Annual Compliance Review: Requirements, Recordkeeping, and Penalties

An annual compliance review is a documented internal test of whether your written policies and procedures are actually preventing violations of the laws that govern your industry. For SEC-registered investment advisers, FINRA-regulated broker-dealers, public companies, and HIPAA-covered healthcare organizations, federal rules make some version of this review mandatory each year. Skipping it, or doing it so lightly that nothing gets tested, can cost you six-figure fines, suspended registration, and in serious cases a court-ordered monitor at your expense.

Who Has to Do One

The obligation depends on what kind of entity you are and which regulator oversees you.

Investment Advisers

SEC-registered advisers fall under Rule 206(4)-7 of the Investment Advisers Act of 1940. The rule requires written compliance policies, a designated chief compliance officer who is a supervised person, and a review of those policies no less than annually to evaluate whether they are effectively preventing violations of federal securities law.¹²

Broker-Dealers

Broker-dealers answer to two FINRA rules working together. Rule 3120 requires designated principals to maintain and test a supervisory control system and submit a report to senior management at least annually summarizing the testing and any changes made.³ Rule 3130 requires a designated chief compliance officer and an annual CEO certification that the firm has processes to establish, review, test, and modify its compliance and supervisory procedures.⁴ Firms that handle customer accounts also owe independent testing of their anti-money laundering program on a calendar-year basis under Rule 3310; firms that don’t carry customer accounts or execute customer transactions can test every two years.⁵

Public Companies

Section 404 of the Sarbanes-Oxley Act requires management of a publicly traded company to assess the effectiveness of its internal controls over financial reporting each year and include that assessment in the company’s annual report, with an independent auditor attestation.⁶ Non-accelerated filers, generally smaller reporting companies with a public float under $75 million, are exempt from the external auditor attestation under Section 404(b).⁷ Since 2023, annual filings must also describe how the company assesses and manages cybersecurity risk, including board oversight and management’s role.⁸

Healthcare Organizations

Covered entities and business associates under the HIPAA Security Rule must maintain safeguards for electronic protected health information and conduct periodic technical and nontechnical evaluations of how well their security policies meet regulatory requirements, especially after operational or environmental changes.⁹¹⁰ The rule says “periodic” rather than “annual,” but most compliance programs run it yearly because the underlying risk analysis has to be updated whenever systems change.

Deadlines You Can’t Miss

Investment advisers file an annual updating amendment to Form ADV within 90 days after their fiscal year ends. For a calendar-year firm, that’s March 31. The SEC examination staff lists late Form ADV amendments among the most common compliance failures it finds.¹¹ Finish the underlying policy review before that filing, so any issues can shape the updated disclosures.

Broker-dealers must deliver the Rule 3120 supervisory control report to senior management at least annually.¹² The Rule 3130 CEO certification is due by the anniversary of the previous year’s certification; a new FINRA member firm has one year from joining to complete its first. The Rule 3130 report must reach the board or audit committee within 45 days after the CEO signs the certification.⁴

What the Review Actually Has to Cover

The SEC has been explicit that a review which simply restates the manual’s contents without testing anything is treated the same as no review at all. The point is to confirm that your policies are adequate for the business you actually run, and that people are actually following them.

Start with the written manual. Does it reflect your current investment strategies, fee structures, client types, and personnel? Examiners regularly catch firms using generic off-the-shelf manuals that describe strategies the firm abandoned years ago or reference staff who have left.¹¹

From there, the review should look at:

Employee trading logs and gift or entertainment disclosures that might surface conflicts of interest.
Marketing materials, social media posts, and client presentations used during the period, checked for accuracy and required disclosures.
Prior audit and examination findings, with evidence that deficiencies were corrected.
Customer complaints and their resolutions.
Training records showing employees completed required compliance training.
Cybersecurity incident logs and the firm’s response.

For healthcare organizations, the focus shifts to the risk analysis itself, access logs for electronic health records, breach notification records, and business associate agreements. The HIPAA Security Rule requires a thorough assessment of risks and vulnerabilities, and the annual review should confirm the safeguards flowing from that analysis are still appropriate given current systems.¹³

Where the Review Goes

Most annual compliance reviews are not filed anywhere. They stay inside the firm, and the regulator asks for them during an examination.

Investment advisers keep the Rule 206(4)-7 review documentation internally. The Form ADV annual amendment, which is a separate filing, goes through the Investment Adviser Registration Depository.¹⁴

Broker-dealer Rule 3120 reports go to the firm’s own senior management, not to FINRA.³ The Rule 3130 certification and report go to the board of directors and audit committee.⁴ FINRA can request either during an examination, so both have to be organized and retrievable.

Public companies file their annual internal control assessments as part of their 10-K through EDGAR.⁶ Healthcare providers keep HIPAA documentation internally but have to produce it on demand during an Office for Civil Rights investigation.

What Examiners Flag Most Often

SEC risk alerts show the same patterns year after year. The biggest category is manuals that don’t match the business, including firms running one strategy using a template written for another. Right behind that is the review that happens on paper but never actually tests anything.

Other recurring findings include inaccurate Form ADV disclosures, such as misstated assets under management or missing disciplinary history, and late Form ADV amendments. The SEC also flags firms that identify a problem during the annual review, document it in the report, and then do nothing about it. A gap you noted a year ago and still have is treated as worse than one you never spotted.¹¹

How Long to Keep the Records

SEC-registered advisers must retain compliance-related books and records for at least five years from the end of the fiscal year of the last entry, with the first two years in an accessible office of the adviser. Codes of ethics and related acknowledgments from supervised persons are also kept for five years.¹⁵

HIPAA retention runs longer. The Security Rule requires compliance documentation to be kept for six years from the date it was created or last in effect, whichever is later. That covers privacy policies, training records, breach documentation, business associate agreements, and complaint logs.¹⁶

Penalties If You Skip It or Botch It

The SEC can censure an investment adviser, suspend its registration for up to 12 months, revoke registration entirely, or bar an individual from the industry.¹⁷ Civil monetary penalties follow a three-tier structure. For an entity, first-tier penalties reach roughly $118,000 per violation, second-tier penalties involving fraud or reckless disregard of a regulatory requirement reach about $591,000 per violation, and third-tier penalties where the violation caused substantial losses can exceed $1.18 million per violation. These are the 2025 inflation-adjusted figures, which remain in effect for 2026.¹⁸

In September 2025, the SEC charged Meridian Financial, LLC with violating Rule 206(4)-7 for failing to conduct an annual compliance review and failing to implement its own written procedures. The firm was censured, ordered to cease and desist, and agreed to pay a $75,000 civil penalty along with undertakings to correct the failures.¹⁹ That sits at the lighter end. Broader or longer-running failures draw penalties well into six figures, and in fraud cases the per-violation maximums stack quickly. The SEC can also require a firm to hire an independent compliance consultant at its own expense, typically for nine months to two years, with written reports going to both firm leadership and SEC staff.

HIPAA uses a four-tier penalty structure based on the violator’s level of awareness:

No knowledge of the violation: $100 to $50,000 per violation, up to $25,000 per year for identical violations.
Reasonable cause: $1,000 to $50,000 per violation, up to $100,000 per year.
Willful neglect, corrected within 30 days: $10,000 to $50,000 per violation, up to $250,000 per year.
Willful neglect, not corrected: $50,000 per violation, up to $1,500,000 per year.

These are the base statutory amounts established by the HITECH Act and are subject to periodic inflation adjustments.²⁰ A provider that skips periodic security evaluations entirely sits in the willful-neglect tiers, where the annual cap reaches $1.5 million per type of violation.

Across every sector, the sanction that tends to matter most is not the fine. The SEC can suspend an adviser’s registration for up to a year or revoke it permanently, and bar individuals from associating with any adviser, broker-dealer, or other regulated entity.¹⁷ FINRA has parallel authority over broker-dealer firms and their associated persons. Losing the registration that lets you operate is the outcome worth building the review to avoid.

1
eCFR. 17 CFR 275.206(4)-7 – Compliance Procedures and Practices
2
U.S. Securities and Exchange Commission. Compliance Programs of Investment Companies and Investment Advisers
3
FINRA. FINRA Rule 3120 – Supervisory Control System
4
FINRA. FINRA Rule 3130 – Annual Certification of Compliance and Supervisory Processes
5
FINRA. FINRA Rule 3310 – Anti-Money Laundering Compliance Program
6
U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports
7
U.S. Securities and Exchange Commission. Smaller Reporting Companies
8
U.S. Securities and Exchange Commission. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
9
U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule
10
eCFR. 45 CFR 164.308 – Administrative Safeguards
11
U.S. Securities and Exchange Commission. Risk Alert – The Five Most Frequent Compliance Topics Identified in Examinations
12
FINRA. Supervision Frequently Asked Questions
13
U.S. Department of Health and Human Services. Guidance on Risk Analysis
14
Investment Adviser Registration Depository. Investment Adviser Registration Depository
15
eCFR. 17 CFR 275.204-2 – Books and Records to Be Maintained by Investment Advisers
16
eCFR. 45 CFR 164.316 – Policies and Procedures and Documentation Requirements
17
Office of the Law Revision Counsel. 15 USC 80b-3 – Registration of Investment Advisers
18
Federal Register. Adjustments to Civil Monetary Penalty Amounts
19
U.S. Securities and Exchange Commission. SEC Charges Massachusetts-Based Investment Adviser
20
Federal Register. Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties