Broker-Dealer & Adviser Due Diligence: Products, Clients, Conflicts

Broker-dealer and investment adviser due diligence runs on two separate legal standards that reach many of the same activities. A broker-dealer recommending a security to a retail customer must satisfy the four obligations of Regulation Best Interest. An investment adviser owes a fiduciary duty of care and loyalty under the Investment Advisers Act of 1940 that runs continuously through the relationship. Both frameworks require firms to vet the products they recommend, build a documented picture of each client, manage conflicts, deliver specific disclosures, monitor accounts over time, protect client data, and keep records that reconstruct every decision.

The Two Standards and What Each Firm Owes

Regulation Best Interest, codified at 17 CFR § 240.15l-1, requires a broker-dealer making a recommendation to a retail customer to act in that customer’s best interest at the time of the recommendation without placing the firm’s financial interests ahead of the customer’s.¹ The rule has four components: a Disclosure Obligation, a Care Obligation, a Conflict of Interest Obligation, and a Compliance Obligation. Failing any one is a violation, and a retail customer cannot waive Reg BI’s protections.²

The Care Obligation is where product and client due diligence live for broker-dealers. It requires reasonable diligence, care, and skill to understand the potential risks, rewards, and costs of a recommendation, and to have a reasonable basis to believe the recommendation could be in the best interest of at least some retail customers.¹

Investment advisers work under a different standard. The SEC has interpreted the anti-fraud provisions of the Advisers Act as establishing a duty of care and a duty of loyalty. The duty of care includes providing advice and monitoring consistent with the agreed-upon scope of the relationship. The duty of loyalty requires the adviser to eliminate conflicts of interest or make full and fair disclosure so the client can give informed consent.³ A broker-dealer’s obligation attaches at each recommendation. An adviser’s fiduciary duty runs continuously.

FINRA Rule 2111, the older suitability rule, still applies in some settings, but it does not apply to any recommendation covered by Reg BI.⁴ For retail recommendations, Reg BI controls. Rule 2111 remains in play for institutional accounts and certain non-retail contexts.

Product Due Diligence: Building a Reasonable Basis

Before recommending any security, a firm must develop a reasonable basis to believe the product could benefit at least some investors. That means working through the prospectus, the issuer’s financial statements, and SEC filings such as the Form 10-K, which contains audited financials, management discussion, and market risk disclosures. The review looks at debt levels, revenue trends, and whether the business model is sustainable.

Fees are a core part of the analysis. Mutual funds and ETFs carry annual operating expenses, management fees, and sometimes sales loads or 12b-1 distribution fees, and those costs directly reduce investor returns over time.⁵ A firm that recommends a more expensive fund when a cheaper equivalent is available needs a documented reason.

The investigation also covers the management team’s track record, legal disputes involving the sponsors, and how transparently the product generates returns. A product that fails the reasonable-basis standard cannot be recommended to anyone. Most due diligence failures start here: firms rubber-stamp a new offering based on past experience with the same issuer rather than evaluating the current deal on its own.

h3>Private Placements

Regulation D private placements draw heightened scrutiny because they lack the disclosure protections of public securities. FINRA expects firms to evaluate the issuer and its management, the business prospects, the assets held or to be acquired, and the intended use of proceeds.⁶ Sound practice includes independent verification of projected costs, timing, and returns through third-party experts rather than reliance on the offering memorandum alone; investigation of red flags like unlikely return projections or liquidity restrictions with documented resolution; a post-closing review to confirm proceeds were used consistently with the memorandum; and identification of any financial ties between the firm’s affiliates or control persons and the issuer.

A recurring examination finding is firms leaning on their history with the same issuer instead of independently evaluating the current offering. Each offering needs fresh analysis.⁶

Complex and High-Risk Products

Inverse ETFs, leveraged exchange-traded products, and structured notes require additional layers of review. FINRA’s 2026 Annual Regulatory Oversight Report expects firms to establish product review processes that categorize risk and complexity, apply heightened supervision to recommendations, and limit who can recommend these products to specific customer types.⁷ Firms must also make sure recommendations do not create concentrations beyond internal policy limits or a disproportionate share of a customer’s liquid net worth.

The SEC has said that leveraged and inverse exchange-traded products, if appropriate for a retail client at all, would require daily monitoring by the adviser.³ That ongoing burden makes these products far more expensive to supervise than conventional investments.

Client Due Diligence: Know Your Customer

FINRA Rule 2090 requires every member firm to use reasonable diligence, when opening and maintaining each account, to know and retain the essential facts about every customer and about the authority of anyone acting for the customer.⁸ Essential facts are whatever the firm needs to service the account, follow special handling instructions, understand who has authority, and comply with applicable law.

A client investment profile pulls together the client’s financial situation (annual income, net worth, liquid assets), tax status, investment objectives (growth, income, capital preservation, speculation), time horizon, liquidity needs, risk tolerance, and investment experience. These are the profile factors under FINRA Rule 2111 and they carry forward into Reg BI’s Care Obligation.⁴ Without them, a firm has no basis for judging whether any recommendation fits. Firms gather this information through account opening forms, questionnaires, and conversations, then verify it through identity checks and third-party data.

Identity Verification Under the CIP

Federal law requires financial institutions to run a Customer Identification Program as part of anti-money laundering compliance under the USA PATRIOT Act. At account opening, the firm must collect the customer’s name, date of birth, address, and a government identification number, such as a Social Security number for U.S. persons or a passport number for non-U.S. persons. The program must let the firm form a reasonable belief that it knows the true identity of each customer, and firms cross-reference the information against government IDs and third-party databases.

Trusted Contacts and Senior Investor Holds

FINRA Rule 4512 requires firms to make reasonable efforts to obtain the name and contact information of a trusted contact person for every non-institutional account. The trusted contact is someone the firm can reach if it suspects financial exploitation, needs to confirm the customer’s health status, or needs to verify the identity of someone claiming legal authority over the account. Not having a trusted contact on file does not stop the firm from opening the account, but the effort to obtain one must be documented.⁹

Under FINRA Rule 2165, a firm may place a temporary hold on a transaction or disbursement from a senior investor’s account when it reasonably believes financial exploitation has occurred or is being attempted. The firm must notify all authorized parties and the trusted contact within two business days, unless one of them is the suspected source of the exploitation. The initial hold runs up to 15 business days, with extensions available for up to 55 business days total if internal review supports the concern and the matter has been reported to a state regulator or court.⁹

Managing Conflicts of Interest

Reg BI’s Conflict of Interest Obligation requires broker-dealers to establish, maintain, and enforce written policies designed to identify and address conflicts associated with recommendations. At a minimum, firms must disclose or eliminate all conflicts. For conflicts tied to individual-level financial incentives, disclosure alone is not enough; the firm must actively mitigate them by changing practices to reduce the incentive’s pull.¹⁰

One category must be eliminated outright: sales contests, sales quotas, bonuses, and non-cash compensation tied to selling specific securities within a limited time period. These incentives cannot be cured by disclosure or mitigation.¹⁰

Investment advisers face a parallel requirement under the duty of loyalty. The adviser must either eliminate the conflict or make disclosure specific enough that the client can give informed consent. Saying the adviser “may” have a conflict when one actually exists is not sufficient. The disclosure has to identify the types of transactions, clients, or advice affected and explain how the adviser addresses the conflict.¹¹

Conflict management is not a one-time setup. Firms have to monitor for new conflicts as compensation structures, product menus, and business relationships change, and test periodically whether existing policies still work.

Disclosures You Have to Deliver

Form CRS

Both broker-dealers and investment advisers must file and deliver Form CRS, a standardized relationship summary limited to two pages, or four for dual registrants. The document must be in plain English and follow a prescribed structure covering services, fees, conflicts, disciplinary history, and additional resources.¹²

Investment advisers must deliver Form CRS before or at the time of entering into an advisory contract with a new retail investor. Existing clients must receive it before the adviser opens a new type of account, recommends a rollover from a retirement account, or recommends a new advisory service not already held in an existing account. Amendments must be communicated to existing clients within 60 days of the required change, and a current copy must be provided within 30 days of any client request.¹³

Form ADV Part 2A

Investment advisers must deliver a brochure covering 15 required items, including services, fee schedule, methods of analysis, disciplinary history, code of ethics, brokerage practices, and custody arrangements. The brochure has to be provided before or at the time of entering into an advisory agreement, and an updated version or a summary of material changes must go out annually within 120 days after the adviser’s fiscal year end.¹⁴

If the brochure is amended to add new disciplinary information, that amendment must be delivered to clients. Other interim amendments must be filed promptly when information becomes materially inaccurate but generally do not require immediate client delivery.¹⁴

Form BD

Broker-dealers register with the SEC on Form BD, which requires extensive disclosure of the firm’s disciplinary and legal history. Item 11 covers criminal convictions, regulatory actions, civil court injunctions, and financial events such as bankruptcy proceedings under the Securities Investor Protection Act. Disclosure extends to any “control affiliate,” meaning anyone who directly or indirectly controls or is controlled by the applicant.¹⁵ This disciplinary history feeds publicly searchable tools like FINRA BrokerCheck.

Recordkeeping

The SEC’s books and records rules dictate how firms document and store their due diligence work. Under 17 CFR § 240.17a-3, broker-dealers must create and maintain specific records for each account, including customer account information, transaction records, and order memoranda.¹⁶

The companion rule, 17 CFR § 240.17a-4, sets retention periods. Blotters, ledgers, and certain core records must be preserved for at least six years, with the first two years easily accessible. Other records, including order tickets and communications, must be kept for at least three years, again with two years of easy access. Account cards and records related to opening and maintaining a customer account must be preserved for six years after the account closes.¹⁷

Supervisory personnel review and sign off on documentation as an added compliance layer. Electronic storage is permitted, but the systems must meet specific requirements for preventing alteration and ensuring reproduction. The point is to reconstruct the rationale behind every recommendation years later. Firms that cannot produce records during an examination are in trouble before the substance of any recommendation is examined.

Monitoring After Onboarding

For advisers in an ongoing advisory relationship, the SEC has said the duty of care includes monitoring the client’s account over the course of the relationship. When an adviser charges a periodic asset-based fee, that monitoring obligation is “relatively extensive.” An adviser providing a one-time financial plan for a flat fee, by contrast, is unlikely to have a continuing duty to monitor unless the engagement letter says otherwise.³

Monitoring covers all personalized advice provided to the client. In an ongoing relationship, that includes evaluating whether the client’s account type, such as a wrap fee program, still serves their best interest. Adviser and client can agree on the frequency of reviews, quarterly or monthly for example, as long as the adviser fully discloses the terms, including whether interim monitoring will happen when market events affect the portfolio.³

Protecting Client Data

The volume of sensitive information collected during due diligence carries a cybersecurity obligation. Under the amended Regulation S-P, broker-dealers, registered investment advisers, and other covered institutions must develop and maintain written incident response programs designed to detect, respond to, and recover from unauthorized access to customer information.¹⁸

When a breach occurs, the firm must assess its scope, contain it, and notify affected individuals whose sensitive information was accessed. Notification must happen within 30 days of the firm becoming aware of the breach, unless the Attorney General determines that notification would pose a risk to national security. Service providers handling customer data must notify the covered institution within 72 hours of discovering a breach. Firms must also keep written records documenting their safeguards, any detected unauthorized access, their response steps, and copies of notices sent to affected customers.¹⁸

What Failures Cost

Regulators treat due diligence failures as the root cause of most investor harm. FINRA’s enforcement tools include fines, suspensions of individuals, and, for serious misconduct, permanent bars from the securities industry.¹⁹ The SEC can bring its own enforcement actions, issue cease-and-desist orders, and seek civil monetary penalties. A Wells Notice, which informs a firm or individual of charges the SEC intends to bring, often precedes formal proceedings and gives the recipient a chance to respond before the case is filed.

Penalties scale with the severity of the failure and the harm caused. A firm that skipped reasonable-basis analysis on a private placement that later collapsed faces a very different outcome than one with a minor recordkeeping gap. Beyond regulatory sanctions, firms are exposed to private litigation from harmed investors.

1
eCFR. 17 CFR 240.15l-1 – Regulation Best Interest
2
U.S. Securities and Exchange Commission. Frequently Asked Questions on Regulation Best Interest
3
U.S. Securities and Exchange Commission. Commission Interpretation Regarding Standard of Conduct for Investment Advisers (Release No. IA-5248)
4
FINRA. FINRA Rule 2111 – Suitability
5
U.S. Securities and Exchange Commission. How Fees and Expenses Affect Your Investment Portfolio
6
FINRA. 2022 Report on FINRA Examination and Risk Monitoring Program – Private Placements
7
FINRA. 2026 Annual Regulatory Oversight Report
8
FINRA. FINRA Rule 2090 – Know Your Customer
9
FINRA. Frequently Asked Questions Regarding FINRA Rules Relating to Financial Exploitation of Senior Investors
10
U.S. Securities and Exchange Commission. Staff Bulletin: Standards of Conduct for Broker-Dealers and Investment Advisers Conflicts of Interest
11
U.S. Securities and Exchange Commission. Frequently Asked Questions Regarding Disclosure of Certain Financial Conflicts Related to Investment Adviser Compensation
12
U.S. Securities and Exchange Commission. Form CRS Relationship Summary
13
eCFR. Delivery of Form CRS
14
U.S. Securities and Exchange Commission. Form ADV Part 2 – Uniform Requirements for the Investment Adviser Brochure and Brochure Supplements
15
U.S. Securities and Exchange Commission. Form BD
16
eCFR. 17 CFR 240.17a-3 – Records to Be Made by Certain Exchange Members, Brokers and Dealers
17
eCFR. 17 CFR 240.17a-4 – Records to Be Preserved by Certain Exchange Members, Brokers and Dealers
18
U.S. Securities and Exchange Commission. Regulation S-P – Privacy of Consumer Financial Information and Safeguarding Customer Information
19
FINRA. Enforcement