Securities (SEC, FINRA, state)

SEC Federal RIA Examination Deficiency Letter Response

Reference guide. Last verified 2026-07-03. Sources cited below.

The situation

Sarah, 52, is the Chief Compliance Officer of Meridian Wealth Advisors, a federally registered RIA with $340M AUM and 8 employees based in Denver. In January 2026, the SEC sent an exam team for a 5-day examination. In March 2026, Sarah received a deficiency letter with 6 findings: (1) client testimonials on the website lacked required disclosures; (2) Forbes Best-in-State designation used in marketing without required disclosures about selection criteria; (3) hypothetical performance scenarios in a client brochure lacked required prominent disclosures; (4) the RIA's marketing policy hadn't been updated for the 2022 Marketing Rule; (5) cybersecurity incident response plan not updated for June 2024 Reg S-P amendments; (6) no annual Reg S-P review documented. Response due in 30 days.

(a) Marketing Rule deficiency responses have a specific expected structure. Each deficiency needs: (i) acknowledgment that the firm identified the specific practice; (ii) root cause analysis (why did it happen, knowledge gap, process failure, or technical error); (iii) corrective action taken or planned with specific dates; (iv) monitoring control to prevent recurrence. The SEC's staff expect all four components; a response that simply says "we updated the website" invites a follow-up.

(b) The Marketing Rule testimonial deficiency is the most systematically addressable. The required disclosures are specific and codified in Rule 206(4)-1: a "clear and prominent" disclosure of whether the testimonial is from a current client, whether the testimonial is compensated, and whether the testimonial reflects the views of all clients. Sarah can update the website and add disclosures in 48 hours, but the response needs to document the specific disclosure language added and confirm it meets the "clear and prominent" standard.

(c) The Reg S-P cybersecurity deficiency requires a specific response structure. The June 2024 Reg S-P amendments (effective June 3, 2024 for smaller advisers) require: written policies and procedures for the detection, response, and recovery of security incidents; a notification process for notifying customers within 30 days of discovering a breach affecting their sensitive financial information. Sarah's response must describe both what she HAS done and what she WILL do by a specific date.

(d) Her compliance attorney quoted $18,000 for "deficiency letter review, response drafting, and one round of SEC follow-up." Most of the response is templated around known rule requirements.

Who receives this

CCOs (Chief Compliance Officers) and principals of federally registered investment advisers (RIAs with ≥$110M AUM) who received SEC Division of Examinations deficiency letters and need to produce a written remediation response within 30 days. Primary: smaller federally registered RIAs ($110M–$500M AUM) with in-house compliance but without dedicated SEC examination response counsel. Secondary: solo RIA principals who also serve as CCO (no dedicated compliance staff).

Why the agency will not advise you

The SEC's Division of Examinations issued the deficiency letter; its examiners cannot advise the registrant on what an adequate remediation response looks like. Comply.com, SmartRIA, and Pulsio are pre-exam compliance preparation platforms, their products reduce the likelihood of receiving a deficiency letter but don't help draft the response after one arrives. The 30-day response deadline creates an acute payment moment with $10k–$25k attorney alternative.

Key facts, with sources

The SEC's Division of Examinations examines approximately 15% of the ~15,000 federally registered investment advisers per year (~2,250 exams annually). When the exam identifies violations or compliance weaknesses, the Division issues a deficiency letter to the registrant; approximately 65% of all exams result in a deficiency letter. The registrant must respond within 30 days with a written response describing corrective actions. The Division's 2026 Examination Priorities (released November 2025) identified key focus areas: the 2022 Marketing Rule (Advertising Rule) violations (testimonials, endorsements, performance records), AI/technology risk management, vendor and third-party oversight, and Regulation S-P cybersecurity requirements. A December 2025 SEC Risk Alert specifically focused on testimonial and endorsement deficiencies under the Marketing Rule. Source: SEC Releases FY 2026 Examinations Priorities for RIAs and Others — Shulman Rogers · SEC 2026 Examination Priorities for Registered Investment Advisers — Goodwin · SEC Division of Examinations — SEC.gov
SEC deficiency letters describe specific violations of Advisers Act provisions and require the registrant to submit a written response with corrective actions and an implementation timeline. A deficiency letter is not an enforcement action, but inadequate response or evidence of systemic violations can result in an enforcement referral to the SEC's Division of Enforcement. RIA compliance platforms (Comply.com, SmartRIA, Pulsio) focus on pre-exam preparation and ongoing compliance automation; they do not offer a structured deficiency letter response navigator. SEC compliance attorneys charge $10,000–$25,000 per deficiency letter response engagement (source: advertised rates at Brightstar Law Group, Adviser Law, and SEC compliance specialists). Source: How to Prepare for an SEC Exam in 2025: A Step-by-Step Guide — SmartRIA · What is an SEC Exam and What Does it Mean for RIAs? — Brightstar Law · SEC Compliance Requirements for RIAs in 2026 — Stratifi
The SEC's 2022 Marketing Rule (Investment Advisers Act Rule 206(4)-1) is the most active source of RIA deficiency letters in 2024-2026. The rule governs advertisements and marketing materials, including testimonials, endorsements, third-party ratings, and performance advertising. Common deficiencies: (1) client testimonials on the firm's website without required disclosures (whether the testimonial is compensated, whether the client is a current client); (2) third-party ratings (e.g., Forbes Best-in-State Wealth Advisors) without required disclosures about the rating criteria; (3) hypothetical performance presentations without required conditions; (4) endorsements by non-clients without required disclosures. The December 2025 SEC Risk Alert on Marketing Rule deficiencies confirmed these as the dominant deficiency categories in 2025 examinations. Source: SEC Exam Priorities 2026: What RIAs Need to Know and Do Now — Stratifi · SEC Regulation S-P Modernization: June 2026 RIA Deadline Guide — Adviser Law · SEC.gov Resource List: Common Deficiencies — SEC Division of Examinations

When to bring in a professional

Self-serve responses fit routine cases: clear facts, amounts a business can absorb, and a deadline still ahead of you. Bring in a licensed professional when the amount at stake is large relative to their fee, the facts are genuinely disputed, criminal exposure is possible, or the deadline has already passed. A short paid consultation to sanity-check your plan is often worth it even when you handle the filing yourself.

Want a response tool for this notice?

This notice type has a research guide but no interactive builder yet. Leave an email and we will tell you if that changes. Nothing else is ever sent to it.

Related notices

All sources for this guide

This guide is general information compiled from the cited public sources, last verified on the date above. It is not legal advice, and rules change; confirm anything you rely on against the linked source or with a licensed professional in your state.