On September 14, 2026, the SEC’s Division of Examinations published a Risk Alert on investment adviser annual compliance reviews. It may be the least glamorous thing the Division has released this year. It proposes no new theory, addresses no new technology, and signals no new rule. It concerns an obligation that has been on the books since 2004. Under Rule 206(4)-7, every SEC-registered adviser must review, at least annually, whether its policies and procedures are adequate and whether they are actually being carried out.
That is precisely why it deserves attention. The Division does not need to tell the industry that a twenty-year-old rule exists. What it is telling the industry is that examiners may be viewing the state of a firm’s compliance program through the lens of its annual compliance program review.
What the SEC Staff Observed in Annual Compliance Reviews
The findings fall into five categories: timeliness, completeness of review procedures, consistency with those procedures, alignment between policy and practice, and follow-through.
Timeliness. Advisers simply skipped years, conducting reviews for 2021 and 2023 but not 2022. Others let review intervals stretch well past twelve months, often around a CCO departure or other personnel changes. Some newly registered firms waited 18 months for their first review, relying on a transitional allowance that applied only when the Compliance Rule first took effect in 2004. Some firms asserted that annual training or employee attestations satisfied the requirement. Most striking, some had already received deficiency letters for failing to conduct timely reviews and still had not corrected the problem.
Review procedures. Firms had policies requiring testing and validation but no procedures explaining how to test, what to weigh, or what to document. In other cases, a policy elsewhere in the manual required annual testing of a topic, such as identity theft, but that topic never made it into the review plan, so it was never tested.
Consistency with procedures. Some reviews did not follow the firm’s own written procedures on review period, scope, or workpapers. Some tested superseded versions of the firm’s own policies.
Alignment with practice. This is the category that should most concern every CCO. Annual reviews missed:
- fee billing that failed to prorate for large mid-period deposits, apply breakpoints, or issue refunds to terminating accounts;
- proxy voting policies promising to vote in clients’ best economic interest at firms that told clients they did not vote proxies and, in practice, did not;
- custody procedures that did not ensure accounts were identified to the accountant performing the surprise examination;
- marketing procedures never updated for the Marketing Rule;
- filing procedures that omitted Form CRS for firms with retail clients;
- functions delegated to third parties with no defined oversight.
Follow-through. Documentation was created during reviews but not retained. Written review reports that firm policy required were never prepared. Corrective actions were recommended but never taken. In some cases, the review report stated that remediation had already occurred, yet the issue persisted into the next cycle.
How Examiners Use the Annual Review to Hold a Firm Accountable
One sentence in the alert explains the rest. The staff noted that it often identified these inconsistencies after observing issues in core areas of the adviser’s business, which it then compared against the annual review and the written policies.
In other words, the examination does not begin with the annual review. It ends there. An examiner finds a fee calculation error, a custody gap, or a proxy disclosure that contradicts practice, and then pulls the annual review to see whether the firm noticed. If the review is silent, an operational error becomes a compliance program failure. A Compliance Rule problem is layered on top of the underlying one, and the firm’s own documentation is the proof.
The annual review is, functionally, the firm’s testimony about what it knew about itself over the course of the year. A review that reports remediation as complete when the problem remains is no longer a shield, but an exhibit. Recent enforcement activity bears this out, including Compliance Rule charges tied to annual review failures and backdated review documentation.
Why a Back-to-Basics Alert Lands Differently in 2026
Context is not a luxury in compliance analysis, and the context here is the regulatory climate as a whole. The rulebook is not expanding. The private fund adviser rules were vacated. FinCEN’s investment adviser AML rule has been deferred to 2028. The agency has deliberately recalibrated what enforcement is for and whom it should reach.
It would be a mistake to read that posture as a lighter examination touch. The Division’s 2026 examination priorities were explicit about returning to foundational Advisers Act obligations. When the rulebook stops growing, the examination question shifts more focus from “have you implemented the new rule” to “does what you already have actually work?”
The annual review is the one mechanism in the adviser framework built to answer the latter. A regulator that relies less on new rules naturally must rely more on firms’ own supervisory infrastructure. Deregulation does not reduce the burden of proof, it moves that burden inside the firm.
This alert also completes a sequence. The Division’s December 2025 Marketing Rule observations and its June 2026 alert on economic conflicts of interest identified where the problems live. The new alert’s own footnotes cite both. Read together, the September alert explains why firms don’t catch those problems themselves. The fee billing deficiencies from June are the same ones this alert says annual reviews failed to surface. If your firm treated the conflicts alert as a disclosure exercise, now is the time to revisit how conflicts are identified and captured and whether your review actually tests them.
Is a Written Annual Review Still Required After the Fifth Circuit Ruling?
There is a subtle trap here for firms that followed the rulemaking closely.
In 2023, the SEC amended the Compliance Rule to require that annual reviews be documented in writing. In June 2024, the Fifth Circuit vacated that amendment along with the rest of the private fund adviser package, and the SEC confirms the vacated amendments are no longer in effect. Some advisers took that as permission to scale back.
The alert does not rely on the vacated amendment. It relies on Rule 204-2(a)(17)(ii), which has long required advisers to keep records documenting their annual review. It also relies on the firms’ own policies. Nearly every documentation deficiency the staff cites is a firm failing to do what it wrote it would do, or failing to retain what it had already created.
The written report mandate is gone; the evidentiary expectation is not. For examination purposes, an undocumented review is a review that did not happen.
Where the Gap Between Program and Practice Opens
The alert faults advisers for failing to consider changes in their business, including CCOs who were never told about operational changes that should have shaped the review’s scope. That observation deserves more weight than its placement in the alert suggests, because business change is where compliance programs fall behind the firms they govern.
Private equity and private credit managers add continuation vehicles, co-investment structures, portfolio company service arrangements, and new fee offset mechanics far faster than compliance manuals are updated. Valuation and fee and expense allocation are exactly where manual and practice can diverge, particularly as regulatory expectations and the operating environment for private equity continue to evolve and fee transparency remains an enforcement focus for private fund managers.
Advisers adding digital asset exposure should consider the custody observation closely. Custody procedures written for traditional qualified custodians rarely anticipate tokenized products or crypto custody arrangements. As the SEC’s approach to tokenization, custody, and digital market infrastructure continues to develop, including through staff positions addressing crypto custody arrangements, this is precisely the type of gap an annual review should identify; in our experience, often does not.
Firms deploying AI or outsourcing core functions should recognize themselves in the delegation finding. An AI tool drafting client communications, or a vendor performing surveillance, is a delegated function. The alert faults policies that delegate execution without defining how the adviser oversees it. That concern is particularly relevant where firms use AI to increase the efficiency of compliance functions while retaining human judgment and oversight or incorporate AI into client communications subject to existing supervisory obligations. Efficiency without documented oversight is exposure deferred, making a defined AI governance framework increasingly important as these tools become embedded in core business and compliance processes.
Firms that lose a CCO risk losing a review cycle with them. The alert’s observation that review intervals lengthened around CCO departures describes a continuity failure, not a knowledge failure. The review calendar should belong to the firm, not to an individual.
What a Defensible Annual Review Looks Like
None of this requires reinventing the annual review. It requires treating the review as an assessment rather than a ritual.
- Anchor the calendar to the firm, not the person. Set a fixed review period that survives personnel changes. Define triggers for interim reviews, which the Compliance Rule adopting release has encouraged since 2003, for significant compliance events, business changes, and regulatory developments.
- Derive scope from risk, not the table of contents. Cross-reference every policy that requires testing to the review plan. Refresh the risk assessment for new products, structures, vendors, and technologies. Build a formal channel so business changes reach the CCO before the review, not after the examination.
- Test practice, not paper. Reconcile fee calculations against executed agreements, not just billing system outputs. Compare proxy practice to disclosure, and the custody account list to what the surprise-examination accountant actually received. Confirm you are testing the current version of every policy.
- Close the loop, and verify it is closed. Track every recommendation with an owner, a deadline, and a validation step. Never record a corrective action as complete until someone has confirmed the issue is actually addressed and resolved. Attestations and training are useful inputs to a review, but they are not a review.
Technology can make this discipline repeatable. Workflow tools that schedule testing, capture evidence, and map policies to requirements, such as the Planner and Govern modules within CRC Oyster’s compliance technology solutions, turn the annual review from a year-end scramble into a continuous record.
The Timing Is Not Incidental
The alert arrived in mid-September, just as calendar-year advisers are scoping reviews for fourth-quarter fieldwork. Those findings should also inform the Form ADV annual amendment due by the end of March. The Division has effectively handed CCOs a scoping checklist at the moment they need one. Firms that use it now will conduct better reviews. Firms that file it away will likely see its contents again, in a deficiency letter.
The annual review is the only document in which an adviser tests and proves its regulatory self-awareness, and examiners are checking whether that account is true.
CRC Oyster conducts independent annual compliance reviews designed to hold up under examination. We scope each review to how your firm actually operates, test practice against policy rather than paper against paper, and document the testing and findings to the standard examiners expect. Every recommendation is tracked through remediation and confirmed closed before it’s marked complete.
Whether you’re a newly registered adviser approaching your first review, a firm that has lost continuity through a CCO transition, or an established manager whose business has outgrown its compliance manual, your next review cycle is coming. Talk to us about where your program stands.