Where RIA Compliance Programs Break Under Examination

Key takeaways

• Examiners test the evidence your program produces, not the thickness of your policy binder.
• Most programs fail on documentation and governance, not on knowing the rules.
• Conflicts need specificity. A benefit you “may” receive but receive regularly is exposure.
• AI tools carry portfolio-system governance weight, not data-vendor governance weight.

Explore our RIA compliance tools and connect with our team.

SEC examiners don’t grade your policy binder by the pound. They test what you can prove. For registered investment advisers, a compliance program lives or dies on the evidence it produces, not the policies it describes.

The pillars below are the ones examiners return to. The focus here is investment advisers, but most of it applies to FCMs, hedge funds, and other regulated entities. The question is whether your program can show its work when the questions get specific.

Fiduciary governance: the tell is timing

The Compliance Rule (Advisers Act Rule 206(4)-7) is settled ground: written policies reasonably designed to prevent violations, reviewed at least annually, with a named chief compliance officer running the program. Examiners don’t reward you for clearing that bar. They look at whether your CCO was in the room before a decision or after it.

Borrowed templates are the first thing that gives a program away. Your manual should reflect:

• Your actual client base and fee arrangements
• Your trading model and conflicts profile
• Your technology stack and third-party service providers
• Your current disclosure obligations

Policies also have to be operational. Your staff should know who owns each control, when reviews are scheduled, how exceptions get escalated, and what evidence is retained. That’s the difference between a document set and a program that runs.

Your CCO needs real authority, which means a seat at the table when the firm adopts new technology, revises fee structures, or moves into new product areas. Compliance that learns about new activities after launch isn’t compliance. It’s cleanup.

The annual review is your exposure map, not a calendar entry

Treated as a date on the calendar, the annual review produces a file nobody reads. Run well, it’s the clearest picture you have of where your program holds and where it doesn’t.

A useful review accounts for

1. What changed during the year across business practices, personnel, and products
2. Which controls were tested and how they performed
3. What exceptions surfaced and how they were resolved
4. Whether disclosures kept pace with the business
5. Whether your written policies still describe how the firm actually operates

Document the scope, methodology, findings, remediation steps, owners, and timelines. That record tells a story about your program. Make sure it’s the one you want told.

Conflicts of interest: specificity is the standard

This is where fiduciary duty gets tested in practice. Map where financial incentives, compensation arrangements, affiliations, or operational structure could influence advice, trade allocations, or vendor selection. For each conflict, determine whether it can be:

• Avoided entirely through structural changes
• Mitigated through supervision or controls
• Supervised with documented ongoing oversight
• Disclosed to clients with sufficient specificity

Then document how each determination was made, and by whom.

Disclosure quality matters as much as identification. Form ADV, client agreements, and marketing materials need to tell the same story. Marketing carries its own bar under the Marketing Rule (Advisers Act Rule 206(4)-1), in effect since its November 2022 compliance date: advertising fair and balanced, testimonials and endorsements clearly disclosed, performance substantiated and shown net of fees. Saying your firm “may” receive a benefit it receives regularly creates exposure. So does failing to explain how a conflict shapes your approach to best execution or share-class selection.

Best execution: the gap is documentation, not knowledge

Every adviser knows the best execution standard. That’s not where firms get caught. The gap is the ability to show, over time and across accounts, how execution decisions were made and supervised. “We use a quality broker” is not a framework.

Best execution isn’t a single numbered rule. It’s part of the fiduciary duty the SEC enforces under the Advisers Act, and examiners routinely test how you document it. Build a repeatable review process that covers: 

• Routing decisions and how they're made
• Broker evaluation against measurable criteria
• Conflict assessment where broker relationships create incentives
• Client-outcome analysis across accounts and time periods

Broker selection is a larger piece of this than most frameworks acknowledge. When an examiner asks how a specific transaction was handled, the answer depends on whether your records are complete and traceable or fragmented across a clearing correspondent.

Records and controls: where programs quietly drift

Books and records are where a program proves itself or comes apart. The Books and Records Rule (Advisers Act Rule 204-2) sets the baseline regardless of medium. You need documented retention across advisory agreements and trade records, client communications and code of ethics reporting, marketing approvals and pitch materials, and annual review documentation and testing results.

Form ADV, client brochures, and internal procedures should describe the same business. When they don’t, a routine exam becomes a much longer conversation.

Look hard at operational controls: cash movement, billing, standing letters of authorization, trade allocation, and vendor-supported processes. Weak controls there hit disclosure accuracy and best-execution oversight at once. Skip periodic testing and you discover that your controls drifted from your policies years earlier. That drift is what turns a finding into a remediation project.

AI governance: weigh it like a portfolio system, not a data vendor

RIAs are deploying AI faster than their frameworks are catching up. Portfolio rebalancing, client-communication drafts generated from CRM data, trade-signal generation, and risk flagging are already running inside advisory firms, and each one creates governance obligations most policies don’t yet address.

The mistake is assessing these tools the way you’d assess a new data vendor. The governance weight is closer to a portfolio management system. Before any AI tool goes live, your program needs to address:

• How the tool was reviewed and approved internally
• How outputs are validated before they affect client-facing decisions
• How access to sensitive client data is restricted
• Whether your disclosures about automation stay accurate as the tool evolves

The SEC has made this an active examination area. Its FY2026 priorities single out “AI washing,” overstated or inaccurate claims about how a firm uses AI, which puts your marketing and Form ADV automation language under the same Marketing Rule scrutiny as any performance claim. Build a dedicated review process, document it, and revisit it when the tool changes. They always change.

Quick-reference checklist

Use this as a readiness check before an exam cycle or a starting point for your next annual review.

If any row makes you hesitate, that’s where to focus first.

What’s coming

Examination priorities don’t stand still. AI governance, off-channel communications, and digital asset custody have all shifted in recent years, and the pace isn’t slowing. The Division of Examinations released its FY2026 priorities in November 2025, keeping fiduciary standards and compliance program effectiveness front and center while elevating AI and emerging technology. The firms that handle exams well aren’t the ones retrofitting their programs after a new priority lands. They’re the ones that built frameworks flexible enough to absorb change without starting over.

The goal isn’t the longest policy set. It’s a framework that reflects how your business actually runs and holds up when the questions get specific.

How TradeStation Institutional fits the evidence problem

The pillars above are governance work, and they’re yours to own. Where infrastructure helps is in making the evidence easier to produce.

TradeStation Securities is a self-clearing broker-dealer registered with the SEC and a futures commission merchant registered with the CFTC. Trade data, execution records, and account activity run through one vertically integrated system rather than across a clearing correspondent. When you’re asked to produce records on how a specific transaction was handled, you have a complete, traceable record to pull.

On execution quality, TradeStation’s Q1 2026 figures show an average equity market-order speed of 63 milliseconds and average price improvement of $3.04 per covered equity market order, as measured by S3 Matching Technologies LP, an independent firm not affiliated with TradeStation. Those numbers don’t replace your governance process. They give your due diligence file a quantifiable data point you can produce on request, without a manual pull.

TradeStation Institutional also provides multi-account reporting with permission-based access, enhanced reporting built for best-execution documentation, and FIX, REST, and WebSocket API connectivity so third-party compliance systems can pull execution data directly.

AI access is its own compliance decision. When a tool needs market data, account information, or order execution, the way it connects is part of your control surface. TradeStation’s MCP (Model Context Protocol) server gives AI assistants and agentic tools a standardized, authenticated path to TradeStation data and trading functions through one interface scoped to your account’s permissions, instead of custom integrations and separate credentials for every tool. That’s a single controlled path you can govern and document.

TradeStation Institutional works with RIAs that need more than a standard broker relationship. From self-clearing infrastructure and enhanced execution reporting to multi-account management and dedicated concierge support, the platform is built around how compliant, sophisticated advisers operate.

Explore TradeStation Institutional’s RIA capabilities and connect with our team.