The SEC’s Custody Rule for Registered Investment Advisors
Organizing the Pieces After the March 12 Amendments
Effective March 12, 2010, the SEC amended Rule 206(4)-2 (the Custody Rule), which governs the custody of client securities and funds by federally registered investment advisors (RIAs). The Custody Rule provides that RIAs that have custody of client funds and securities must use a “qualified custodian” (such as a bank or registered broker-dealer). Under the amended rule, RIAs are now deemed to have custody of client funds or securities that are held by related parties that are qualified custodians. The amended rule also requires RIAs to provide a written notice to clients when they open an account with a qualified custodian on the client’s behalf, requires annual surprise examinations of RIA client accounts by independent auditors, and requires the RIA’s independent auditors to file reports of the results of their inspections with the SEC.
The following discussion seeks to organize and summarize the requirements of the amended Custody Rule in order to assist RIAs in identifying the requirements that apply to their operations.
A. Determining whether an RIA has custody
An RIA has custody of a client’s funds or securities when it directly or indirectly holds them, or when it has authority to obtain possession of them. An RIA is also deemed to have custody if certain persons who are related to the RIA hold client funds or securities or have authority to obtain possession of them. The Custody Rule provides three examples of situations where an RIA would be deemed to have custody:
- If the advisor has possession of client funds or securities.
Note: There are two exceptions: (1) when the advisor holds a check drawn by the client that is payable to a third party or (2) when the advisor inadvertently receives client funds or securities and returns them to the sender promptly, but in any case within three business days of receiving them.
- If there is any arrangement under which the advisor is authorized or permitted to withdraw client funds or securities maintained with a custodian upon the advisor’s instruction to the custodian.
- If the advisor has a capacity under which the advisor or its supervised person has legal ownership or access to client funds or securities.
Note: Such a capacity would generally include an investment adviser who manages a pooled investment vehicle (such as a general partner of a limited partnership, a manager of a limited liability company, or a comparable position) or a trustee of a trust.
B. Requirements that apply to an RIA that has direct custody
The Custody Rule imposes the following requirements on an RIA that has direct custody of client funds or securities through possession or authority to obtain possession of them.
Use of a qualified custodian. The RIA must maintain client funds and securities with a qualified custodian either in a separate account under each client’s name or in accounts that contain only client funds and securities under the RIA’s name as agent or trustee for the clients.
The SEC has identified four kinds of financial institutions as qualified custodians for the purposes of the rule, including:
- Banks (as defined in the Advisers Act) or savings associations that have deposits insured by the FDIC,
- Registered broker-dealers holding customer assets in customer accounts,
- Registered futures commission merchants holding funds, securities futures, or securities incidental to commodity contracts and options, in customer accounts, and
- Foreign financial institutions that customarily hold financial assets for their customers, provided that the institution keeps advisory client assets in customer accounts segregated from its proprietary assets.
Of course, some advisors are themselves institutions that meet the requirements for being qualified custodians, and some advisors have custodial relationships with affiliates that are qualified custodians. If the qualified custodian fulfills the obligations for acting as a qualified custodian, there is no prohibition against these advisory relationships.
Notices to clients. When the RIA opens an account with a qualified custodian on a client’s behalf, the RIA must promptly notify the client in writing concerning the qualified custodian’s name, address, and the manner in which the client’s funds or securities are maintained. The RIA must also provide prompt written notice of any changes in this information. If the RIA sends its own account statements to the clients to which it is required to provide notice, it must include in the notification a statement urging the client to compare the account statements of the custodian with those of the adviser.
Account statements. The RIA must establish that it has a reasonable basis, after due inquiry, for believing that the qualified custodian delivers account statements at least quarterly to each of the RIA’s clients whose funds or securities it maintains. The account statements must:
- Identify the amount of funds and of each security at the end of the period and
- Set forth all transactions in the account during the period.
The RIA can satisfy its obligation to establish a reasonable basis for believing that the qualified custodian is delivering the required account statements by either (a) receiving copies of the account statements sent to each client or (b) receiving a written confirmation from the custodian that the account statements were sent to each client. Providing website access to account statements is not sufficient, because the rule requires that account statements actually be delivered.
With respect to the shares of publicly traded mutual funds, the advisor may use the mutual fund itself or the mutual fund’s transfer agent to act as a qualified custodian and to deliver account statements to clients.
Independent verification/surprise examinations. The RIA must enter into a written agreement providing for verification of the funds and securities in custody with an accountant that meets the independence requirements of SEC rule 201(b) and (c) and that is registered with, and subject to inspection by, the Public Company Accounting Oversight Board (PCAOB) in accordance with its rules. The agreement with the accountant must provide:
Surprise inspections. The accountant will provide annual inspections to verify client funds and securities by actual examination at a time chosen by the accountant without prior notice or announcement to the adviser and that is irregular from year to year.
Timing for first inspection. For RIAs who are subject to the Custody Rule on March 12, 2010, the first examination must occur prior to December 31, 2010, and for RIAs that become subject to the Custody Rule after March 12, 2010, the first examination must occur within six months after the RIA becomes subject to the Custody Rule, and not later than six months after the RIA obtains an internal control report (see below).
Filing of Form ADV-E certificate. The accountant will file with the SEC within 120 days after the inspection a certificate on Form ADV-E stating that the accountant has examined the funds and securities and the nature and extent of the examination.
Notice to the SEC of material discrepancies. If the accountant finds any material discrepancies during the course of the examination, the accountant will notify the SEC within one business day by fax or e-mail followed by first class mail, directed to the Director or the Office of Compliance Inspections and Examinations.
Notice to the SEC of resignation or dismissal. Upon resignation, dismissal, or other termination of the engagement, or upon removing itself or being removed from consideration for being reappointed, the accountant will file within four business days a Form ADV-E that states the date of the action, contact information of the accountant, and an explanation of any problems relating to the scope or procedure of the examination that contributed to the termination.
Internal control reports. The RIA must obtain within six months of gaining custody, and thereafter no less frequently than once each calendar year, a written internal control report from an independent accountant (that is registered with the PCAOB in accordance with its rules, and subject to regular inspection as of the commencement of the professional engagement period and as of each calendar year-end). The report must meet the following requirements:
Controls suitably designed and operating effectively. The internal control report must include the opinion of the accountant as to whether the controls have been placed in operation as of a specific date and are suitably designed and are operating effectively to meet control objectives relating to custodial services, including the safeguarding of funds and securities held on behalf of advisory clients during the year.
Verification and reconciliation. The internal control report must include a verification of client funds and securities and a reconciliation of them to a custodian other than the adviser or related person.
Generally, the SEC has indicated that a Type II SAS 70 report will meet the requirements for an internal control report. Under a separate amendment to the SEC’s rule relating to record keeping by RIAs (Rule 204-2), the SEC requires that the RIA maintain a copy of any internal control reports it receives for five years.
Custody by a dual registered RIA/broker-dealer. Where an RIA is dually registered as a broker-dealer (as distinguished from an RIA that is related to, but not the same entity as, a registered broker-dealer), its RIA operations are subject to the same regulatory regime as other RIAs with direct custody of client assets. This fact has significant implications for the broker-dealer side of the entity’s operations, including (a) being subject to the independent verification and surprise examination requirement and (b) the requirement to file notice of the termination of services of the entity’s accounting firm within four business days, rather than within 15 business days that would apply to a broker-dealer that was not an RIA. Nevertheless, an RIA is not deemed to have custody as an RIA of broker-dealer client funds and securities with respect to which the entity does not provide investment advice.
C. Special requirements that apply in cases of indirect or limited custody
Indirect custody through a related person. The Custody Rule provides that an RIA has custody of any client funds or securities that are directly or indirectly held by a “related person.” A related person is any person directly or indirectly controlling or controlled by the RIA or any person under common control with the RIA. When an RIA has indirect custody of client assets through a related person, all of the same requirements apply that apply in the context of direct RIA custodianship, except that the internal control report requirements apply to the related person rather than to the RIA. If, however, a related person custodian is “operationally independent,” then there is no requirement for independent verification of client funds and securities. Related person custodians are presumed not to be “operationally independent” unless each of the following conditions is met and if no other circumstances can reasonably be expected to compromise the operational independence of the related person:
- Client assets in the custody of the related person must not be subject to the claims of the advisor’s creditors,
- Advisory personnel must not have custody or possession of, or direct or indirect access to, client assets of which the related person has custody, or the power to control the disposition of the client assets to third parties for the benefit of the advisor or its related persons, or otherwise have the opportunity to misappropriate the client assets,
- Advisory personnel and personnel of the related person who have access to advisory client assets must not be under common supervision, and
- Advisory personnel must not hold any position with the related person or share premises with the related person.
If an RIA has a related person qualified custodian whom it treats as operationally independent, under a parallel amendment to the RIA record keeping rule, the RIA must maintain a copy of a memorandum concerning the basis for its determination for five years.
Custody limited to authority to make fee deduction withdrawals. An RIA who has custody of client funds and securities solely through the authority to make withdrawals from client accounts to pay the RIA’s advisory fees from a qualified custodian is not required to obtain independent verification of clients’ funds and securities maintained with the qualified custodian.
Indirect custody through a limited partnership or other pooled investment vehicle. An RIA to a limited partnership or other pooled investment vehicle is not required to comply with the notice and account statement requirements and is deemed to have complied with the requirement for independent verification of funds and securities through surprise examination requirement if:
The entity is subject to audits (as defined in rule 1-02(d) of SEC Regulation S-X),
- At least annually, the entity distributes its audited financial statements prepared in accordance with GAAP to all limited partners (or other beneficial owners) within 120 days of the end of its fiscal year,
- The audits are made by an independent public accountant that is registered with the PCAOB in accordance with its rules and subject to regular inspection as of the commencement of the professional engagement period and as of each calendar year-end, and
- Upon liquidation, the entity distributes its audited financial statements prepared in accordance with GAAP to all limited partners (or other beneficial owners) promptly after the completion of the audit.
D. Special requirements that apply to custody of certain assets
Securities obtained in a private offering. An RIA is not required to keep securities with a qualified custodian if the securities (1) were acquired in a private placement, (2) are uncertificated with ownership recorded only on the books of the issuer or its transfer agent in the name of the client, and (3) are transferable only with the prior consent of the issuer or holders of the outstanding securities of the issuer.
Note: This exemption from maintaining certain securities obtained in private placements with a qualified custodian does not exempt the RIA from sending required notices and account statements or from compliance with independent verification and surprise examination requirements unless the RIA complies with the audit and distribution of audited financial statement requirements described in section C. above.
Indirect custody through a registered investment company. An RIA is not required to comply with the Custody Rule with respect to the account of an investment company that is registered under the Investment Company Act of 1940.
E. Related amendments to Forms ADV and ADV-E
The SEC made parallel amendments to the Form ADV to provide enhanced disclosure obligations concerning RIA custodial arrangements. These requirements include disclosure of related parties and whether they serve as custodians (Item 7); disclosure of the amount of funds and securities and number of clients that the RIA or its related parties act as custodian for and the RIA’s relationship with pooled investment vehicles (Item 9); and identification and PCAOB qualification information concerning the RIA’s auditors. The SEC also adopted amendments to Form ADV-E with respect to filing reports of certification of examination within 120 days and termination of engagement within four business days.
F. SEC guidance regarding the Custody Rule
The SEC release that announced the adoption of the amendments to the Custody Rule (Rel. IA- 2968) contains guidance on the types of policies and procedures that RIAs should maintain in their internal compliance policies if they maintain custody of client assets. The SEC also published a companion release to the Custody Rule amendments (Rel. IA-2969, Commission Guidance Regarding Independent Engagements Performed Pursuant to Rule 206(4)-2 Under the Investment Advisers Act of 1940), which focuses primarily on objectives and procedures to be followed by independent accountants in conducting surprise examinations under the rule but which also provides guidance on internal control report objectives and appropriate controls to be provided for by the custodian. Subsequently, the SEC released a FAQ updated through March 15, 2010, concerning staff responses to questions about the Custody Rule, which provided responses to a number of technical questions concerning the application of the rule.
The foregoing discussion is only a general statement of the principal provisions of Rule 206(4)-2 on the date of this article and is not intended to exhaustively review all aspects of that rule or the manner in which it may apply in certain circumstances. The statements made may be inappropriate to your particular circumstances, and they should not be construed as legal advice or an opinion as to any matter.