A failed review can expose gaps in the written program, safeguards, vendor oversight, and breach records; the firm should remediate with evidence. Citation: 16 CFR 314.4.
Primary source: FTC Safeguards Rule business guidance
What happens if a state-registered investment adviser fails an FTC Safeguards Rule audit?
Details
For a state-registered investment adviser, the risk is not just a missing binder. The issue is whether real systems, vendors, people, and customer information match the written program. FTC guidance lists investment advisers that are not required to register with the SEC, and 16 CFR 314.2(h)(2)(xii) identifies investment advisory companies.
Primary source: FTC Safeguards Rule business guidance.
Related obligations - not covered by this packet: state adviser books-and-records and examination rules may require separate records retention, advertising, billing, custody, and compliance files. Policywright's WISP packet does not satisfy those securities-recordkeeping duties.
FAQ
What happens if a state-registered investment adviser fails an FTC Safeguards Rule audit?
A failed review can expose gaps in the written program, safeguards, vendor oversight, and breach records; the firm should remediate with evidence. Citation: 16 CFR 314.4.
What is the data-flow issue for a state-registered investment adviser?
Client information lives in Form ADV files, advisory agreements, suitability or planning notes, custodial account data, portfolio-management tools, email, portals, billing records, and household financial plans. The WISP should distinguish custodian systems from adviser-controlled records.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.