broker-dealers, investment companies, and private fund managers on regulatory compliance issues.
This article is for information purposes and does not contain or convey legal or tax advice. The information herein should not be relied upon regarding any particular facts or circumstances without first consulting with a lawyer and/or tax professional.
[1] Please note this checklist is not all-inclusive; additional steps may be required depending on the firm’s business practices, investment strategies, clients, affiliates, and regulatory obligations. This is provided as guidance only.
[2] See Final Rule: Investment Adviser Marketing
[3] See Final Rule: Regulation S P: Privacy of Consumer Financial Information and Safeguarding Customer Information
