Top 10 compliance questions solo RIAs ask — answered
The questions solo RIAs ask us most often about Form ADV amendments, Reg S-P incident response, and the SEC Marketing Rule 206(4)-1 — answered in plain English and paired with the free gated policy templates used by the RegAxis Founding 100.
1. How do I amend Form ADV after a material change?
File an interim amendment (Form ADV-W) within 30 days of any material change to your Part 1A or Part 2A information. Triggers include new services, disciplinary events, ownership changes, new conflicts of interest, custody arrangements, and changes to fee schedules. Prompt filing is the difference between a clean SEC exam and a deficiency letter.
Keep a written log of every potential trigger event with the date you identified the trigger and the date you filed the amendment — the SEC will ask for this in an examination. Most solo RIA firms miss the trigger because they don't have a documented change-detection process tied to calendar dates.
Texas-registered firms see Texas Form ADV state notice filing requirements → · NY-registered firms see New York RIA Form ADV Part 2A brochure delivery and NY AG registration →
2. When do I update Form CRS vs. Part 2A?
Form CRS is the standalone Client Relationship Summary, and Part 2A is the longer Brochure — both are required for retail clients. Form CRS becomes inaccurate whenever any of its eight required fields changes, and amendments must be filed within 30 days.
Part 2A Brochure amendments follow the same 30-day rule but carry a separate filing cycle. Use Form ADV-W to amend Part 2A, and update Form CRS in the same filing window when both are affected. The Form ADV policy template includes a side-by-side update checklist so the two never drift out of sync.
Texas-registered firms see Texas Form ADV state notice filing requirements →
3. What triggers a Reg S-P incident notification?
Reg S-P is triggered by any unauthorized acquisition of client nonpublic personal information that creates a reasonable risk of harm. Common triggers include phishing attacks on supervised persons, lost or stolen devices with unencrypted client data, vendor breaches, and credential compromises.
Once you identify a likely incident, start the response clock: notify affected clients, preserve evidence, and determine whether the breach crosses SEC reporting thresholds. The Reg S-P IRP template gives solo RIAs a fill-in incident classification matrix and a written notification script so your team can act in the first 24 hours, not after legal review.
4. How long do I have to notify clients after a breach?
Reg S-P requires client notification "as expediently as possible and without unreasonable delay." Industry practice treats this as 30 to 60 days from discovery, depending on the scope of the incident and forensic timing.
SEC-registered advisers must also file Form NCEN within 30 days of discovering the incident under the 2024 amendments. State notification deadlines (especially in New York DFS, California, and Texas) often run shorter than federal timelines — the IRP template includes a state-by-state matrix so you don't miss the earliest deadline.
Get the Reg S-P IRP template →
NY-registered advisory firms see New York RIA compliance — Article 23-A registration and 11 NYCRR Part 221 books-and-records →
5. What counts as an "advertisement" under Rule 206(4)-1?
The SEC's Marketing Rule defines an advertisement as any communication, directed to more than one person, that offers investment advisory services or includes performance results. That sweeps in websites, blog posts, social media updates, podcast show notes, email blasts, and even standardized one-on-one reports used at scale.
Testimonials and endorsements are also covered. If you publish anything that a reasonable client could read as marketing, the Marketing Rule applies. The policy template lays out the seven disclosure categories the SEC looks for on first review.
6. Can I post hypothetical performance on my website?
Yes, hypothetical performance is permitted — but conditional. The SEC requires advisers to adopt and implement written policies and procedures reasonably designed to ensure hypothetical performance is relevant to the likely financial situation and investment objectives of the intended audience.
In practice the rule requires (a) policies and procedures before any use, (b) documentation of the audience match, and (c) specific disclosures including the basis of calculation, fees deducted, and risk warnings. Without all three, the SEC will cite a deficiency in the first marketing exam.
7. Do I need a written agreement before using client testimonials?
Yes. The Marketing Rule requires a written agreement with the client (or former client) giving informed consent to be quoted, a clear disclosure of any compensation paid in exchange for the testimonial, and prominent disclosure of any material conflicts the testimonial creates.
For endorsements — third-party influencers or firms — the rule also requires adviser due diligence on the endorser's compliance with marketing rules and a written agreement covering content review. The Marketing Rule template includes a one-page client consent form you can drop straight into your onboarding flow.
8. How often must I review my marketing materials?
The Marketing Rule requires written policies and procedures defining the review cadence, the approver, and the documentation retention period. Industry standard is annual review of all marketing materials, plus a same-day review of any new content before publication.
Solo RIAs typically lack a second approver, so write your policy around a documented self-review with a fixed 12-month renewal cycle plus per-publication sign-off. Retain approval records for at least five years under the books-and-records rule.
9. What's the difference between Reg S-P and Reg S-ID for cyber incidents?
Reg S-P governs safeguarding of client information and incident response for RIAs — solo advisory firms and state-registered advisers included. Reg S-ID imposes customer identification, transaction monitoring, and account notification duties on broker-dealers under the USA PATRIOT Act.
If your firm is dual-registered (RIA and BD), both regimes apply to the same incident and the firm must satisfy the most stringent obligation on each affected account. Single-registrant advisers only need to plan for Reg S-P; broker-dealers only need Reg S-ID. The IRP template flags which obligations apply based on registration type.
10. How do I file an interim amendment for a new employee?
Add the new supervised person to Part 1A Schedule D and, if the person will deliver advisory services directly to clients, prepare a corresponding Part 2B Brochure Supplement covering education, business experience, disciplinary history, and contact information.
File Form ADV-W within 30 days of the start date. The Form ADV template includes a new-hire checklist so you capture every required field at onboarding rather than chasing the missing items when the amendment is due.