On December 30, 2009, the US Securities and Exchange Commission (SEC) published its final rule amending certain custody requirements under the Investment Advisers Act of 1940, as amended (Advisers Act) for registered investment advisers (RIAs).1 The SEC indicated in the Adopting Release that the amendments were adopted to enhance the safekeeping of investor assets in the wake of several high-profile fraud cases against investment advisers and broker-dealers. Among other things, the amendments to Rule 206(4)-2 under the Advisers Act (Custody Rule) will require surprise examinations and SAS 70 reports for certain RIAs based on their custody of client assets.2


The Custody Rule provides that an RIA is deemed to have custody of client assets if it, or a related person,3 directly or indirectly holds client funds or has any authority to obtain possession of them. Custody includes, among other things: (i) possession of client assets; (ii) a power of attorney or other arrangement authorizing the RIA to withdraw client assets; and (iii) acting in any capacity that gives the RIA legal ownership of, or access to, client funds or securities, such as status as the general partner or managing member (or any comparable position) of a private fund. The Custody Rule generally provides that it is a fraudulent, deceptive or manipulative practice for an RIA to have custody of client assets unless certain requirements are met.

Qualified Custodians, Account Statements and Notices

Qualified Custodian. The first such requirement is that client assets be held by a “qualified custodian” in a separate account for each client in the client’s name, or in the RIA’s name as agent for the client.4 Shares of registered open-end investment companies held by advisory clients are, and certain types of “privately offered securities” may be, exempt from this requirement.5

Account Statement Delivery. Second, the RIA must have a reasonable basis, after “due inquiry,” for believing that the qualified custodian sends an account statement, at least quarterly, to each advisory client for which the qualified custodian maintains assets.6 For RIAs to private funds that do not annually distribute audited financial statements to their investors (described in further detail below), quarterly account statements must be distributed by the qualified custodian to each investor in the private fund.7

Notice to Clients. Third, for custodial accounts opened by the RIA on behalf of a client, the RIA must notify the client of certain information concerning the custodian, and update the client if the information changes.8 Any account statement sent to the client by the RIA must include a notification urging the client to compare the account statements received from the custodian with those received from the RIA.9

Independent Verification of Client Assets — The “Surprise Examination”

In general, RIAs that have custody of client assets (directly, or through a related person) must undergo an annual surprise examination during which an independent public accountant, pursuant to a written agreement,10 will verify by actual examination all client assets custodied by the RIA (or its related person). This is a significant change from the prior rule.11 For RIAs that are subject to this requirement because the RIA, or its related person, acts as qualified custodian, this independent public accountant must be registered with, and subject to regular inspection by, the Public Company Accounting Oversight Board (PCAOB).

There are three exceptions to the surprise examination requirement. First, the examination requirement does not apply to RIAs that have custody solely because they have the authority to automatically deduct advisory fees from client accounts. Second, this requirement does not apply to RIAs that are “operationally independent” from their related person that acts as qualified custodian for client assets. An RIA may overcome the presumption that it is not “operationally independent” from its related person who has custody only if:

  • No Creditor Access – Client assets in the custody of the related person are not subject to claims of the RIA’s creditors;
  • No Opportunity to Misappropriate – The RIA’s advisory personnel do not have custody or possession of, or direct or indirect access to, client assets of which the related person has custody, or the power to control the disposition of such client assets to third parties for the benefit of the RIA or its related person, or otherwise have the opportunity to misappropriate such assets;
  • No Common Supervision – The RIA’s advisory personnel and personnel of the related person who have access to advisory client assets are not under common supervision;12
  • No Dual-Employment or Shared Premises – The RIA’s advisory personnel do not hold any position with the related person or share premises with the related person; and
  • Catch-All – No other circumstance can reasonably be expected to compromise the operational independence of the related person.13

The amendments also modified Rule 204-2 to require that any RIA relying on the “operationally independent” exemption make and keep a memorandum on file describing the relationship with the related person in connection with the advisory services the RIA provides to clients. The memorandum must also contain an explanation of the RIA’s basis for overcoming the presumption that it is not operationally independent of the related person.

Third, RIAs to private funds that distribute annual audited financial statements to investors within 120 days (180 days in the case of a fund of funds) of the end of the fund’s fiscal year (and promptly after a “liquidation audit,” described below) are exempt from the surprise examination requirement (with respect to their private fund client(s) only) if those annual audited financial statements are prepared in accordance with generally accepted accounting principles by an independent public account registered with, and subject to regular inspection by, the PCAOB. This PCAOB qualification is a new requirement. Distribution of annual audited financial statements also exempts the RIA from distributing quarterly account statements to the private fund (and its investors).

Internal Control Reports

RIAs that act as qualified custodians for advisory clients (or have related persons that act as qualified custodians for the RIA’s advisory clients, regardless of whether the RIA is “operationally independent” from the related person) must obtain (or receive from its related person) a written control report (commonly known in the United States as a “SAS 70”) prepared by an independent public accountant registered with, and subject to regular inspection by, the PCAOB. For example, an RIA that is also a qualified custodian (e.g., an RIA that is a registered broker-dealer) that maintains self-custody of advisory client assets as qualified custodian and an RIA whose related person maintains custody of advisory client assets a qualified custodian would each be required to obtain an internal control report. On the other hand, an RIA with an affiliated broker-dealer that does not act as qualified custodian for any of the RIA’s clients (even if it acts as qualified custodian for other advisers’ advisory clients) would not need to obtain an internal control report. The internal control report must, among other things, set out the opinion of the accountant as to whether controls are in place and suitably designed to safeguard client assets.

Suggested Policies and Procedures

In the Adopting Release, the SEC suggested that RIAs with custody of client assets consider adopting certain policies and procedures, including:

  • Background and credit checks on employees who will have access to client assets over which the RIA or its related person has “custody”;
  • Requiring authorization of more than one employee before the movement of assets within, and withdrawals and transfers from, a client’s custodial account, as well as before changes to account ownership information;
  • Limiting the number of employees who are permitted to interact with qualified custodians with respect to client assets, and rotating the approved employee roster periodically; and
  • If the RIA also serves as a qualified custodian for client assets, segregating duties of its advisory personnel from those of custodial personnel to make it “difficult” for any one person to misuse client assets without being detected.

The SEC also suggested that RIAs with authority to deduct advisory fees directly from client accounts should also consider adopting policies and procedures for, among other things: Periodic testing on a sample basis of fee calculations

  • for client accounts to determine their accuracy;
  • Testing of the overall reasonableness of the amount of fees deducted from all client accounts for a period of time based on the adviser’s aggregate assets under management; and
  • Segregating duties between: (i) the RIA’s personnel responsible for processing billing invoices or listing of fees due from clients that are provided to and used by custodians to deduct fees from clients’ accounts; (ii) the RIA’s personnel responsible for reviewing the invoices and listings for accuracy; and (iii) the RIA’s personnel responsible for reconciling invoices and listings with deposits of advisory fees by the custodians into the RIA’s bank account.

Other Provisions

Form ADV Part 1 Amendments

The Adopting Release also made changes to Form ADV Part 1, some of which are described below:

  • RIAs will be required to list on Schedule D all related persons that are broker-dealers, municipal securities dealers, and government securities brokers or dealers, in addition to related persons that are investment advisers;
  • In Item 9.A(1), RIAs must specify whether they are relying on the “operationally independent” carve-out to avoid answering that they have custody of client assets (for purposes of Form ADV Part 1);
  • In Item 9.A(2) and 9.B(2), RIAs must specify the value of client assets, and the number of clients, over which the RIA or its related persons have custody; In Item 9.C, RIAs must specify if any of the following are true:

1. A qualified custodian sends account statements at least quarterly to investors in private fund(s);

2. An independent public accountant audits annually private fund client(s), and audited financial statements are distributed to investors;

3. An independent public accountant conducts an annual surprise examination of client assets; and

4. An independent public accountant prepares an internal control report with respect to custodial services when the RIA or its related persons are qualified custodians for client assets.

If the RIA responds in the affirmative for items 2, 3 or 4 above, the RIA must identify on Schedule D the accountant(s) engaged to perform the services;

  • In Item 9.D, RIAs must disclose whether the RIA or any related person acts as qualified custodian for the RIA’s clients, and if so, the RIA must disclose any related person qualified custodians on Schedule D; and
  • In Item 9.E, RIAs must specify the date of their last surprise examination, if applicable.

Liquidadation Audit

RIAs to private funds must, in addition to obtaining an annual audit, obtain a final audit of the pool’s financial statements upon liquidation of the fund and distribute the financial statements to fund investors promptly after the completion of the audit. According to the SEC staff, the investors cannot vote to avoid a liquidation audit.

Compliance Dates

The Adopting Release specifies that all RIAs required to undergo a surprise examination must enter into a written agreement with an independent public accountant providing that the first examination will take place no later than December 31, 2010. The Adopting Release further explains that all RIAs required to obtain or receive an internal control report must do so by September 12, 2010. The revised Form ADV responses will be required in the RIA’s next annual amendment after January 1, 2011.

Click here to view Appendix