How RIAs create written policies and procedures

This is the 17th installment in a Financial Planning series by Chief Correspondent Tobias Salinger on how to build a successful RIA. See the previous stories here, or find them by following Salinger on LinkedIn.

Financial advisors who launch registered investment advisory firms can expect much more flexibility and control, but they also have to satisfy their regulatory compliance obligations.

Alongside other needs such as registering with the Securities and Exchange Commission or state regulators and buying the necessary insurance policies, startup firms must create written policies and procedures and update them each year. The areas covered by the policies include key RIA functions such as portfolio management, marketing, business continuity, recordkeeping and safeguarding of client assets. And they carry big stakes: enforcement cases typically include allegations that firms failed to adopt or follow policies and procedures “reasonably designed” to observe the relevant laws or rules. 

SEC settlements last month with units of Empower and Vanguard are only the latest examples. In addition, recent guidance from the SEC and its counterparts at the state level highlighted guidelines that make tasks such as yearly reviews and the appointment of a chief compliance officer mandatory steps. 

While RIA owners can easily find templates for the policies and procedures online, they should know that the “failure to customize your manual” is a frequent finding in regulatory exams, according to Kyrstin Ritsema, an executive director of compliance services working with advisory practices, investment companies and broker-dealers at international regulatory technology firm Confluence. She suggested that startup RIAs set aside at least 30 days to file their registration documents and write their written policies and procedures and a code of ethics. Sometimes those processes can be “challenging for breakaways,” she said.

“If you have something in there that says you are responding to every Google review and you do not respond to every Google review, you now have a violation of your policies and procedures,” Ritsema said. “FINRA is incredibly prescriptive, and the SEC paints a picture for you. You have to know how to apply that within your company.”

That’s why she and Jenice Malecki, a securities attorney who represents advisors, firms and investors at Malecki Law, say hiring a compliance consultant to help a newly established firm with its written policies and procedures and other important documents is often a worthwhile investment.

“You have to have them — that shouldn’t be a surprise to anyone who’s wanting to start an RIA,” Malecki said. “Policies and procedures are important. They must be followed. In order to follow them, you need to have a lot of training and supervision.”

READ MORE: Record-breaking RIA growth, in 5 charts

Check the rulebook

The SEC’s Compliance Rule under the Investment Company Act of 1940 and the Investment Advisers Act of 1940 codified written policies and procedures into law more than 20 years ago.

“The new rules require each registered investment adviser and each fund to adopt and implement compliance programs that conform to the new rules,” the 2004 guidelines say. “Failure of an [RIA] or fund to have adequate compliance policies and procedures in place will constitute a violation of our rules independent of any other securities law violation. The new rules will thus permit the Commission to address the failure of an [RIA] or fund to have in place adequate compliance controls, before that failure has a chance to harm clients or investors.”

Five years ago, the North American State Securities Administrators Association adopted a model rule outlining the areas of RIA operations and documents that must be part of the companies’ written policies and procedures. That same year, the SEC issued a “risk alert” warning firms about the “notable deficiencies or weaknesses” in many of them.

At the time, SEC examiners cited firms’ inadequate compliance resources, lack of authority for their chief compliance officers, problems with their annual reviews and failures in adopting and maintaining the policies and procedures. 

“The Compliance Rule does not enumerate specific elements that [RIAs] must include in their policies and procedures,” the alert said. “Each [RIA] should adopt policies and procedures that take into consideration the nature of that firm’s operations. The policies and procedures should be designed to prevent violations from occurring, detect violations that have occurred and correct promptly any violations that have occurred.”

In that backdrop, compliance consulting fees that charge lower rates of around $3,000 to $4,000 for an RIA registration and the other necessary documentation at startup compared to more standard expenses of between $6,000 and $12,000 could prove costly in the end, Ritsema said. Unless firms are opening their doors without any clients, they should “take the time to interview consultants” to ensure they find a good fit for their particular needs, she noted.

“You get what you pay for,” she said. “What seems inexpensive can cause heartbreak when you do your exam.”

READ MORE: When should a financial advisor launch an RIA?

Watch out for career roadblocks

And written policies and procedures could come up for a different reason earlier in the career of an advisor or another industry professional, according to Malecki. 

Giant wealth management firms frequently hit employees with a Form U5 termination disclosure that “makes them really unemployable, for all intents and purposes,” based on a firm’s claim that they breached its policies and procedures, she said. Sometimes, the claims stem from “a mistake on a check-the-box” task in two or three calls or client interactions out of as many as 8,000 to 10,000 in a year, and many of the younger professionals “don’t actually recommend products,” and haven’t received enough training and coaching from their firms, she said. Unless they pursue an expensive expunction, the novice employees may have to leave the industry.

“It’s sort of a heavy-handed, I think, unfair and really irresponsible way for firms to fill out these forms upon someone’s termination, even if it’s an honest mistake,” Malecki said. “I see it all the time, especially at some of these large broker-dealers with call centers for young employees or branches within a bank.”