How quickly must I amend Form ADV after a material change?

Under SEC Rule 204-1, an adviser must file an interim amendment to Form ADV (Form ADV-W) within 30 days of any material change to Part 1A or Part 2A, including new services, disciplinary events, ownership changes, or new conflicts of interest. Form CRS has the same 30-day rule.

What is the Reg S-P 30-day client notification rule?

When a Reg S-P incident results in unauthorized acquisition of client nonpublic personal information that creates a reasonable risk of harm, the SEC expects firms to notify affected clients promptly. The 30-day window refers to the SEC's own reporting timeline; firms should have written procedures that define how clients are notified within days, not weeks.

What is the SEC's top exam priority for solo RIAs in 2025?

The SEC Division of Examinations' 2025 priority letter highlights the Marketing Rule (Rule 206(4)-1), Regulation S-P cybersecurity compliance, and Form ADV accuracy. For solo RIAs, the most-cited deficiencies are stale ADV brochures, missing written information security plans, and untested incident response procedures.

Is MFA required for solo RIAs accessing client PII?

Reg S-P requires a written information security plan with controls reasonably designed to protect client information. In current SEC enforcement posture, multi-factor authentication on all systems that store or access client nonpublic personal information is the de facto baseline standard — firms without it are cited in nearly every sweep exam.

How often should a solo RIA supervise the trade blotter?

Best practice for solo and small RIAs is documented weekly trade blotter review with a clear escalation path for exceptions — including personal trading, allocation issues, and trade errors. The procedure and review log should be retained for at least five years under Rule 204-2.

Free Self-Assessment — Under 90 Seconds

How ready is your solo RIA firm for an SEC exam?

Quick yes/no check across the four exam areas solo RIAs get hit on most: your SEC compliance program, Form ADV, Reg S-P, and cybersecurity. You'll see a partial readiness score after the first three questions — your full results, scoring breakdown, and printable report unlock by email.

Readiness score

1 — SEC Compliance Program 0 / 2 answered

Do you maintain written compliance policies and procedures, reviewed and approved at least annually?

Weight: 3 — Rule 206(4)-7 requires written policies reviewed annually

Have you designated a Chief Compliance Officer with clear authority and enough time to administer the compliance program?

Weight: 3 — CCO designation with authority is a core 206(4)-7 test

2 — Form ADV Filing 0 / 2 answered

Is your Form ADV Part 2A updated within 30 days of any material change (new services, conflicts, disciplinary events, ownership)?

Weight: 3 — Rule 204-1 requires 30-day interim amendment

Do you deliver the current ADV brochure (Part 2A) and Form CRS to every client before engagement, and annually after a material change?

Weight: 3 — delivery obligations are tested in every exam

Your score is ready

—

Enter your email to see the full breakdown

We'll send your section-by-section read across all eight questions, plus a printable PDF readiness report. No spam, no list-selling.

Your license type (optional)

Continue without finishing — see partial results

3 — Reg S-P (Privacy & Safeguards) 0 / 2 answered

Have you delivered your written privacy notice (initial and annually) to every client, opt-outs honored, and shared affiliate-marketing opt-outs in place?

Weight: 3 — annual delivery is a Reg S-P bright-line test

Do you have a documented, tested incident response procedure for unauthorized acquisition of client NPI — with client notification ready within 30 days?

Weight: 3 — untested IR is a top exam deficiency

4 — Cybersecurity 0 / 2 answered

Is firm-wide multi-factor authentication enabled on every system that stores or accesses client nonpublic personal information?

Weight: 3 — MFA is the de facto baseline under Reg S-P

Do you maintain tested, encrypted backups for client data with a documented recovery procedure your firm can actually execute?

Weight: 3 — encryption + tested recovery is an exam checklist item

Here's your full breakdown

Printable report

Download your compliance readiness report

Single-page summary you can save, email, or bring to your next team meeting. Includes your score, per-section breakdown, and the next three actions to take.

Download PDF report

Founding 100

100 of 100 founding spots remaining

Get alerted the next time the SEC flags solo RIA gaps.

RegAxis monitors SEC enforcement, FINRA disciplinary actions, and NAIC bulletins 24/7. Founding members lock in $49/mo for life — after seat 100, regular pricing is $149/mo.

Claim founding seat →

Targeted next steps

Where solo RIAs see the most exposure

Reg S-P enforcement actions in the RegAxis archive → SEC Marketing Rule Readiness Scorecard (20-question deep dive) → Form ADV amendment policy template → Ask a compliance question (free, AI-grounded in RegAxis archive) →

Solo RIA compliance

Common questions from solo RIAs

Why does the SEC drill solo RIAs on Reg S-P in 2025?

The SEC's 2025 Division of Examinations priority letter elevated cybersecurity and Reg S-P compliance as a top focus for investment advisers. The 2024 amendments tightening Reg S-P incident response are now in force, and firms without documented, tested IR procedures are routinely cited — regardless of firm size. Solo RIAs without a written IRP and a tested client-notification procedure are the most exposed population.

How fast do I have to amend Form ADV?

Rule 204-1 requires an interim amendment (Form ADV-W) within 30 days of any material change to Part 1A or Part 2A — new services, conflicts, disciplinary events, ownership changes, or new affiliates. Form CRS has the same 30-day window. The annual updating amendment is due within 90 days of your fiscal year end.

If I outsource IT, am I responsible for Reg S-P anyway?

Yes. Reg S-P applies to you as the adviser — your service-provider agreement needs to require them to meet your information security standards, and you retain responsibility for the program overall. Outsourcing IT does not transfer regulatory liability.

Is MFA actually required for solo RIAs?

MFA is not a single-rule mandate, but the SEC's enforcement record-plus the 2024 Reg S-P amendments make it the de facto baseline for any adviser system that touches client NPI. Firms without MFA on cloud email, CRM, custodian portals, and document storage are getting cited in nearly every cybersecurity sweep. The cost of not having MFA now dwarfs the cost of enabling it.

What's the fastest way to move out of "Critical Exposure"?

In priority order: (1) enable MFA on every system that touches client data, (2) write a Reg S-P IRP and walk through one tabletop exercise, (3) review Form ADV Part 2A against your actual services and amend within 30 days of any material change, (4) document annual policy review with date-stamped approval. Two of those four are under $500 of effort and remove most of the "red flag" exposure a sweep would surface.