Outside Compliance Support: What’s the Right Fit for Your Firm?

Compliance needs are not static. A firm may be perfectly well served by its existing compliance structure for years and then find that growth, new products, personnel changes, regulatory developments, or simply an increased workload have changed the equation. In other cases, staffing is not the issue at all. The firm may have a capable internal compliance team but need additional expertise, an independent review, or help with a particular project.

That is why it is useful to distinguish between outsourcing a compliance role and using an outside compliance consultant. They are not the same thing, and a firm does not need to outsource its CCO or FinOp function in order to make meaningful use of outside compliance resources.

Outsourcing or Compliance Consulting?

At DFP Partners, we provide both types of services and can easily transition from one to the other, or provide a combination of both. Outsourcing generally means that one of our professionals serves in a designated role for the firm, most commonly as CCO or FinOp. In that type of engagement, DFP becomes part of the firm's ongoing compliance or financial-regulatory structure.

There are also functions a firm can outsource without outsourcing the CCO role. Registration is a good example. A firm may keep its CCO and compliance structure completely in-house while outsourcing the day-to-day registration function to DFP.

Many of our clients have an in-house CCO, FinOp, supervisors, and compliance personnel and use DFP to perform specific reviews, testing, inspections, or other compliance work. The firm retains its existing structure while adding experience or resources where they are needed. That may mean having DFP conduct a Rule 3120 review, perform branch inspections, review marketing or electronic communications, conduct independent AML testing, or assist with a particular regulatory issue.

Outside compliance support is not an all-or-nothing decision; firms can outsource a designated role, supplement an internal team, or engage help for a specific review or project.

When Does Outside Compliance Support Make Sense?

There is no single answer, but there are some common situations in which firms begin looking for outside help.

One is simply capacity. Compliance departments, especially at small firms, are often lean, and it does not take much for the workload to begin outpacing the resources available to handle it. Required reviews get pushed back, procedures fall behind changes in the business, testing becomes harder to complete on schedule, and regulatory developments compete with day-to-day responsibilities. In those situations, our consultants can add experienced resources without the firm having to expand its staff.

Another is specialized expertise. A new product, business line, regulatory requirement, supervisory issue, or remediation project may involve an area the firm's internal personnel do not deal with regularly. Rather than having someone on the team learn the issue from scratch, it may make more sense to bring in someone who has already worked through it and understands both the regulatory requirements and the practical issues involved in implementing them.

Personnel changes can also be a factor. The departure of a CCO, FinOp, or another experienced compliance professional can create a significant gap, particularly at smaller and mid-sized firms where one person may carry a substantial portion of the compliance workload. Depending on the circumstances, outside support may be temporary, ongoing, or may ultimately take the form of an outsourced CCO or FinOp arrangement.

There is also value in having an independent set of eyes look at the program. The people who operate a compliance program every day are naturally very familiar with it, and that can sometimes make it harder to spot gaps, inconsistencies, or practices that have drifted away from what the firm's procedures say it is doing. An outside review can provide a different perspective before those issues are identified by a regulator.

What Can a Compliance Consultant Actually Do For You?

Consulting engagements can be much broader than simply providing advice. DFP performs a number of compliance functions for broker-dealers and investment advisers without serving as the firm's CCO or FinOp.

Those services include:

ongoing compliance consulting;
full branch office inspections;
FINRA Rule 3120 reviews and supervisory controls testing;
RIA annual compliance reviews under Advisers Act Rule 206(4)-7;
development and implementation of AML programs;
independent AML testing;
mock FINRA and SEC examinations;
development and updating of Written Supervisory Procedures;
Annual Compliance Meeting preparation and delivery;
marketing and advertising reviews;
electronic communications reviews and testing;
regulatory filing and registration support;
outsourced registration services;
FINRA New Membership Applications for new broker-dealers;
SEC and state registration of new investment advisers and Exempt Reporting Adviser filings;
regulatory remediation; and
assistance with new products, business lines, regulatory requirements, and other special projects.

The scope can be narrow or broad. A firm may engage DFP for one required annual review, while many of our clients work with us for years and use us for a number of different compliance functions. None of these consulting services require DFP to serve as the firm's CCO.

Ongoing Compliance Consulting

Not every consulting relationship is built around a formal annual review, examination, or one-time project. For many of our clients, DFP becomes an ongoing part of the firm's compliance process while the firm's own CCO remains firmly in place.

We meet with these clients on a regular basis, usually monthly, although many meet with us more frequently. These meetings give us a chance to work through the smaller compliance matters that can easily accumulate if they are not addressed, while also discussing broader initiatives, changes in the firm's business, and regulatory developments that may have implications down the road. The idea is not simply to react when a problem arises. It is to help the CCO stay ahead of issues and think through how changes in the business or regulatory environment may affect the firm's compliance program.

Over time, that relationship also gives our consultants a much better understanding of the firm's business, its personnel, and the way its compliance program actually operates. That context matters because it allows us to provide advice based on the firm's actual circumstances rather than treating every question as an isolated issue.

Our ongoing clients also use us for many of the specific services discussed below, whether that means updating procedures, conducting an annual review, handling a branch inspection, reviewing a new product, or working through a regulatory development. The value of the ongoing relationship is that we already understand the firm and can look at those issues in the context of the broader compliance program.

Outsourcing the Registration Function

Registration is somewhat different from many of the consulting services discussed here because it is a function that can be outsourced on an ongoing basis without outsourcing the CCO role itself.

DFP can handle the day-to-day registration work for broker-dealers and investment advisers, including Form U4 filings and updates, Form BD and Form ADV amendments, state registrations, renewals, and other related registration matters. The firm's CCO remains in place, while DFP handles the filing and administrative work associated with maintaining the firm's and its personnel's registrations.

For firms without a dedicated registration department, this can remove a substantial amount of recurring administrative work from the CCO and other senior compliance personnel. There is no particular benefit to having a CCO spend significant portions of the day processing routine registration matters if that function can be handled by experienced people who do it regularly.

Branch Office Inspections

Branch inspections are a good example of the difference between consulting and outsourcing. DFP does not need to be a firm's CCO in order to conduct the inspection.

We perform full branch office inspections, including traveling to the office, meeting with branch personnel, reviewing books and records and branch activities, evaluating supervisory and compliance practices, identifying issues that need to be addressed, and documenting the results. We are not simply providing the firm with an inspection checklist or advising someone else on how to perform the review; we conduct the inspection.

Required Annual Reviews and Testing

A number of regulatory requirements lend themselves particularly well to an outside review. For broker-dealers, DFP performs FINRA Rule 3120 reviews and supervisory controls testing. For registered investment advisers, we conduct the annual compliance review required under Advisers Act Rule 206(4)-7.

These reviews help the firm meet an applicable regulatory requirement, but they also provide a useful opportunity to step outside the day-to-day operation of the compliance program and determine whether the firm's policies, procedures, and controls are working as intended.

AML Program Design and Independent Testing

DFP's AML work includes both the design of AML programs and independent testing. We can build a program from the ground up for a new firm, substantially revise an existing program when the firm's business or risk profile has changed, and perform the independent AML testing required of broker-dealers.

An effective AML program should reflect the firm's actual business, customers, products, transaction activity, geographic exposure, and other relevant risks. It should not simply be a generic manual with the firm's name added to the cover. For new broker-dealers in particular, we can develop the AML program as part of the broader compliance infrastructure being put in place during the membership application process.

RIAs are another area where this work can be useful. Although investment advisers are not currently subject to the same AML program requirements as broker-dealers, some firms may decide that having an AML program provides an additional layer of protection appropriate for their business and clients. Others may want to put a framework in place now rather than wait to see what form future AML requirements for investment advisers ultimately take. In either case, DFP can design the program around the adviser's actual business and, where appropriate, conduct subsequent independent testing of that program.

Mock Regulatory Examinations

A regulatory examination is another common reason firms seek outside assistance, although ideally the first serious review of the compliance program does not begin when an examination letter arrives.

DFP conducts mock FINRA and SEC examinations to help firms identify potential issues before the regulators do. Depending on the scope of the review, that may include examining procedures and supporting documentation, testing whether required reviews are actually being performed, comparing written procedures to the firm's actual practices, and identifying areas where the firm may have difficulty demonstrating what it has done.

If an examination is already underway, we can also assist with organizing the response, reviewing requested materials, identifying potential concerns, and helping the firm work through issues as they arise. Firms often find significant value in having us review responses to written information requests to help ensure they are accurate, complete, and actually responsive to what the regulator is asking.

Marketing and Electronic Communications Reviews

Marketing and electronic communications are also areas where a firm can use outside compliance resources while retaining its own CCO and supervisory structure.

DFP can review marketing and advertising materials as part of the firm's communications compliance process and can also perform reviews and testing of electronic communications. These functions can consume a significant amount of compliance time, particularly as the volume of communications grows. Bringing in additional experienced reviewers allows the firm to supplement its existing compliance resources without having to outsource the broader compliance function.

This is another good example of how a CCO can selectively use outside resources. The CCO remains in place and continues to oversee the compliance program, while DFP takes on a specific compliance function where additional capacity or experience is useful.

Setting Up a New Broker-Dealer, RIA, or ERA

Outside compliance support can begin before the firm itself is up and running. DFP works with new broker-dealers and investment advisers from the beginning of the registration process and can manage that process through completion.

For a new broker-dealer, we guide the firm through FINRA's New Membership Application process, including development of the business plan, preparation of Forms BD and NMA and related filings, development of the firm's Written Supervisory Procedures and other required compliance documents, responses to FINRA requests for additional information, and preparation for the FINRA membership interview. The process involves much more than filling out forms. The business plan, supervisory structure, financial arrangements, personnel, procedures, and regulatory filings all need to be consistent with the business the firm is proposing to conduct.

We provide the same type of beginning-to-end assistance for new investment advisers, whether the firm will register with the SEC or one or more states. That includes determining the appropriate registration path, preparing and filing Form ADV, developing the firm's compliance manual and other required policies and documents, and responding to SEC or state regulator questions during the registration process.

Exempt Reporting Advisers are also within our practice. While an ERA is not registered as an investment adviser in the same manner as an RIA, it still has filing and compliance obligations. We assist with the applicable Form ADV reporting process and with putting an appropriate compliance framework in place for the firm's business.

Starting a new regulated firm involves a large number of moving parts, most of which are interconnected. Having one team manage the regulatory process from the beginning helps keep the application, the proposed business, and the compliance program aligned as the firm moves toward launch.

Choosing the Right Approach

The right approach depends on what the firm actually needs. For some firms, outsourcing the CCO or FinOp function makes sense. For others, the internal compliance structure is perfectly sound, but the firm needs additional resources, specialized expertise, an independent review, help with recurring compliance functions, or assistance with a particular requirement.

Those needs can also change over time. A firm may first engage DFP for a Rule 3120 review, later add branch inspections or communications reviews, outsource its registration function, and eventually decide that it makes sense to supplement or outsource a larger portion of its compliance function. Another firm may never need or want an outsourced CCO at all and may use DFP as a consulting resource for years.

At DFP Partners, we provide outsourced CCO and FinOp services, outsourced registration services, assistance establishing new broker-dealers and investment advisers, and compliance consulting for existing firms. The point is not to fit every firm into the same model. It is to determine where outside support is useful and provide the level of assistance that makes sense for that particular firm.