Financial Advisor Compliance: Fiduciary Duty, Reg BI, and Form ADV

Financial advisor compliance requirements in the United States are set by the Securities and Exchange Commission, FINRA, and state securities regulators, and the specific rules that apply to you depend on whether you’re registered as a Registered Investment Adviser (RIA), a broker-dealer, or both. The obligations cover how you advise clients, what you disclose, how you supervise your team, how long you keep records, how you market the firm, how you hold client assets, and how you train staff. Getting any of them wrong can mean fines in the tens of millions, suspension, or a permanent industry bar.

Who Regulates You Depends on How You’re Registered

The SEC oversees RIAs with $100 million or more in client assets under management. Those firms register through Form ADV and are governed primarily by the Investment Advisers Act of 1940.¹ RIAs charge fees for ongoing advice rather than earning commissions on individual trades.

FINRA is the self-regulatory organization for broker-dealers and their registered representatives, operating under SEC oversight and enforcing its own rulebook on sales practices, advertising, and supervision.² Broker-dealers earn commissions by executing securities transactions and answer to the Securities Exchange Act of 1934 on top of FINRA rules.

State securities regulators handle RIAs with less than $100 million in assets under “Blue Sky” laws, and share jurisdiction with FINRA over broker-dealer agents selling securities inside their borders. If you run a smaller advisory firm, your primary compliance relationship is with your state, not the SEC.

Many firms are dually registered as both an RIA and a broker-dealer. That doubles the compliance burden because both rulebooks apply at the same time, and the SEC’s 2026 examination priorities specifically flag dually registered advisors as a focus area.³

The Standard of Care You Owe Clients

This is where most enforcement actions start. The standard turns on whether you’re acting as an RIA or a broker-dealer, and the two standards are not interchangeable.

Fiduciary Duty for RIAs

An RIA owes clients a fiduciary duty under the Investment Advisers Act. You must act in the client’s best interest at all times, not only when making a specific recommendation. Conflicts of interest must be eliminated, or fully disclosed and mitigated so they don’t taint the advice. SEC examiners will scrutinize how your financial conflicts affect the impartiality of your recommendations.³

The duty is continuous and applies across the entire advisory relationship. Recommendations must align with the client’s goals, risk tolerance, and financial situation. If a lower-cost index fund serves the client as well as a higher-fee proprietary product, the fiduciary standard makes the proprietary product a hard sell.

Regulation Best Interest for Broker-Dealers

Reg BI took effect in June 2020 and requires broker-dealers and their representatives to act in the “best interest” of retail customers when making any recommendation.⁴ Compliance means satisfying four obligations at the same time:

Disclosure. Provide written disclosure of all material facts about the recommendation and the relationship before or at the time of the recommendation.
Care. Exercise reasonable diligence and skill to understand the risks, rewards, and costs, and have a reasonable basis to believe the recommendation is in that particular customer’s best interest.⁵
Conflict of interest. Maintain written policies to identify, disclose, and mitigate conflicts. Sales contests and quotas tied to specific products must be eliminated entirely.
Compliance. Establish, maintain, and enforce written policies designed to achieve compliance with all of Reg BI.

The practical gap between fiduciary duty and Reg BI comes down to conflicts. A fiduciary generally must eliminate conflicts or reduce them until they no longer influence advice. Reg BI requires mitigation and disclosure but doesn’t demand elimination. A broker-dealer can still recommend a proprietary fund with higher internal costs if they can demonstrate it’s genuinely the best option for that customer. That replaced the old suitability standard under FINRA Rule 2111, which only required a reasonable basis to believe a recommendation was appropriate.⁶

What You Must Disclose and When

Form ADV and the Firm Brochure

Every RIA files Form ADV with the SEC or the appropriate state regulator. Part 2A is the firm brochure describing services, fees, conflicts, and disciplinary history, and clients must receive it before or at the time they sign an advisory contract.¹ You must offer an updated brochure to existing clients each year.

Part 2B is the brochure supplement, a separate document for each individual providing advice to the client. You deliver it when the client first starts working with that advisor, and again if an existing client gets reassigned. Supplement updates are event-driven: amend and deliver whenever the information becomes materially inaccurate.

Form CRS

Both RIAs and broker-dealers must deliver a Customer Relationship Summary to retail investors. It’s a short document covering the nature of the relationship, fees, conflicts, and disciplinary history. For broker-dealers, delivery must happen before recommending an account type, a transaction, or an investment strategy.⁷ For RIAs, delivery is required before or at the time of entering into an advisory contract.⁸

Existing clients must receive an updated Form CRS when specific events occur, such as opening a different type of account or getting a rollover recommendation. If you amend Form CRS, you have 60 days to communicate the changes. Clients who request a copy must receive one within 30 days.

Supervision and the Internal Compliance Program

Chief Compliance Officer and Annual Review

Every SEC-registered RIA must designate a Chief Compliance Officer responsible for administering compliance policies and procedures. The firm must review the adequacy of those policies, and the effectiveness of how they’re implemented, at least once a year.⁹ A real annual review identifies gaps revealed by new business activities, regulatory changes, or past failures. The SEC evaluates the quality of these programs during examinations.

Broker-Dealer Supervisory Systems

FINRA Rule 3110 requires every broker-dealer to establish a supervisory system designed to prevent and detect violations. The firm must designate registered principals to supervise each type of business activity and each branch office, and every registered representative must be assigned to a supervisor responsible for their conduct.¹⁰ Procedures must cover review of customer accounts, trade activity, and correspondence. Branch offices require periodic inspections that include reviewing business records and electronic communications, and written supervisory procedures must describe who performs each review, how often, and how it’s documented.

Recordkeeping and Off-Channel Messaging

Retention Periods and Format

Record-keeping rules are among the most strictly enforced in the industry. Broker-dealers must preserve certain core records, such as trade blotters, ledgers, and account statements, for at least six years, with the first two years in an easily accessible location. Other records, including order tickets and communications, carry a minimum three-year retention period.¹¹ FINRA’s own rules require a six-year minimum for any records that don’t have a different retention period specified elsewhere.¹²

Electronic records must be stored in a format that prevents alteration. Broker-dealers using electronic storage must comply with either a write-once, read-many (WORM) format requirement or maintain a compliant audit trail.¹³

Off-Channel Communications

No single compliance issue has produced more enforcement dollars recently. When employees use personal phones, WhatsApp, Signal, or other unapproved apps to discuss business, the firm loses the ability to archive and review those conversations, and regulators treat that as a serious recordkeeping failure.

The SEC fined 26 firms a combined $392.75 million in 2024 for failing to preserve electronic communications on unapproved channels.¹⁴ In early 2025, another 12 firms paid over $63 million in combined penalties, with individual fines ranging from $600,000 to $12 million.¹⁵ The 2025 round included Charles Schwab, Blackstone, KKR, and Carlyle.

FINRA’s 2026 Regulatory Oversight Report highlights common failures: not archiving non-email electronic communications on firm-approved channels, not capturing emails sent through third-party vendor addresses, and failing to detect when associated persons use personal accounts for business.¹³ Firms that get this right watch for signs that employees have shifted away from approved channels, like a sudden drop in messaging volume on firm systems, and regularly update the keyword searches used to detect off-channel activity.

Advertising and the Marketing Rule

The SEC’s Marketing Rule, Rule 206(4)-1, overhauled advertising for investment advisers. The old blanket ban on client testimonials is gone. RIAs can now include testimonials from current clients and endorsements from non-clients, provided they meet specific conditions.¹⁶

Those conditions are not trivial. You must disclose whether the person giving the testimonial is a current client, whether compensation was provided, and any material conflicts. Compensated testimonials require a written agreement describing scope and terms. You must have a reasonable basis for believing the testimonial complies with the rule, and anyone disqualified under the rule’s “bad actor” provisions cannot be compensated. Performance advertising must follow specific presentation requirements, including showing net-of-fee returns. Marketing Rule compliance is one of the SEC’s core examination areas for 2026.³

Broker-dealer communications fall under FINRA Rule 2210, which requires a registered principal to approve each retail communication before it’s used or filed with FINRA’s Advertising Regulation Department. Retail communications are defined as any written material distributed to more than 25 retail investors within a 30-day period.¹⁷ Some communications, like posts on interactive online forums or materials that don’t make investment recommendations, can be handled through the firm’s general correspondence supervision instead of pre-approval.

Custody of Client Assets

If your RIA has custody of client funds or securities, you fall under one of the most detailed compliance regimes in the industry. SEC Rule 206(4)-2 requires that a qualified custodian hold all client assets, typically a bank with FDIC-insured deposits or a registered broker-dealer.¹⁸ The rule imposes four key obligations:

Qualified custodian. Client funds and securities must be held either in separate accounts under each client’s name or in accounts containing only client assets under the adviser’s name as agent.
Client notification. When you open a custodial account on a client’s behalf, promptly notify them in writing of the custodian’s name, address, and how the assets are maintained.
Quarterly statements. You must have a reasonable basis for believing the custodian sends account statements to each client at least quarterly, showing all holdings and transactions.
Surprise examination. An independent public accountant must verify client assets through an unannounced examination at least once per calendar year, at an irregular time chosen by the accountant, and file the results with the SEC on Form ADV-E within 120 days.

If the accountant discovers material discrepancies during the surprise exam, they must notify the SEC within one business day. Custody practices are a perennial examination focus.

Anti-Money Laundering and Cybersecurity

AML Programs

The Bank Secrecy Act requires financial institutions, including broker-dealers, to maintain anti-money laundering programs. Those programs must verify the identity of every new client, monitor for suspicious activity on an ongoing basis, and report transactions above $10,000 or anything that appears to involve illegal activity.¹⁹ The program must designate a compliance officer, provide staff training, and include independent testing by internal personnel or an outside party.²⁰

Regulation S-P and Data Protection

Regulation S-P requires every covered financial institution to develop, implement, and maintain written policies addressing administrative, technical, and physical safeguards for client information.²¹ That covers encryption, access controls, data loss prevention, and written procedures for breach response.

The SEC’s 2026 examination priorities highlight cybersecurity as a dedicated focus area. Examiners will assess governance practices, data loss prevention, account management, and how firms respond to and recover from incidents, including ransomware. Firms are also expected to have training and security controls that address risks introduced by artificial intelligence and new forms of malware.³

Artificial Intelligence in Advice

FINRA’s 2026 Regulatory Oversight Report identifies risks firms must account for when deploying AI, particularly generative AI “agents” that can autonomously perform tasks on behalf of users.²² The concerns are practical: an AI agent might act beyond its intended scope, produce recommendations that can’t be audited or explained, or mishandle sensitive client data.

FINRA doesn’t treat AI tools differently from any other business activity. If an AI system generates investment recommendations, your supervisory obligations still apply, and someone must be able to trace how the recommendation was made and verify it meets applicable standards. The SEC’s 2026 exam priorities add that examiners will review whether firms’ claims about their AI capabilities are accurate and whether AI tools are used consistently with fiduciary or Reg BI obligations.³ Firms that market themselves as using AI-driven advice face heightened scrutiny on whether the reality matches the marketing.

Continuing Education and Licensing

Compliance doesn’t end at initial registration. FINRA’s continuing education program has two mandatory components. The Regulatory Element is an annual computer-based training requirement administered directly by FINRA. The Firm Element requires each broker-dealer to design and deliver its own annual training program tailored to its business activities and the roles of its registered persons. Firms can develop their own content or use FINRA’s centralized platform, called the Financial Learning Experience (FLEX).²³

For investment adviser representatives, the North American Securities Administrators Association (NASAA) has adopted a model rule requiring 12 credits of approved training annually in states that have implemented it. The number of participating states continues to grow, so IARs should verify their own state’s requirements. FINRA qualification exams, such as the Series 7 for general securities representatives, remain prerequisites for registration, and continuing education builds on top of those initial licensing requirements.

Examinations and Enforcement Consequences

The SEC examines RIAs on a risk-based schedule. Larger firms, those with custody of client assets, and those flagged by complaint patterns or unusual activity face more frequent inspections. Routine exams cover fiduciary conduct, conflicts of interest, custody practices, marketing materials, and the overall adequacy of the compliance program. For 2026, the SEC has identified several specific focus areas: alternative and complex investment products, advisors serving older investors and those approaching retirement, and firms that have recently merged or been acquired.³

FINRA’s program targets broker-dealer sales practices, supervisory systems, and financial stability. Examiners review electronic communications, trade records, and supervisory logs. Targeted exams can be triggered by spikes in customer complaints or unusual trading patterns.¹³

When an examination uncovers potential violations, the matter may be referred for formal investigation. Firm-level penalties commonly include monetary fines that can reach hundreds of millions of dollars, as the off-channel communications cases show, and the SEC can issue cease-and-desist orders requiring immediate corrective action. For individuals, sanctions range from temporary suspension to a permanent industry bar, with repeat offenders and those involved in fraud facing the harshest outcomes. Administrative proceedings and civil actions can be brought against the firm and the individual advisor separately.

1
Securities and Exchange Commission. Form ADV General Instructions
2
Financial Industry Regulatory Authority. Supervision
3
U.S. Securities and Exchange Commission. Fiscal Year 2026 Examination Priorities
4
U.S. Securities and Exchange Commission. Regulation Best Interest
5
eCFR. 17 CFR 240.15l-1 – Regulation Best Interest
6
Financial Industry Regulatory Authority. FINRA Rule 2111 – Suitability
7
eCFR. 17 CFR 240.17a-14 – Form CRS
8
eCFR. 17 CFR 275.204-5 – Delivery of Form CRS
9
eCFR. 17 CFR 275.206(4)-7 – Compliance Procedures and Practices
10
Financial Industry Regulatory Authority. FINRA Rule 3110 – Supervision
11
eCFR. 17 CFR 240.17a-4 – Records to Be Preserved
12
Financial Industry Regulatory Authority. FINRA Rule 4511 – General Requirements
13
Financial Industry Regulatory Authority. 2026 Annual Regulatory Oversight Report
14
U.S. Securities and Exchange Commission. Twenty-Six Firms to Pay More Than $390 Million
15
U.S. Securities and Exchange Commission. Twelve Firms to Pay More Than $63 Million Combined
16
eCFR. 17 CFR 275.206(4)-1 – Investment Adviser Marketing
17
Financial Industry Regulatory Authority. FINRA Rule 2210 – Communications with the Public
18
eCFR. 17 CFR 275.206(4)-2 – Custody of Funds or Securities of Clients
19
FinCEN.gov. The Bank Secrecy Act
20
FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program
21
eCFR. 17 CFR 248.30 – Procedures to Safeguard Customer Information
22
Financial Industry Regulatory Authority. FINRA Publishes 2026 Regulatory Oversight Report
23
FINRA.org. Continuing Education