Investment advisers that rely on annual compliance reviews risk overlooking gaps between written policies and day-to-day practices, according to a recent Risk Alert from the US Securities and Exchange Commission (SEC). RegTech provider Red Oak argues that continuous monitoring can help firms identify and address these discrepancies before they become regulatory problems.

Under the SEC’s Compliance Rule, Rule 206(4)-7, investment advisers must review their compliance programmes at least annually. The assessment must establish whether their policies and procedures remain adequate for their current business activities and whether employees are following them in practice. As firms adapt to new technologies, business models and regulatory requirements, policies can quickly become outdated, leaving gaps that may only emerge during an examination.

The SEC’s Division of Examinations uses Risk Alerts to highlight recurring weaknesses identified by its examiners. The latest alert identified six areas of concern: policies that do not reflect actual practices, late or missing annual reviews, incomplete review procedures, reviews that do not follow a firm’s documented processes, inadequate record-keeping, and corrective actions that are identified but not implemented.

The disconnect between written policies and actual practices is particularly significant because it can contribute to failures across the other areas. When employees do not follow established procedures, compliance issues can go undetected, accountability can weaken and remediation efforts can fall short. The SEC also highlighted outdated marketing procedures that continued to reflect requirements superseded by the SEC Marketing Rule in 2022, demonstrating that policy drift can extend beyond supervision.

The findings highlight the challenge of maintaining effective compliance programmes as business operations and regulatory expectations evolve.

Source link