SEC Risk Alert Focuses on Annual Compliance Reviews

Background:

On September 14, 2026, the SEC’s Division of Examinations issued a Risk Alert describing deficiencies the staff identified in advisers’ annual compliance reviews conducted under the Compliance Rule.
Notably, the rule does not require a written annual review — a long-standing frustration for examiners. Because the Compliance Rule itself gives examiners limited leverage on annual review issues, the staff looks for other paths to the same result.
The Alert is a reminder that although the rule imposes few formal requirements, examiners treat the annual review as a central test of a compliance program.

Summary of SEC Findings:

The risk alert highlights the following findings:

Timeliness – Advisers had not performed reviews in certain years, prepared a single review covering more than one year, or asserted that other processes, such as attestations, substituted for the annual review.
Compliance manual obligations – Compliance manuals imposed obligations to conduct or document an annual review but those policies were not followed. In other instances, review areas listed in the compliance manual as requiring annual review were not addressed or reviews were conducted in a manner different from that prescribed by the policies.
Annual review deficiencies – Some annual reviews failed to identify deficiencies in the compliance program. For example, some reviews failed to identify that key policies had not been adopted or did not consider changes in the adviser’s business or applicable regulations. The staff cited other examples, including fees and expenses being incorrectly applied, proxies not being voted in accordance with the adviser’s fiduciary duty, custody practices being incorrectly executed, marketing practices not being updated, regulatory filing procedures not being updated to reflect a Form CRS filing obligation, and inadequate policies governing oversight of service providers.
Maintaining documentation – Advisers didn’t have supporting documentation for the annual review conclusions or did not follow their own self-imposed requirement for documentation.
Taking corrective action – Advisers did not make the changes recommended, or committed to, in their annual review.

Takeaways:

There is no perfect annual review — Advisers have significant flexibility in how they design and conduct the review, and what works best will depend on the nature and risks of the business. Perfection can also be difficult to achieve because examiners often work backwards from a primary rule violation to identify related Compliance Rule or annual review deficiencies. Rather than trying to anticipate every possible issue, advisers should develop an annual review process that works for their organization and focuses on the risks that matter most
Robust annual reviews build trust with examiners. A thoughtful, well documented annual review can give examiners greater confidence in the adviser’s compliance program and its ability to identify and address risk. That credibility can matter during an examination—potentially reducing the length and depth of the exam as examiners gain comfort that the compliance program is working effectively.
Less is more when it comes to written annual review policies. Once an adviser adopts specific requirements for how the annual review must be conducted, examiners can hold the adviser to those requirements. The more detailed the policy, the more opportunities there are to fall short. Keep any policy simple to avoid unnecessary compliance risk.