Outsourcing by Investment Advisers

Federal RegisterNov 16, 2022

Ask Donna

What actually matters in this document.

Text

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 275, and 279

[Release Nos. IA-6176; File No. S7-25-22]

RIN 3235-AN18

Outsourcing by Investment Advisers

AGENCY:

Securities and Exchange Commission.

ACTION:

Proposed rule.

SUMMARY:

The Securities and Exchange Commission (“Commission” or “SEC”) is proposing a new rule under the Investment Advisers Act of 1940 (“Advisers Act”) to prohibit registered investment advisers (“advisers”) from outsourcing certain services or functions without first meeting minimum requirements. The proposed rule would require advisers to conduct due diligence prior to engaging a service provider to perform certain services or functions. It would further require advisers to periodically monitor the performance and reassess the retention of the service provider in accordance with due diligence requirements to reasonably determine that it is appropriate to continue to outsource those services or functions to that service provider. We also are proposing corresponding amendments to the investment adviser registration form to collect census-type information about the service providers defined in the proposed rule. In addition, we are proposing related amendments to the Advisers Act books and records rule, including a new provision requiring advisers that rely on a third party to make and/or keep books and records to conduct due diligence and monitoring of that third party and obtain certain reasonable assurances that the third party will meet certain standards.

DATES:

Comments should be received on or before December 27, 2022.

ADDRESSES:

Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's internet comment form (

http://www.sec.gov/rules/submitcomments.htm

); or

• Send an email to

rule-comments@sec.gov.

Please include File Number S7-25-22 on the subject line.

Paper Comments

• Send paper comments to Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090.

All submissions should refer to File Number S7-25-22. The file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method of submission. The Commission will post all comments on the Commission's website (

http://www.sec.gov/rules/proposed.shtml

). Comments are also available for website viewing and printing in the Commission's Public Reference Room, 100 F Street NE, Washington, DC 20549, on official business days between the hours of 10 a.m. and 3 p.m. Operating conditions may limit access to the Commission's Public Reference Room. All comments received will be posted without change. Persons submitting comments are cautioned that the Commission does not edit personal identifying information from submissions. You should submit only information that you wish to make available publicly.

Studies, memoranda, or other substantive items may be added by the Commission or staff to the comment file during this rulemaking. A notification of the inclusion in the comment file of any such materials will be made available on the Commission's website. To ensure direct electronic receipt of such notifications, sign up through the “Stay Connected” option at

www.sec.gov

to receive notifications by email.

FOR FURTHER INFORMATION CONTACT:

Christopher Chase, Senior Counsel; Christian Corkery, Senior Counsel; Juliet Han, Senior Counsel; Mark Stewart, Senior Counsel; Jennifer Porter, Senior Special Counsel; Holly Miller, Senior Financial Analyst; Melissa Roverts Harke, Assistant Director, Investment Adviser Regulation Office, Division of Investment Management, at (202) 551-6787, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-8549.

SUPPLEMENTARY INFORMATION:

The Commission is proposing for public comment 17 CFR 275.206(4)-11 (“proposed rule 206(4)-11”) under the Advisers Act [15 U.S.C. 80b-1

et seq.

]; and amendments to 17 CFR 275.204-2 (rule 204-2) and Form ADV [17 CFR 279.1] under the Advisers Act.

Unless otherwise noted, when we refer to the Advisers Act, we are referring to 15 U.S.C. 80b, and when we refer to rules under the Advisers Act, we are referring to title 17, part 275 of the Code of Federal Regulations [17 CFR 275]. In addition, unless otherwise noted, when we refer to the Investment Company Act, we are referring to 15 U.S.C. 80a.

Table of Contents

I. Introduction

A. Background

B. Overview of Rule Proposal

II. Discussion

A. Scope

1. Covered Function

2. Service Provider

3. Recordkeeping of Covered Functions

B. Due Diligence

1. Nature and Scope of Covered Function

2. Risk Analysis, Mitigation, and Management

3. Competence, Capacity, Resources

4. Subcontracting Arrangements

5. Compliance Coordination

6. Orderly Termination

7. Recordkeeping Provisions Related to Due Diligence

C. Monitoring

1. Recordkeeping Provisions Related to Monitoring

D. Form ADV

E. Third-Party Recordkeeping

F. Existing Staff No-Action Letters and Staff Statements

G. Transition and Compliance

III. Economic Analysis

A. Introduction

B. Baseline

1. Affected Parties

2. Adviser Use of Service Providers

3. Applicable Law Impacting Use of Service Providers

C. Broad Economic Considerations

D. Benefits and Costs

1. Due Diligence

2. Monitoring

3. Recordkeeping

4. Form ADV

E. Effects on Efficiency, Competition, and Capital Formation

1. Efficiency

2. Competition

3. Capital Formation

F. Reasonable Alternatives

1. Alternatives to the Proposed Scope

2. Alternatives to the Proposed Due Diligence and Monitoring Requirements

3. Alternatives to the Proposed Amendments to the Books and Records Rule

4. Alternatives to the Form ADV Requirements

5. Alternatives to the Transition and Compliance Period

G. Request for Comment

IV. Paperwork Reduction Act Analysis

A. Introduction

B. Rule 204-2

C. Form ADV

D. Request for Comment

V. Initial Regulatory Flexibility Act Analysis

A. Reason For and Objectives of the Proposed Action

1. Proposed Rule 206(4)-11

2. Proposed Amendments to Rule 204-2

3. Proposed Amendments to Form ADV

B. Legal Basis

C. Small Entities Subject to the Rules and Rule Amendments

1. Small Entities Subject to Proposed Rule 206(4)-11 and Proposed Amendments to Rule 204-2 and Form ADV

D. Projected Reporting, Recordkeeping and Other Compliance Requirements

1. Proposed Rule 206(4)-11

2. Proposed Amendments to Rule 204-2

3. Proposed Amendments to Form ADV

E. Duplicative, Overlapping, or Conflicting Federal Rules

1. Proposed Rule 206(4)-11

2. Proposed Amendments to Rule 204-2

3. Proposed Amendments to Form ADV

F. Significant Alternatives

1. Proposed Rules 206(4)-11 and 204-2

2. Proposed Amendments to Form ADV

G. Solicitation of Comments

VI. Consideration of Impact on the Economy

VII. Statutory Authority

I. Introduction

A. Background

The asset management industry has evolved greatly since Congress adopted the Investment Advisers Act of 1940 (“Advisers Act” or “Act”). For instance, many advisers now seek to provide full service wealth management and financial planning (

e.g.,

tax, retirement, estate, education, and insurance), and they use electronic systems to provide those services and keep their records.

Clients and investors also are seeking to invest in types of securities and other assets that were not commonly traded or did not exist at that time, including, for example, derivatives and exchange-traded funds.

At the same time, fee pressures for advisers have increased.

As a result, advisers are under pressure to meet evolving and increasingly complex client demands in a cost-effective way.

The demand for advisory services has grown as well.

For example, regulatory assets under management (“RAUM”) have increased from $47 trillion to $128 trillion over the past 10 years; while RAUM managed for non-high net worth advisory clients have increased from approximately $3.7 trillion to approximately $7 trillion.

See Financial Advisers Now Help with College Plans, Family Counseling, Cremains,

The Wall Street Journal (Aug. 23, 2019),

available at https://www.wsj.com/articles/financial-advisers-now-help-with-college-plans-family-counseling-cremains-11566558002;

Beyond Finances: Holistic Life Planning Trends Among Advisors,

Investment News (2020),

available at https://www.investmentnews.com/beyond-finances-holistic-life-planning-trends-among-advisors.

See Young, Confident, Digitally Connected—Meet America's New Day Traders,

Reuters (Feb. 2, 2021),

available at https://www.reuters.com/article/us-retail-trading-investors-age/young-confident-digitally-connected-meet-americas-new-day-traders-idUSKBN2A21GW;

College Students Are Buying Stocks—But Do They Know What They're Doing?,

CNBC (Aug. 4, 2020),

available at https://www.cnbc.com/2020/08/04/college-students-are-buying-stocks-but-do-they-know-what-theyre-doing.html.

See, e.g., Adviser Industry Fee Pressures in Focus,

Planadviser (Feb. 4, 2022),

available at https://www.planadviser.com/exclusives/adviser-industry-fee-pressures-focus/

(stating that fee compression has impacted adviser revenue models in recent years due to increasing automation, stiffer competition and ongoing industry consolidation);

CaseyQuirk Remarks and Discussion,

U.S. Securities and Exchange Commission Asset Management Advisory Committee (Jan. 14, 2020),

available at https://www.sec.gov/files/BenPhillips-CaseyQuirk-Deloitte.pdf

(stating that buyers are becoming more fee-sensitive and showing an annualized reduction in global effective fees between 2015 and 2018).

A recent survey indicated that advisers are reducing their own expenses in response to fee compression, with 52% of surveyed respondents planning to reduce expense ratios on some products.

C-Suite Asset Management Survey,

Brown Brothers Harriman & Co. (2020), at 6 (“C-Suite Asset Management Survey”),

available at https://www.bbh.com/content/dam/bbh/external/www/investor-services/insights/c-suite-asset-manager-survey/C-Suite%20Asset%20Manager%20Survey%20PDF_data.pdf

(finding more than half of respondent asset managers are planning to reduce expense ratios or fees in the following year).

See also Fees Were Already Under Pressure. Then the Pandemic Hit,

Institutional Investor (Dec. 8, 2020),

available at https://www.institutionalinvestor.com/article/b1plj6z9wsv5nf/Fees-Were-Already-Under-Pressure-Then-the-Pandemic-Hit.

See AWM: From `A Brave New World' to a New Normal,

PwC (2020), at 6,

available at https://www.pwc.lu/en/asset-management/awm-from-a-brave-new-world-to-a-new-normal.html

(calculating worldwide assets under management in 2019 as $110.9 trillion, including a 9% compound annual growth rate since 2015).

Registered investment advisers report $7.096 trillion in RAUM for non-high net worth advisory clients, based on analysis of data reported on Form ADV through the Investment Adviser Registration Depository (IARD) system as of April 30, 2022. The data consists of assets that are reported by both advisers and sub-advisers, including mutual fund and ETF assets. Prior to the October 2017 changes to Form ADV, clients and client RAUM were estimated based on the midpoint of ranges reported.

Many advisers are adapting to the changes discussed above by engaging service providers to perform certain functions (“outsourcing”).

In some cases, service providers may support the investment adviser's advisory services and processes. Supporting functions may include, for example, investment research and data analytics, trading and risk management, and compliance. In other cases, advisers hire service providers to perform or assist with functions that support middle- and back-office functions essential to asset management (

e.g.,

collateral management, settlement services, pricing or valuation services, and performance measurement). Additionally, investment advisers have engaged service providers to perform activities that form a central part of their advisory services.

Advisers increasingly have engaged index providers to develop bespoke indexes that an adviser may replicate or track in portfolios for its clients, advisers engage subadvisers to manage some or all of a client's portfolio, and advisers use third parties to provide technology platforms for offering robo-advisory services.

See, e.g., The Race to Scalability 2020: Current Insights from a Decade of Advisor Research on Investment Management Trends,

Flexshares (2020),

available at https://go.flexshares.com/outsourcing;

Christopher Newman,

Asset Managers Continue to Outsource Middle Office Functions,

EisnerAmper (Oct. 21, 2020),

available at https://www.eisneramper.com/asset-managers-outsource-ai-blog-1020/.

See Smart Outsourcing Can Be a Game-Changer for RIAs,

ThinkAdvisor (Mar. 18, 2021),

available at https://www.thinkadvisor.com/2021/03/18/smart-outsourcing-can-be-a-game-changer-for-rias/

(describing benefits to registered investment advisers of using service providers, including outsourcing management of individual portfolios and possibility of “keep[ing] some core functions in-house and outsourc[ing] others”).

Service providers may give the adviser or the adviser's clients access to certain specializations or areas of expertise, reduce risks of keeping a function in-house that the adviser is not equipped to perform, or otherwise offer efficiencies that are unavailable to or unachievable by an adviser alone. Use of service providers can provide staffing flexibility by reducing the burdens on advisers' existing personnel and may mitigate the need to hire new personnel (which generally entails hiring and onboarding costs in addition to salaries and benefits). This flexibility may be particularly useful for services that the adviser uses on a periodic or ad hoc basis but may not need or wish to dedicate permanent staffing. Advisers with few personnel in particular may find benefits by allowing service providers to handle tasks that would otherwise be time-consuming or costly given the lack of economies of scale. Engaging a service provider also may prove efficient because it allows an adviser to allocate specific duties to a single service provider, rather than relying on multiple internal personnel to complete a function. Clients also can benefit from outsourcing, including through better quality of service, lower fees (if the adviser passes along any cost savings), or some combination.

There is a risk that clients could be significantly harmed, however, when an adviser outsources to a service provider a function that is necessary for the provision of advisory services without appropriate adviser oversight. The risk is in addition to any risks that would exist from the adviser providing these functions and should be managed. For example, a significant disruption or interruption to an adviser's outsourced services could affect an adviser's ability to provide its services to its clients. Outsourcing a service also presents a conflict of interest between an adviser providing a sufficient amount of oversight versus the costs of providing that oversight or the cost of the adviser providing the function itself. Poor oversight could lead to financial losses for the adviser's clients, including through market losses and as a result of

increased transaction costs or the loss of investment opportunities. Excessive oversight can result in costs to the adviser, and potentially its clients, that outweigh the intended benefits. Outsourcing also has the potential to defraud, mislead or deceive clients. For example, outsourcing necessary advisory functions could have a material negative impact on clients, such as: inaccurate pricing and performance information that advisory clients rely on to make decisions about hiring and retaining the adviser and that advisers rely on to calculate advisory fees;

compliance gaps that enable fraudulent, deceptive or manipulative activity by employees and agents of such service providers to occur or continue unaddressed;

or poor operational management or risk measurement that leads to client losses. A service provider's major technical difficulties could prevent the adviser from executing an investment strategy or accessing an account. Additionally, sensitive client information and data could be lost

and used to the client's detriment, or client holdings or trade order information could be negligently maintained by a service provider and misused by the service provider's employees or other market participants in trading ahead or front-running activities. Clients also may be harmed when a service provider has significant operations in a single geographic region because weather events, power outages, geopolitical events and public health events in that location raises concerns that the service provider can continue to perform its functions during these events.

See

Armental, Maria,

BNY Mellon to Pay $3 Million to Resolve Massachusetts Probe Over Glitch,

The Wall Street Journal (Mar. 21, 2016),

available at https://www.wsj.com/articles/bny-mellon-to-pay-3-million-to-resolve-massachusetts-probe-over-glitch-1458581998.

See

In the Matter of Aegis Capital, LLC, Investment Advisers Release No. 4054 (Mar. 30, 2015) (settled order) (failures of an outsourced Chief Compliance Officer and the adviser's Chief Operating Officer resulted in Form ADV filings that grossly overstated the registrant's AUM and total number of clients).

See

Tokar, Dylan

et. al., Fund Administrator of Fortress, Pimco and Others Suffers Data Breach Through Vendor,

The Wall Street Journal (Jul. 27, 2020),

available at https://www.wsj.com/articles/fund-administrator-for-fortress-pimco-and-others-suffers-data-breach-through-vendor-11595857765.

Risks related to a service provider's conflicts of interests also may cause harm to an adviser's clients. There may be conflict of interest risks when a service provider recommends or otherwise highlights investments to advisory clients that the service provider also owns or manages for others. In that circumstance, the service provider has an incentive to influence investing behavior in a way that benefits the service provider to the detriment of the adviser's clients. For example, an index provider that holds an investment it subsequently adds to its widely followed index has a conflict of interest because it would directly benefit from creating or increasing demand for that investment and clients could be harmed if the investment does not perform as well as other investments the index provider could have added instead.

The risks of harm may be particularly pronounced where services that are necessary for the provision of advisory services are highly technical or proprietary to the service provider, or where the services require expertise or data the adviser lacks. For example, if an adviser engages a service provider that uses proprietary technology to measure portfolio risk or performance of client investments, the adviser likely would not be able to replicate such measurements for its clients. If such technology fails to provide accurate measurements, it would be difficult for the adviser to detect such issues and manage the portfolios or report performance for its clients without the adviser having a plan in place for managing and mitigating the risks of such a failure. The risks of harm are also heightened where the service provider has further outsourced one or more necessary functions to another service provider (possibly without the adviser's awareness or influence), or where the service provider delivers some services from locations outside of the United States, which introduces potential oversight and regulatory gaps or oversight challenges. In each of these cases, the disruption, interruption, or failures in the service provider's services could affect the ability of every adviser using that service provider to deliver advisory services to its clients or otherwise meet its obligations, including under the Advisers Act or other Federal securities laws.

The use of service providers could create broader market-wide effects or systemic risks as well, particularly where the failure of a single service provider would cause operational failures at multiple advisers.

For example, there could be concentration risks to the extent that one service provider supplies several services to an adviser or multiple service providers merge to become a single market leader. Multiple regulated entities could use a common service provider,

particularly because service providers have become more specialized in recent years,

and for certain functions there may be only a few entities offering relevant (often information technology-dependent) services. If a large number of investment advisers and their clients use a common service provider, operational risks could be correspondingly concentrated, which could, in turn, lead to an increased risk of broader market effects during times of market instability. One example where the failure of a service provider had a broad impact occurred when a corrupted software update to accounting systems at a widely used fund accounting provider caused industry-wide concern over the accuracy of fund values for several days.

An estimated 66 advisers and 1,200 funds were unable to obtain system-generated net asset values (“NAVs”) for several days, suggesting that an error in a system used by many advisers could disrupt entire markets.

See, e.g.,

The International Organization of Securities Commissions (“IOSCO”) FR07/2021,

Principles on Outsourcing: Final Report

(Oct. 2021), (“IOSCO Report”),

available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD687.pdf.

The IOSCO Report cites examples of risks that could lead to systemic risk if multiple entities use a common service provider including: (1) if the service provider suddenly and unexpectedly becomes unable to perform services that are material or critical to the business of a significant number of regulated entities, each entity will be similarly disabled, (2) a latent flaw in the design of a product or service that multiple regulated entities rely upon may affect all these users, (3) a vulnerability in application software that multiple regulated entities rely upon may permit an intruder to disable or corrupt the systems or data of some or all users, and (4) if multiple regulated entities depend upon the same provider of business continuity services (

e.g.,

a common disaster recovery site), a disruption that affects a large number of those entities may reduce the capacity of the business continuity service.

Financial Stability Board,

Regulatory and Supervisory Issues Relating to Outsourcing Third Party Relationships: Discussion Paper

(Nov. 9, 2020), at 2 (“FSB Discussion Paper”),

available at https://www.fsb.org/wp-content/uploads/P091120.pdf

The IOSCO Report,

supra

footnote 13.

See

Armental, Maria,

BNY Mellon to Pay $3 Million to Resolve Massachusetts Probe Over Glitch,

The Wall Street Journal (Mar. 21, 2016),

available at https://www.wsj.com/articles/bny-mellon-to-pay-3-million-to-resolve-massachusetts-probe-over-glitch-1458581998.

See id. See also,

e.g., BlackRock: The monolith and the markets,

The Economist (Dec. 7, 2013),

available at https://www.economist.com/briefing/2013/12/07/the-monolith-and-the-markets

(stating that 7% of the world's $225 trillion of financial assets were supported by the same system and stating, “If that much money is being managed by people who all think with the same tools, it may be managed by people all predisposed to the same mistakes.”); IOSCO FR06/22,

Operational resilience of trading venues and market intermediaries during the COVID-19 pandemic & lessons for future disruptions: Final Report,

at 23 (July 2022),

available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD706.pdf

(stating that disruption of outsourced services could lead to losses, such as clients unable to access accounts or have orders executed during market volatility).

Our observations underscore the risks associated with advisers outsourcing functions to service providers. We have observed an increase in such outsourcing and issues related to the outsourcing and advisers' oversight. One recent example is an enforcement action for alleged violations of section 206 of the Advisers Act against investment advisers that used models and volatility guidelines from a third-party subadviser without first confirming that they worked as intended.

In another recent action, an adviser allegedly failed to oversee a third-party vendor that did not properly safeguard customers' personal identifying information.

Additionally, we are troubled that the Commission staff have observed some advisers unable to provide timely responses to examination and enforcement requests because of outsourcing. In response to our staff's requests for documents, some advisers have not provided the information necessary to demonstrate compliance with the Advisers Act and its rules because of outsourcing. For example, some advisers that use client relationship management providers have asserted that they have complied with rule 204-3 because brochure delivery is programmed into the providers' software, though they cannot produce records to evidence that delivery took place.

See

In the Matter of Aegon USA Investment Management, LLC, et al, Investment Advisers Act Release No. 4996 (Aug. 27, 2018) (settled order).

See

Morgan Stanley Smith Barney LLC, Investment Advisers Act Release No. 6138 (Sept. 20, 2022) (settled order).

See

17 CFR 275.204-3

These observations illustrate that despite the existing legal framework regarding the duties and obligations of investment advisers, more needs to be done to protect clients and enhance oversight of advisers' outsourced functions. An adviser has a fiduciary duty to its clients. The Advisers Act establishes a federal fiduciary duty for investment advisers that comprises a duty of loyalty and a duty of care and is made enforceable by the antifraud provisions of the Advisers Act.

This combination of obligations has been characterized as requiring the investment adviser to act in the best interests of its client at all times.

See Transamerica Mortgage Advisors, Inc.

Lewis,

444 U.S. 11, 17 (1979) (“§ 206 establishes federal fiduciary standards to govern the conduct of investment advisers.”) (quotation marks omitted);

SEC

Capital Gains Research Bureau, Inc.,

375 U.S. 180, 191 (1963); Commission Interpretation Regarding Standard of Conduct for Investment Advisers, Investment Advisers Act Release No. 5248 (June 5, 2019), at 6-8 [84 FR 33669 (July 12, 2019)] (“Standard of Conduct Release”).

See SEC

Tambone,

550 F.3d 106, 146 (1st Cir. 2008) (“Section 206 imposes a fiduciary duty on investment advisers to act at all times in the best interest of the fund . . .”);

SEC

Moran,

944 F. Supp. 286, 297 (S.D.N.Y 1996) (“Investment advisers are entrusted with the responsibility and duty to act in the best interest of their clients.”).

See also

Standard of Conduct Release,

supra

footnote 21, at 6-8 (discussing various interpretations of an adviser's fiduciary duty spanning several decades).

When an investment adviser holds itself out to clients and potential clients as providing advisory services, the adviser implies that it remains responsible for the performance of those services and will act in the best interest of the client in doing so.

Outsourcing a particular function or service does not change an adviser's obligations under the Advisers Act and the other Federal securities laws. In addition, the adviser is typically responsible for the advisory services through an agreement with the client that represents or implies the adviser is performing all the functions necessary to provide the advisory services. An adviser remains liable for its obligations, including under the Advisers Act, the other Federal securities laws and any contract entered into with the client, even if the adviser outsources functions. In addition, an adviser cannot waive its fiduciary duty. Accordingly, an adviser should be overseeing outsourced functions to ensure the adviser's legal obligations are continuing to be met despite the adviser not performing those functions itself.

See

Standard of Conduct Release,

supra

footnote 21 (discussing various interpretations of an adviser's fiduciary duty spanning several decades).

See also

section 205(a)(2) of the Advisers Act makes it unlawful for an SEC-registered adviser to enter into or perform any investment advisory contract unless the contract provides that no assignment of the contract shall be made by the adviser without client consent.

As a fiduciary, an investment adviser cannot just “set it and forget it” when outsourcing. In this regard, we are concerned that outsourcing these necessary functions (defined as “Covered Functions” in proposed rule 206(4)-11) in particular, without further oversight by the investment adviser, can undermine the adviser's provision of services and compliance with the Federal securities laws, and can directly harm clients. We also believe it is a deceptive sales practice and contrary to the public interest and investor protection for an investment adviser to hold itself out as an investment adviser, but then outsource its functions that are necessary to its provision of advisory services to its clients without taking appropriate steps to ensure that the clients will be provided with the same protections that the adviser must provide under its fiduciary duty and other obligations under the Federal securities laws. We believe a reasonable investor hiring an adviser to provide investment advisory services would expect the adviser to provide those services and, if significant aspects of those services are outsourced to a provider, to oversee those outsourced functions effectively. To do otherwise would be misleading, deceptive, and contrary to the public interest. Moreover, disclosure cannot address this deception. We do not believe any reasonable investor would agree to engage an investment adviser that will not perform functions necessary to provide the advisory services for which it is hired, and instead will outsource those functions to a service provider without effective oversight over the service provider. An adviser's use of service providers should include sufficient oversight by an adviser so as to fulfill the adviser's fiduciary duty, comply with the Federal securities laws, and protect clients from potential harm.

Accordingly, in light of the increase in the use of service providers, the services provided, and the risks of client harm described above, we believe that a consistent oversight framework across investment advisers is needed for outsourcing functions or services that are necessary for the investment adviser to provide its advisory services in compliance with the Federal securities laws. Proposed new rule 206(4)-11 under the Advisers Act is designed to address these issues by requiring investment advisers to comply with specific elements as part of a due diligence and monitoring process to oversee the provision of covered functions.

Given the increasing use of service providers by investment advisers, we are also concerned that the Commission has limited visibility into advisers' outsourcing and thus the potential extent to which advisory clients face outsourcing-related risks. The Commission currently collects only limited information about an adviser's use of certain service providers through forms filed with the Commission, such as third-party keepers of advisers' books and records and certain service providers for private funds reported on Form ADV, or during examinations conducted by Commission staff.

If the Commission had additional information about which service providers all registered advisers are using that are necessary to perform their advisory services, for example, it could quickly

analyze the potential breadth of the impact from a market event. In the event of a critical failure at an asset management service provider, the Commission would be able to identify quickly all advisers reporting that firm on Form ADV as a service provider of one or more covered functions, which can help inform the Commission's course of action.

See

Form ADV Part 1A, Schedule D, Sections 1.L. and 7.B.1.

Finally, we are concerned that when an investment adviser outsources its books and records obligations to a third party, the adviser may not be properly ensuring that it can comply with the Commission's recordkeeping requirements. Currently, rule 204-2 requires advisers to make and keep specified records, including standards for keeping those records electronically, but does not expressly impose specific requirements when an adviser outsources recordkeeping functions to a third party.

We believe that specific conditions should apply to all advisers using third parties to make and keep records required by rule 204-2.

Commission staff addressed third party recordkeeping in two staff letters.

See

OMGEO, LLC, SEC Staff No-Action Letter (Aug. 14, 2009), at n.3 (“OMGEO NAL”),

available at https://www.sec.gov/divisions/investment/noaction/2009/omgeo081409.htm

(citing First Call and National Regulatory Services, SEC Staff No-Action Letter (Dec. 2, 1992)); First Call Corporation, SEC Staff No-Action Letter (Sept. 6, 1995) (“First Call NAL”),

available at https://www.sec.gov/divisions/investment/noaction/1995/firstcall090695.pdf.

The staff no-action letters represent the views of the staff of the Division of Investment Management. They are not a rule, regulation, or statement of the Commission. The Commission has neither approved nor disapproved their content. The staff no-action letters, like all staff statements, have no legal force or effect: they do not alter or amend applicable law, and they create no new or additional obligations for any person.

See also infra

section II.F.

B. Overview of Rule Proposal

The proposed rule would establish a set of minimum and consistent due diligence and monitoring obligations for an investment adviser outsourcing certain functions to a service provider. Proposed rule 206(4)-11 under the Advisers Act would apply to advisers that are registered or required to be registered with us and that outsource a covered function.

The definition of a covered function has two parts: (1) a function or service that is necessary for the adviser to provide its investment advisory services in compliance with the Federal securities laws, and (2) that, if not performed or performed negligently, would be reasonably likely to cause a material negative impact on the adviser's clients or on the adviser's ability to provide investment advisory services.

Clerical, ministerial, utility, or general office functions or services are excluded from the definition.

Before engaging a service provider to perform a covered function, the adviser would have to reasonably identify and determine through due diligence that it would be appropriate to outsource the covered function, and that it would be appropriate to select that service provider, by complying with six specific elements. These elements address:

Proposed rule 206(4)-11(a). The rule number assigned to the proposed rule 206(4)-11 is based on the numbering for other rule amendments the Commission previously proposed.

See, e.g.,

Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies,

available at https://www.sec.gov/rules/proposed/2022/33-11028.pdf

(proposing rule 206(4)-9 related to cybersecurity policies and procedures of investment advisers); Private Fund Advisers: Documentation of Registered Investment Adviser Compliance Reviews,

available at https://www.sec.gov/rules/proposed/2022/ia-5955.pdf

(proposing rule 206(4)-10 related to private fund adviser audits). This number could change based on future Commission actions.

Proposed rule 206(4)-11(b).

• The nature and scope of the services;

• Potential risks resulting from the service provider performing the covered function, including how to mitigate and manage such risks;

• The service provider's competence, capacity, and resources necessary to perform the covered function;

• The service provider's subcontracting arrangements related to the covered function;

• Coordination with the service provider for Federal securities law compliance; and

• The orderly termination of the provision of the covered function by the service provider.

Proposed rule 206(4)-11(a)(1).

The proposed rule also would require the adviser periodically to monitor the service provider's performance and reassess the selection of such a service provider under the due diligence requirements of the rule.

Each of these elements is included in the rule to address specific areas of risks and concerns that we have observed, as described above. Although the proposed rule does not require additional explicit written policies and procedures related to service provider oversight, if the proposed rule were adopted, advisers would be required under existing rule 206(4)-7 to have policies and procedures reasonably designed to prevent violations of the Advisers Act and rules under the Act, and this requirement would apply to the proposed rule.

Proposed rule 206(4)-11(a)(2).

In addition, we are proposing to require advisers to make and keep certain books and records attendant to their obligations under the proposed oversight framework, such as lists or records of covered functions and records documenting their due diligence and monitoring of each service provider.

The requirement to make and keep such books and records would help advisers monitor, and determine whether to modify, their approach to outsourcing a particular function. These records would also assist the Commission and its staff in evaluating adviser representations about their services and the extent to which an adviser complies with the rule.

See

proposed rule 204-2(a)(24).

We are also proposing to add a new provision in the recordkeeping rule requiring every investment adviser that relies on a third party to make and/or keep books and records required by the recordkeeping rule to conduct due diligence and monitoring of that third party consistent with the requirements under proposed rule 206(4)-11 and obtain reasonable assurances that the third party will meet four standards. These standards address the third party's ability to: (i) adopt and implement internal processes and/or systems for making and/or keeping records that meet the requirements of the recordkeeping rule applicable to the adviser in providing services to the adviser; (ii) make and/or keep records that meet all of the requirements of the recordkeeping rule applicable to the adviser; (iii) provide access to electronic records; and (iv) ensure the continued availability of records if the third party's operations or relationship with the adviser cease. The requirements are intended to protect required records from loss, alteration, or destruction and to help ensure that such records are accessible to the investment adviser and the Commission staff while allowing investment advisers to continue to contract with a wide variety of service providers to assist with recordkeeping functions.

Finally, we are proposing amendments to Form ADV that are designed to improve visibility for the Commission and advisory clients relating to service providers that perform covered functions. New item 7.C. in Part 1A and Section 7.C. in Schedule D would require advisers to provide census-type information about these providers.

These disclosures would provide more information about outsourced functions, enabling clients

to make better informed decisions about the retention of an adviser and enabling the Commission and its staff to identify and address risks related to outsourcing by advisers and oversee advisers' use of service providers better.

Because Form ADV Part 1A is submitted in a structured, XML-based data language specific to that Form, the information in proposed new Item 7.C would be structured (

i.e.,

machine-readable) as well.

II. Discussion

A. Scope

Under proposed rule 206(4)-11, as a means reasonably designed to prevent fraudulent, deceptive, or manipulative acts, practices, or courses of business within the meaning of section 206(4) of the Act, it would be unlawful for an investment adviser registered or required to be registered with the Commission to retain a service provider to perform a covered function unless the investment adviser conducts certain due diligence and monitoring of the service provider.

A covered function is defined in the proposed rule as a function or service that is necessary for the adviser to provide its investment advisory services in compliance with the Federal securities laws, and that, if not performed or performed negligently, would be reasonably likely to cause a material negative impact on the adviser's clients or on the adviser's ability to provide investment advisory services.

The proposed rule defines a service provider as a person or entity that performs one or more covered functions and is not an adviser's supervised person as defined in the Advisers Act.

A covered function would not include clerical, ministerial, utility, or general office functions or services.

See

proposed rule 206(4)-11(a).

Proposed rule 206(4)-11(b).

1. Covered Function

We are proposing to define “covered function” more narrowly than all of the functions an investment adviser might outsource to a service provider. Advisers outsource many services beyond their core advisory functions, and the failure of many of those functions could have little to no effect on an adviser's clients. Accordingly, we are targeting those outsourced functions that meet two elements: (1) those necessary for the adviser to provide its investment advisory services in compliance with the Federal securities laws; and (2) those that, if not performed or performed negligently, would be reasonably likely to cause a material negative impact on the adviser's clients or on the adviser's ability to provide investment advisory services.

See

proposed rule 206(4)-11.

The proposed rule applies if an adviser retains a service provider to perform a covered function, whether by a written agreement or by some other means. The Commission is not specifying how an adviser might retain a service provider to perform a covered function, but an adviser should consider using a written agreement as a best practice. The determination of whether an adviser has retained a service provider to perform such a covered function would depend on the facts and circumstances. For example, an adviser that enters into a written agreement with a valuation provider to value all of its clients' fixed income securities or with a subadviser to manage fixed income portfolios for several of its clients would be considered to retain a service provider under the proposed rule to perform a function that is necessary for the adviser to provide its advisory services. In contrast, custodians that are independently selected and retained through a written agreement directly with the client would not be covered by the proposed rule because the adviser is not retaining the service provider to perform a function that is necessary for the adviser to provide its advisory services.

The determination of what is a covered function also would depend on the facts and circumstances, as the proposed rule is meant to encompass functions or services that are necessary for a particular adviser to provide its investment advisory services. In addition, certain functions may be covered functions for one adviser but not for another adviser, and so certain persons or entities that perform functions on behalf of advisers may be a service provider in the scope of the rule with respect to one adviser but not for another adviser. We are providing examples of potential covered function categories an adviser may wish to consider in the amendments we are proposing to Form ADV, Section 7.C of Schedule D, which would include: Adviser/Subadviser; Client Services; Cybersecurity; Investment Guideline/Restriction Compliance; Investment Risk; Portfolio Management (excluding Adviser/Subadviser); Portfolio Accounting; Pricing; Reconciliation; Regulatory Compliance; Trading Desk; Trade Communication and Allocation; and Valuation.

Advisers outsource functions that are essential to asset management or directly support the adviser's advisory services and processes. Depending on the specific facts and circumstances, when problems arise with these types of functions, clients could experience a material negative impact, such as interruptions in advisory services or the adviser's inability or failure to comply with its legal responsibilities. We believe an adviser should take specific oversight steps required by the proposed rule to reduce the likelihood that these types of problems will occur and to reduce their impact when they do occur. In addition when an investment adviser holds itself out to clients and potential clients as providing advisory services, the adviser implies that it remains responsible for the performance of those services and will act in the best interest of the client in doing so. We believe it is contrary to the public interest and investor protection if the adviser then outsources covered functions without effectively overseeing those outsourced functions. Accordingly, an adviser should be overseeing outsourced functions to ensure the adviser's legal obligations are continuing to be met despite the adviser not performing those functions itself.

Generally, we would consider functions or services that are related to an adviser's investment decision-making process and portfolio management to meet the first element of the definition. For example, some functions and services covered under the first element would be those related to providing investment guidelines (including maintaining restricted trading lists), creating and providing models related to investment advice, creating and providing custom indexes, providing investment risk software or services, providing portfolio management or trading services or software, providing portfolio accounting services, and providing investment advisory services to an adviser or the adviser's clients (subadvisory services).

Covered functions can

include technology integral to an adviser's investment decision-making process and portfolio management or other functions necessary for the adviser to provide its investment advisory services. For example, if an adviser's investment decision-making process relies on artificial intelligence or software as a service, those services may form part of the covered function even though they are provided through technology. As discussed above, certain of these functions may be covered functions for one adviser but not for another adviser, depending on the facts and circumstances. For example, an adviser may choose to engage an index provider for the purposes of developing an investment strategy for its clients, which would be a covered function under the proposed rule, while another may license a widely available index from an index provider to use as a performance hurdle, in which case the proposed rule would not apply. We believe that the services of an index provider, if retained by an adviser for purposes of formulating the adviser's investment advice, would meet the first element of the definition of a covered function because such services would be necessary for the adviser to provide investment advice to its client. Implementing an investment decision also may meet this element, including identifying which portfolios to include or exclude, determining how to allocate a position among portfolios, and submitting the final orders to the broker. In order to provide investment advisory services in compliance with the Federal securities laws, an adviser might also seek to outsource its compliance functions, including outsourced chief compliance officers and other outsourced compliance functions such as making regulatory filings on behalf of the adviser, and valuation and pricing services.

Ensuring the adviser complies with the regulatory requirements applicable to its advisory services is a necessary part of providing those services and would be covered under the rule. We would not consider functions performed by marketers and solicitors to be covered functions, however, because such services are not used by an adviser to provide investment advice to its clients.

These providers' activities, in whole or in part, may cause them to meet the definition of “investment adviser” under the Advisers Act. In a separate action, the Commission issued a request for public comment related to the status and registration of certain information providers, including index providers, model portfolio providers, and pricing services, under the Advisers Act.

See

Request for Comment on Certain Information Providers Acting as Investment Advisers, Investment Advisers Release No. 6050 (Jun. 15, 2022) [87 FR 37254 (Jun. 22, 2022)] (“Information Providers Request for Comment”),

available at https://www.sec.gov/rules/other/2022/ia-6050.pdf.

The comment letters on the Information Providers Request for Comment (File No. S7-18-22) are available at

https://www.sec.gov/comments/s7-18-22/s71822.htm

and we are continuing to consider all of the comments received. Several commenters noted that many advisers and fund boards oversee information

providers and that advisers are fiduciaries bearing the ultimate responsibility for information providers' services.

See, e.g.,

Comment Letter of ETF BILD (Aug. 16, 2022); Comment Letter of Investment Advises Association (Aug. 16, 2022); Comment Letter of Index Industry Association (Aug. 16, 2022); Comment Letter of Invesco Ltd. (Aug. 16, 2022); Comment Letter of Investment Company Institute (Aug. 16, 2022) (“Comment Letter of ICI”); Comment Letter of Independent Directors Council (Aug. 16, 2022); Comment Letter of NASDAQ (Aug. 16, 2022) (“Comment Letter of NASDAQ”); Comment Letter of S&P Dow Jones Indices (Aug. 16, 2022); Comment Letter of S&P Global Market Intelligence (Aug. 15, 2022); Comment Letter of the Securities Industry and Financial Markets Association (Aug. 16, 2022) (“Comment Letter of SIFMA”). Some commenters also suggested as an alternative to regulating these information providers as investment advisers, that the Commission consider regulating adviser oversight of information providers.

See, e.g.,

Comment Letter of Healthy Markets Association and CFA Institute (Aug. 16, 2022); Comment Letter of ICI; Comment Letter NASDAQ; Comment Letter of SIFMA.

For example, an adviser may use valuation service providers to assist in fair value determinations. Such services would be included under the proposed rule as covered functions, as opposed to, for example, common market data providers providing publicly available information.

Marketers and solicitors must determine whether they are subject to statutory or regulatory requirements under Federal law, including the requirement to register as a broker-dealer pursuant to section 15(b) of the Securities Exchange Act of 1934.

See

15 U.S.C. 78o(b).

The second element of the proposed definition of “covered function” limits the definition to those functions or services that, if not performed or performed negligently, would be reasonably likely to cause a material negative impact on the adviser's clients or on the adviser's ability to provide investment advisory services.

Determining what is a material negative impact would depend on the facts and circumstances, but it could include a material financial loss to a client or a material disruption in the adviser's operations resulting in the inability to effect investment decisions or to do so accurately. An adviser should consider a variety of factors when determining what would be reasonably likely to have a material negative impact, such as the day-to-day operational reliance on the service provider, the existence of a robust internal backup process at the adviser, and whether the service provider is making or maintaining critical records, among other things. For example, if an adviser used a service provider for portfolio management functions that experienced a cyber-incident that caused an inability for the adviser to monitor risks in client portfolios properly, it would be reasonably likely to cause a material negative impact on the adviser's clients and its ability to provide investment advisory services.

See

proposed rule 206(4)-11(b).

See infra

section II.B.4.

A covered function would not include clerical, ministerial, utility, or general office functions or services.

These types of functions or services are not functions that an adviser would perform on its own or they are not likely to qualify as a covered function under the proposed rule because they are not necessary for an adviser to provide investment advisory services in compliance with the Federal securities laws or they are not likely to cause a material harm to clients if not performed properly. For example, covered functions would not include the adviser's lease of commercial office space or equipment, use of public utility companies, utility or facility maintenance services, or licensing of general software providers of widely commercially available operating systems, word processing systems, spreadsheets, or other similar off-the-shelf software.

Proposed rule 206(4)-11(b).

To illustrate how to apply the definition of a covered function, if an adviser engaged an index provider to create or lease an index for the adviser to follow as a strategy for its advisory clients, it would likely fall under both elements of the definition. First, using a bespoke index created specifically for the adviser to follow would serve as a material service that is necessary for the adviser to provide investment advisory services to the extent the index is used by the adviser to provide investment advice and make investments on behalf of the advisory client. Second, if the function is not performed or performed negligently, it would have a material negative impact on the adviser's ability to provide investment advisory services because if, for instance, the service provider failed to provide the index, the adviser would not be able to make investments for the client as needed. Similarly, if an adviser licenses a commonly available index and its stated investment strategy involves management against that index, failure to receive the index or an inaccurate delivery of the index could have a material negative impact on the adviser's ability to manage that portfolio. In contrast, if an adviser purchases a license to utilize a commonly available index solely as a comparison benchmark for performance and not to inform the adviser's investment decisions as part of its advisory services, that index provider would most likely not be providing a covered function because, in that context, the adviser is not using the index to provide investment advice.

2. Service Provider

An investment adviser would be required to comply with the proposed rule if the adviser retains a service provider. The term “service provider” is defined as a person or entity that: (1) performs one or more covered functions; and (2) is not a supervised person of the

adviser.

The proposed rule excludes supervised persons of an adviser from the definition of a service provider since such persons are already being directly overseen by the adviser.

The proposed rule does not, however, make a distinction between third-party providers and affiliated service providers because the risks that the proposed rule are designed to address exist whether the service provider is affiliated or unaffiliated, and the service provider is not necessarily already being overseen by the adviser. For example, the ability to have direct control or full transparency may be limited when an adviser outsources, even to an affiliated service provider, which may increase the risk for failed regulatory compliance. As such, even though the affiliate may be in a control relationship with the adviser, it remains important for the adviser to determine if it is appropriate to retain the affiliate's services and to oversee the affiliate's performance of a covered function.

See

proposed rule 206(4)-11(b).

See

proposed rule 206(4)-11(b). A supervised person is defined in section 2(a)(25) of the Advisers Act as any partner, officer, director, (or other person occupying a similar status or performing similar functions), or employee of an adviser, or other person who provides investment advice on behalf of the adviser and is subject to the supervision and control of the adviser.

The proposed rule would not include an exception for service providers that are subject to other provisions of the Advisers Act, including SEC-registered advisers, or other Federal securities laws. An adviser remains liable for its legal and contractual obligations and should be overseeing outsourced functions to ensure the adviser meets its legal and contractual obligations, regardless of whether the service provider has its own legal obligations under the Federal securities laws. For example, if an adviser engages a broker-dealer to provide an electronic trading platform to submit orders from the adviser and allocate trades among the adviser's client accounts after the trades have been executed, then the adviser's engagement of the broker-dealer for those services would not be excepted from the proposed rule. We believe providing orders to a broker-dealer and allocating securities to client accounts after the trade are part of an investment adviser's services and responsibilities that cannot be outsourced without further oversight because, particularly in a discretionary account, instructing a broker-dealer about the trades the adviser is recommending and then allocating trades among client accounts is a critical component of an adviser's provision of investment advisory services. Additionally, we believe it would be reasonable for a client to expect initial and continued adviser oversight of that function, and the broker-dealer's failure to perform or negligent performance of its covered function could be reasonably likely to cause a material harm to the adviser's clients and its ability to provide its advisory services. For example, without proper oversight of this function, failing to perform the function could result in an adviser being unable to submit orders or allocate trades. A service provider performing asset allocations on behalf of the adviser also might allocate shares in a manner that favors certain clients over others or might fail to consider whether allocating additional shares would violate a client' investment guidelines.

If an adviser engages an SEC-registered adviser as a subadviser to manage and evaluate investments within a portfolio, then the adviser would not be excepted from the proposed rule. Even if the subadviser would be subject to its own compliance with the Federal securities laws, the adviser remains responsible for its advisory services and should perform its own due diligence and monitoring of the subadviser to ensure its obligations continue to be met. Moreover, the adviser's compliance with the proposed rule would not alleviate the subadviser's own compliance with the Federal securities laws, including the proposed rule. In the event that an SEC-registered subadviser were to hire a service provider itself, for example to help manage and evaluate the investments within a managed portfolio, the subadviser would be required to comply with the proposed rule with respect to that service provider. The subadviser would have the same obligations and duties to its client as any other SEC-registered adviser, whether the subadviser's client is another adviser or a client of another adviser, and the subadviser should engage in the same oversight requirements as any other adviser. All advisers registered or required to be registered are subject to the proposed rule if they engage a service provider to perform a covered function, regardless of the identities of their clients or their relationships to other advisers.

3. Recordkeeping of Covered Functions

An adviser would first need to determine which functions are covered functions in order to comply with the requirements of the proposed rule. Accordingly, we are proposing to revise the Advisers Act books and records rule to require an adviser to make and keep a list or other record of covered functions that the adviser has outsourced to a service provider and the name of each service provider, along with a record of the factors, corresponding to each listed function, that led the adviser to list it as a covered function.

See

proposed rule 204-2(a)(24)(i). The rule number assigned to subparagraph (24) of the proposed amendments to rule 204-2(a) is based on the numbering for other rule amendments the Commission previously proposed.

See e.g.,

Private Fund Advisers: Documentation of Registered Investment Adviser Compliance Reviews,

available at https://www.sec.gov/rules/proposed/2022/ia-5955.pdf

(proposing rule 204-2(a)(20) to (23)). The proposed rule's subsection number could change based on future Commission actions.

The recordkeeping requirement might be satisfied by a written agreement between the adviser and service provider, explicitly stating that the function or service provided is a covered function under the proposed rule and the name of each service provider. The written agreement could include the factors that led the function to be deemed a covered function, or that information could be memorialized in a separate record. Alternatively, there might be a written memorandum or other document prepared by the adviser that lists the names of the service providers; that explains how a particular function or service is one that is deemed to be necessary to provide investment advisory services in compliance with the Federal securities laws and that would be reasonably likely to cause a material negative impact on the adviser's clients or on the adviser's ability to provide investment advisory services if not performed or performed negligently; and that provides the factors that led the function to be deemed a covered function. The adviser's written compliance policies also could identify the covered functions and the factors considered for each, such as the type of function or service provided or whether the adviser could provide investment advisory services without the covered function.

The method by which the adviser meets this proposed requirement (

e.g.,

written agreement, memorandum to file, etc.) and the factors relevant to the adviser's determination would likely vary depending on each function or service for which an adviser engages a service provider. Accordingly, we are not specifying any particular method for making the list or record of factors to consider.

See

proposed rule 204-2(e)(1).

Due to the unique nature of an adviser's relationship with a service provider, we are also proposing to revise the Advisers Act books and records rule

to require that the records be maintained in an easily accessible place throughout the time period that the adviser has outsourced a covered function to a service provider, and for a period of five years thereafter.

This amendment would help facilitate the Commission's inspection and enforcement capabilities.

See

rule 204-2.

We request comment on the proposed scope of the rule:

1. Is the proposed scope of the rule appropriate? Why or why not? In what ways, if any, could the proposed scope of the rule or the proposed definition of covered function better match our policy goals? Does it need to be made clearer?

2. Instead of oversight requirements when an adviser outsources a covered function, should we only require Form ADV disclosure to clients and potential clients of any outsourcing of certain functions? Would it be sufficient for an adviser to disclose that it would outsource these services and not oversee them and would any reasonable investor agree to this approach? Or would a more limited approach to the oversight of service providers be appropriate instead of the proposed requirements? If so, what should that limited approach be?

3. In addition to the proposed oversight requirements when an adviser outsources a covered function, should the rule include an express provision that prohibits an adviser from disclaiming liability when it is not performing a covered function itself?

4. Is the proposed definition of “covered function” clear? Why or why not? In what ways, if any, could the proposed definition be made clearer?

5. The proposed rule is designed to apply in the context of outsourcing core advisory functions. The proposed rule does so by qualitatively describing what we believe is a core advisory function—namely, a function or service that is necessary for the investment adviser to provide its investment advisory services in compliance with the Federal securities laws. Does the proposed definition of covered function capture this intended core advisory function scope? Should the rule explicitly state that its application is limited to core investment advisory services? If yes, how would we identify and define what would be considered “core investment advisory services”?

6. Instead of our proposed definition, should we define “covered functions” as a specified list of core investment advisory activities, such as “services that are central to the selection, trading, valuation, management, monitoring, indexing, and modeling of investments”? Are there other specific functions or services that should be included or excluded from this list? Please explain. Are the services in this list clear? For example, would we need to define trading in this alternative definition to include allocation and communications related to trades? Would it be clear that subadvisers and portfolio management would be included as “management” in this alternative definition or that risk management is part of management and monitoring? Would it be confusing to list management and selection as well as indexing and modeling in this alternative definition? Is there overlap among the categories? If there is overlap, should the rule list only certain of these categories, such as selection and management, or would certain core services or functions be inadvertently excluded?

7. Should the Commission include or exclude in the definition of covered function any particular functions or services discussed within the release? Should services related to investment risk identification or monitoring be specifically identified, or would they be assumed to be included as part of the selection or management of investments? Instead should the specified list of covered functions/services be the same as those provided by service provider types listed in the proposed amendments to Form ADV?

8. Are there particular types of service providers to which the rule should apply? For example, should the rule explicitly include the service providers advisers would be required to identify in proposed amendments to Form ADV (portfolio management, trade communication and allocation, pricing services, valuation services, investment risk services, portfolio accounting services, client servicing, subadvisory services, and/or regulatory compliance)? Should we explicitly require the rule to apply to index providers, model providers, valuation agents, or other service providers that may be central to an adviser's investment decision-making process?

9. What would be the advantages and disadvantages of explicitly identifying the types of functions or providers that would trigger the rule? For instance, is there a risk of being over-inclusive and under-inclusive if we take such an approach? Are there certain services or functions that should be considered “core” for all advisers, or does what constitutes a “core” advisory function vary from one adviser to the next? Should what is considered “core” correlate to a certain percentage of clients who receive (and presumably can therefore be affected by) the service provider's services? That is, would a service provider's functions be considered “core” to an adviser if they could have an impact on a certain minimum percentage of the adviser's clients? Should it correlate to a certain percentage of regulatory assets under management that receive (and, again, presumably can be affected by) the service provider's services? That is, would a service provider's functions be considered “core” to an adviser if they could have an impact on a certain minimum percentage of the adviser's regulatory assets under management? What would be a percentage of either such measurement that should trigger application of the rule? 5%? 10%? 15%? 20%? Please explain your answer.

10. Should data providers be explicitly included within the scope of the rule? Are there specific types of data providers that might be considered “covered functions,” such as providers of security master data, corporate action data, or index data?

11. Instead of considering certain compliance functions to be a “covered function” under the rule, should we amend rule 206(4)-7 to require advisers to comply with the due diligence and monitoring requirements of proposed rule 206(4)-11 and 204-2(a)(24) for all outsourced compliance functions, as we are proposing for records made and kept by third parties, as described below?

12. Should we revise the proposed exclusion for clerical or ministerial services? Should we provide different or additional specific exclusions from the definition of covered function under the rule? Which ones, if any? For example, should we use the same definition of supervised person as in the Advisers Act? Should we explicitly exclude broad-based and widely published indices or specific clerical or ministerial services such as basic utilities and widely commercially available operating systems, word processing systems, or spreadsheets, utilities, or general office functions or services? Should we exclude functions or categories of services or should we list specific service providers that should be excluded? How should we view these services or functions when they are integral to the provision of a covered function (

e.g.,

when investment performance is calculated in a spreadsheet or an order management system is hosted in the cloud)?

13. Should we define “covered function” more broadly or more narrowly, and if so, how? For example, should we only use the first prong of the proposed definition and broaden the

definition to any function or service that is necessary for the investment adviser to provide its advisory services in compliance with the Federal securities laws, regardless of the likely impact on clients of non- or negligent performance? Or should we only use the second prong of the definition to apply the rule to any services or functions that, if not performed or performed negligently, could potentially have a material negative impact, regardless of whether they are necessary for the adviser to provide its advisory services in compliance with the Federal securities laws? Should we change the second prong of the definition, for example, by applying the rule to any services or functions that if not performed or performed in a manner materially different from the adviser's representations or undertakings could potentially have a material negative impact?

14. Should the definition of “covered function” be expanded to include functions or services necessary for the adviser to comply with the Federal securities laws or with the Advisers Act instead of limiting the definition to functions or services necessary to provide investment advisory services in compliance with the Federal securities laws? Should the definition include other third-party providers of services to the adviser's clients, such as broker-dealers and custodians? Should the definition include any third-party providers that the adviser recommends to clients even if those providers enter into an agreement directly with the client and not with the investment adviser?

15. Is “necessary for the adviser to provide its advisory services in compliance with the Federal securities laws” sufficiently clear? Is the term “necessary” too restrictive and, if so, should alternate language be used, such as “supports the adviser in making investment selections and otherwise providing its advisory services in compliance with the Federal securities laws”? Should the proposed rule be limited to providing its advisory services in compliance with obligations only under the Advisers Act?

16. Is the proposed definition of “service provider” clear? Why or why not? In what ways, if any, could the proposed definition be made clearer?

17. Are the meanings of “material negative impact” and “reasonably likely” clear? Why or why not? Should we define these phrases or provide additional guidance? If so, how? Is there a different phrase we should use that conveys the same idea?

18. Should the rule define what it means to retain a service provider to perform a covered function? If so, how? Should we explicitly state that outsourcing would include affiliated entities of an adviser, including parent organizations?

19. Should we define when an adviser would retain a service provider for purposes of the proposed rule? Are there specific factors that should be relevant in determining whether a service provider arrangement should be subject to the rule? For example, should the rule apply where the adviser recommends the service provider to some or all of its clients? Would a relevant factor be the extent to which the adviser makes arrangements for the client to engage the service provider? Should the approach differ depending on whether the client is a fund (registered or not) or a separately managed account and the extent to which the adviser is a control person of the fund or has some control over the fund's contracting arrangements? Or should the proposed rule only include service providers that contract directly with the adviser? If so, why? Should we provide an explicit exclusion for all advisers that engage service providers to perform covered functions as part of a larger program or arrangement, such as the sponsor of a wrap fee program or other separately managed account program in which the sponsor is subject to the proposed rule with respect to the participation of the service providers in the program?

20. The proposed rule does not specify how an adviser would “retain” a service provider in compliance with the proposed rule. Should we require a written agreement or some other written documentation between the adviser and service provider to perform a covered function under the proposed rule? If so, what provisions should we require? For example, should certain elements of the proposed rule's due diligence requirements instead be required in a contract between the adviser and service provider? Should there be a written agreement requirement for certain covered functions and not others? For example, should the rule identify a sub-set of the proposed definition of covered function as critical covered functions and require a written agreement in those circumstances only? If the final rule were to, instead, define covered function by listing certain specific functions, such as described in request for comments 5, 6, 7, and 8 above, should we require a written contract between the adviser and these service providers? Are there any contexts in which a written agreement may be more feasible than others? Alternatively, should we not require a written agreement but instead require disclosure in Form ADV Part 1A of whether an adviser has a written agreement for each covered function or require disclosure only if the adviser does not have a written agreement for a particular covered function?

21. Is the scope of the proposed rule sufficiently clear in its application to various advisory arrangements such as, among others, separately managed accounts, wrap-fee programs, robo-advisory services, and model portfolio providers? Is it clear how it applies when technology is used as part of advisory services, such as artificial intelligence, foundation models, or software as a service? Why or why not?

22. With respect to an adviser's clients, should the rule apply to any service providers an adviser retains on behalf of all of the adviser's clients, as proposed, including clients that are registered investment companies or private funds? Why or why not? Should services provided to a fund, such as fund administration, transfer agent, principal underwriter or custody services, be deemed to be “investment advisory services” or otherwise covered under the proposed rule and related recordkeeping requirements? Should we provide an explicit exception for advisers when a registered investment company retains the listed service providers in rule 38a-1 under the Investment Company Act of 1940 (“Investment Company Act”) instead (

i.e.,

principal underwriter, fund administrator, and transfer agent)? What about with respect to private funds, which are not subject to rule 38a-1? Should we provide an explicit exception from the proposed rule if any such engagement is approved, in the case of a registered fund, by the board, including a majority of the independent directors, or in the case of a private fund, by a majority of the Limited Partner Advisory Committee or equivalent body?

23. Should we include subadvisers within the scope of the rule, as proposed? Why or why not? Should this differ based on whether the subadviser for a fund is engaged by the adviser or the fund itself?

24. The proposed rule excludes a supervised person of an investment adviser from the definition of provider. Do commenters agree that it would be duplicative to apply the rule in this context? Should the proposed rule also exclude an adviser's affiliated or related persons? Should such an exclusion depend on whether the affiliate or related person is separated from the

adviser by information barriers? Why or why not?

25. Would it be duplicative or otherwise unnecessary to apply the rule in the context of an adviser's affiliates, as proposed? If so, please explain.

26. Should the proposed rule provide an exception for firms that are dually registered broker-dealers? For example, should we provide an exception for firms that comply with existing broker-dealer provisions such as FINRA Rule 3110 (Supervision) to meet a dual registrant's obligation under these rules? Should there be an exception for outsourcing to SEC-registered advisers or other service providers that are themselves subject to regulation under the Federal securities laws? Should such an exception be limited to outsourcing to another adviser or manager (including banks and trust companies) when the other adviser or manager treats the client as its own client (as may be evidenced, for example, by the client's entry into documentation appointing the adviser or manager, the inclusion of the client as a client on the books and records of the adviser or manager, or the delivery of disclosure documents of the adviser or manager to the client)?

27. To what extent do advisers already take the steps that would be required by the proposed rule? Do commenters believe that the proposed rule is necessary? Why or why not? To the extent that commenters believe that the proposed rule is already covered by the general fiduciary duty enforceable under Section 206 of the Advisers Act, do commenters believe there is sufficient clarity in the industry as to the obligations for an adviser in the context of retaining service providers? And if so, how do those obligations differ from what is outlined in this proposed rule?

28. Are the proposed changes to the books and records rule appropriate? Are there alternative or additional recordkeeping requirements we should impose? For example, should we require that the record include specific information or be memorialized in a written memo or report? Should we require advisers to update the list of covered functions within prescribed time periods such as monthly, quarterly or annually?

29. Should we require advisers to make and keep true, accurate, and current a list of covered functions? Why or why not? Should we specify any particular method for making the list or record of factors to consider? Should we require a specific method of maintaining the list of covered functions such as in its policies and procedures?

30. Do commenters believe it would be overly burdensome to require a record of factors that led the adviser to list each covered function, as proposed? Why or why not? Should we instead only require the list of covered functions without requiring the record of factors for each covered function?

B. Due Diligence

The proposed rule would require advisers to conduct reasonable due diligence before engaging a service provider to perform a covered function.

We believe it is essential for an investment adviser to evaluate whether and how it will continue to meet its obligations to its clients, and the requirements of the Federal securities laws, including its obligations as a fiduciary, when it chooses to outsource.

The due diligence requirement would provide guidelines to help ensure that the nature and scope of the covered function, as well as the risks associated with the adviser's use of service providers are identified and appropriately mitigated and managed. This also could reduce the risk that the adviser's outsourced services are not performed or are performed negligently. Specifically, the proposed rule would require an adviser to reasonably identify and determine that it would be appropriate to outsource the covered function, that it would be appropriate to select the service provider, and once selected, that it is appropriate to continue to outsource the covered function, by complying with six specific elements:

See

proposed rule 206(4)-11(a)(1).

See

In the Matter of AssetMark, Inc. (f/k/a Genworth Financial Wealth Management, Inc.), Investment Advisers Act Release No. 4508 (Aug. 25, 2016) (settled order) (AssetMark's due diligence was insufficient to confirm the accuracy of performance data from a third-party and therefore AssetMark failed to have a reasonable basis for the accuracy of the performance and performance-related claims made in its advertisements);

See also

17 CFR 248.201(e)(4) (applicable to advisers that are a financial institution or creditor with covered accounts); Reg. S-ID, Appendix A, at Section VI(c).

2. Risk Analysis, Mitigation, and Management

The proposed rule would require an adviser to identify the potential risks to clients, or to the adviser's ability to perform its advisory services, resulting from outsourcing a covered function. In doing so, we believe an adviser generally should assess and consider prioritizing the risks created by outsourcing the function in light of the adviser's particular business processes.

As discussed above,

outsourcing an investment adviser's function without a minimum and consistent framework for identifying, mitigating, and managing risks, can undermine the adviser's provision of services and mislead or otherwise harm clients. A lack of such a framework could indicate that it is unreasonable for an adviser to outsource the function. Potential client harm caused by a service provider's failure to perform or negligent performance of the outsourced function could be significantly mitigated, or even avoided, if the adviser first identifies the risk, and then determines, before outsourcing a function, how to mitigate and manage the risk.

We believe a risk prioritization approach is a commonly used and effective practice in the industry. Also, the Commission proposed a risk prioritization approach for cybersecurity risk assessment. We encourage commenters to review that proposal to determine whether it might affect their comments on this proposing release.

See

Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies, Investment Advisers Act Release No. 5956 (Feb. 9, 2022) [87 FR 13524 (Mar. 9, 2022)] (“Proposed Cybersecurity Release”) (stating that “[a]s an element of an adviser's or fund's reasonable policies and procedures, the proposed cybersecurity risk management rules would require advisers and funds periodically to assess, categorize, prioritize, and draft written documentation of, the cybersecurity risks associated with their

information systems and the information residing therein.”).

There are a variety of potential risks that an adviser should generally consider, such as the sensitivity of information and data that would be subject to the service or to which the service provider may have access, the complexity of the function being outsourced, the reliability and accuracy of the service or function delivered by the service provider, extensive use of particular service providers by the adviser or several advisers, available alternatives in the event a service provider fails or is unable to perform the service, the speed with which a function could be moved to a new service provider, existing and potential conflicts of interest of the service provider,

geographic location of the service provider, unwillingness to provide transparency, known supply-chain challenges, and the availability of market resources skilled in the service. Key to this process might include determining the likely potential impact—particularly to the adviser's clients, to investors in the adviser's fund clients, or to the adviser's ability to perform its advisory services—of the failure, or improper performance, of the function to be outsourced.

Advisers may have disclosure obligations related to conflicts of interest that arise from other provisions of the Federal securities laws.

See, e.g.,

Form ADV Part 2, General Instruction 3 (stating that advisers “must seek to avoid conflicts of interests with [their] clients, and, at a minimum, make full disclosure of all material conflicts of interest . . . that could affect the advisory relationship.”).

For example, outsourcing records administration, personal securities trading clearance and compliance, or client trading services may result in the service provider gaining access to the adviser's non-public trading information (

e.g.,

client account positions, active trade orders, restricted securities trading list), or personally identifiable information (“PII”) about an adviser's clients. In these circumstances, it would be important for the adviser to consider whether use of a service provider would increase the likelihood that the non-public trading information or PII could be mishandled, misused, subject to unauthorized access, or otherwise subject to a heightened risk.

This risk may be amplified when outsourcing to an offshore service provider that is unfamiliar with applicable U.S. laws and regulations, is potentially subject to laws that apply a different standard, and may cause delays in production of records. In the case of an offshore service provider, the adviser should consider whether the service provider's policies, procedures, and operations comply with applicable United States laws and regulations, and whether the service provider is able to demonstrate experience servicing clients that are subject to Federal securities laws. Further, the adviser should consider the potential impact to its advisory business and its clients if the non-public trading information or PII were subject to a breach via the service provider.

Advisers should also note that outsourcing that transfers PII to third parties could implicate legal restrictions on sharing by the adviser of such information.

When an adviser outsources any covered function it introduces new relationships and the potential for new conflicts of interest, such as the service provider's incentives to meet its obligations to some clients ahead of others, to devote more resources to a different line of business than the one for which the provider was hired, or to favor affiliates.

The adviser should identify these risks and determine how it will mitigate and manage them. For example, outsourcing some client portfolio management functions to a model provider may introduce new conflicts of interest issues for the service provider that the adviser may want to consider. In such a circumstance, an adviser generally should consider potential issues such as whether the service provider also provides services to the service provider's affiliates and how the service provider prioritizes providing models among clients that pay different fees to the service provider. This is because the service provider could have a financial incentive to provide favorable prioritization or terms to its affiliates or clients paying the service provider a higher fee. If so, the adviser generally should consider how to mitigate this conflict of interest through approaches such as obtaining contractual representations and warranties about the service provider's procedures, reviewing the service provider's applicable written policies and procedures, or obtaining a contractual right to audit the service provider.

As fiduciaries, advisers must seek to avoid conflicts of interest with clients, and, at a minimum, make full disclosure of all material conflicts of interest between the adviser and clients that could affect the advisory relationship.

See

Form ADV Part 2 General Instructions. Advisers may disclose this information in their Part 2 of Form ADV or by some other means.

Another common example that illustrates the importance of an adviser's risk analysis occurs when an adviser seeks to outsource all or portions of its compliance function. There can be benefits to relying on a third party with potentially greater compliance experience and expertise, but an adviser also generally should consider the nature of its business and whether a potential provider can sufficiently understand, ingest, and address the unique compliance needs of the adviser's business. The adviser can seek to mitigate and manage this risk by generally considering certain steps such as seeking references from other clients of the service provider, conducting interviews of key service provider personnel, ensuring the compliance service provider will customize its services to meet the needs and unique aspects of the adviser's particular business, obtaining written assurances about the experience and skills of the service provider personnel that will be assigned to the adviser's account, and obtaining the right to audit the functions being performed by the service provider periodically.

The proposed rule also would require advisers to identify the risks of outsourcing to a particular service provider. We understand that many advisers currently take a variety of steps to understand the risks of their service providers and those of certain service providers. These steps may include reviewing a summary of a service provider's business continuity plan, due diligence questionnaires, an assurance report on controls by an independent party, certifications or other information regarding a provider's operational resiliency or implementation of compliance policies, procedures, and controls relating to its systems, results of any testing, and conducting periodic onsite visits. The nature, depth, and complexity of this analysis would be dependent, in part, on the adviser's assessment of risks associated with the function being outsourced. If an adviser determines that the risk of outsourcing a particular function is relatively high, then the adviser generally should consider adjusting its due diligence of the particular provider commensurate with that risk assessment. An adviser

also generally should consider that a provider may pose unique or novel risks such as international operations, limited financial or operational history, lack of financial or operational transparency, lack of sufficient operating capital to support long-term operations, inability or unwillingness to provide client references, insufficient availability of qualified personnel, infrastructure susceptibility to extreme weather, lack of adequate data security, and prior service failures.

For example, if the outsourced function involves valuation of illiquid or private securities, the adviser generally should consider whether the particular service provider has the capability and experience to provide accurate and timely information. Inaccurate or untimely valuation information could affect the adviser's strategy, resulting in negative financial consequences for the adviser's clients. A lack of necessary sophistication or inability to perform timely are examples of service provider issues that generally should be identified and addressed before the service provider is engaged.

The proposed rule would also require an adviser to determine how it will mitigate and manage the identified risks. This could be accomplished through a variety of means, including actions taken by the adviser, or actions taken by the service provider at the adviser's request or direction. If an adviser determines that risks cannot be mitigated or managed adequately, the adviser generally should consider factors such as whether it is consistent with an adviser's fiduciary responsibility to its clients to move forward with outsourcing the function, whether outsourcing the function may increase the risk of fraud against the adviser's clients, or whether there is a viable alternative to outsourcing.

There are a multitude of ways that an adviser may mitigate or manage risks, subject to the applicable facts and circumstances surrounding the function. To mitigate the identified risks, an adviser generally may consider the potential impacts of the risks occurring, the frequency with which the risks may occur, and how to avoid or lessen those impacts. This could include considering whether the service provider allows sufficient transparency such that the adviser reasonably can monitor the outsourced functions to confirm they are performed correctly and developing and implementing written policies and procedures to oversee the service provider. For example, if an adviser incorporates a service provider's software to manage its portfolio risk, a flaw in the software could adversely affect client portfolios. It would therefore be important that the service provider sufficiently explains and demonstrates how the software operates so that the adviser can understand, identify, and determine whether it can mitigate any risks that the use of the software may pose. The adviser also generally should consider whether and how the service provider would provide notice of software failure, and how the service provider will respond in the event of a failure. Similarly, in the event the adviser is U.S.-based and outsourcing to a non-U.S.-based service provider, the adviser generally should consider whether and how it can effectively monitor the performance of the covered function, and whether there are any unique limitations or risks posed by the location where the services will be provided, such as geopolitical instability, heightened exposure to extreme weather, lack of U.S. legal jurisdiction and ability to enforce legal rights, infrastructure challenges such as instability in the power grid or internet services, or lack of access to an experienced workforce. If the adviser determines it cannot effectively monitor the performance of a covered function, it generally should consider whether outsourcing is consistent with the adviser's fiduciary responsibility to its clients, whether outsourcing may increase the risks for the adviser's clients, and whether there is a viable alternative to outsourcing.

An adviser may also mitigate and manage the risks of failing to perform a function by implementing contractual safeguards or pursuing alternative options. For example, if a service provider placing trades for the adviser's clients experienced a trading delay or stopped trading altogether, there may be material negative impacts on the adviser's clients. To mitigate the risk of this scenario, the adviser could enter into a contractual agreement with the service provider that identified, in advance of such an event, a substitute trading arrangement to be implemented within a timeframe that would cause as little disruption to clients as possible. An adviser also could establish a redundancy in the outsourced service or function. For example, an adviser could engage a primary pricing provider for illiquid securities, and also have an arrangement with a secondary pricing provider. The secondary provider could provide prices in the instance that the first pricing service fails, and otherwise be used, for example, to validate accuracy and identify potential anomalies in the data provided by the primary pricing provider. Such contractual provisions may be particularly important in preventing harm to the adviser's clients. Regardless of who a contract indicates should remedy such a situation or who is liable for a particular breach, a service provider's failure to perform does not excuse the adviser from its fiduciary duty and other legal obligations and liabilities.

3. Competence, Capacity, Resources

Once an adviser has identified the risks related to outsourcing the function and the risks of the service provider, the proposed rule would require the adviser to determine that the service provider has the competence, capacity, and resources necessary to perform the covered function in a timely and effective manner. Outsourcing an investment adviser's function to a service provider without making this determination can undermine the adviser's provision of services and mislead or otherwise harm clients. When an investment adviser holds itself out as providing advisory services or agrees with a client to provide such services, the adviser implies that it remains responsible for the performance of those services and will act in the best interest of the client in doing so. If an adviser retains a service provider without ensuring the service provider is able to perform the function in a timely and effective manner, the adviser would not be ensuring its obligations will be met and clients could be harmed if the service provider fails to perform or negligently performs the covered function. Therefore, in order to comply with its legal obligations when outsourcing a function, the adviser should confirm that the service provider is able to perform the applicable function timely and effectively to the same standards directly applicable to the adviser.

The determination of competence, capacity, resources, and performing the function timely and effectively should be based on the facts and circumstances of the functions being outsourced. For example, if outsourcing a function is high risk due to the complexity of the function, the adviser may want to assess competence by focusing on the experience and expertise of the service provider's personnel and the comprehensiveness of their processes and methodologies. If the function is labor intensive, the adviser may wish to consider factors such as whether the service provider has the necessary staffing capacity to provide the function and the service provider's historical staff retention rates. If the function requires specialized equipment or

technology, the adviser may wish to seek evidence that the service provider possesses those resources. If the function is novel or is unique to the adviser, the adviser may wish to consider whether it is even appropriate to outsource due to a lack of service providers with the necessary competence, capacity, or resources to perform the function. In all of these instances, the adviser may consider whether and how the service provider can perform the covered function such that it effectively addresses the adviser's and its client's needs.

In addition to considering the facts and circumstances of the function being outsourced, we believe an adviser's analysis of competence generally should include an understanding of how the service provider will perform the function. For this, the adviser generally should verify that the service provider is able to explain and demonstrate clearly how the function will be performed. This enables the adviser to confirm it is outsourcing to a competent service provider, mitigates the risk of potential harm to the adviser's clients of a failure to perform, and educates the adviser in order to better monitor the service provider once engaged. For example, if an adviser is outsourcing its robo-advisory product to a third-party digital investment platform the adviser generally should understand the client factors considered by the platform, the methodology used by the platform to generate any recommendations, the factors that may alter that methodology, any highly technical or complex aspects of the methodology such as incorporation of artificial intelligence, and the service provider's procedures for testing and oversight of the methodology.

4. Subcontracting Arrangements

The proposed rule would require that the adviser determine whether the service provider has any subcontracting arrangements that would be material to the performance of the covered function. In the event of such a subcontracting arrangement, the proposed rule would also require that the adviser identify and determine how it will mitigate and manage potential risks to clients or its ability to perform advisory services in light of any such subcontracting arrangement.

Proposed rule 206(4)-11(a)(1)(iv).

In making these determinations, an adviser generally could rely on representations provided by the service provider or could develop policies and procedures with certain limitations or conditions when engaging a service provider that uses subcontractors. For example, an adviser may implement a policy that prevents the adviser from retaining a service provider that primarily relies on subcontractors to perform the covered function, or implement a procedure to audit the service provider's oversight of its subcontractors. An adviser also may enter into a written agreement with the service provider that requires the service provider to notify the adviser of any material incidents that take place at the subcontractor that may cause a failure to perform a covered function by the service provider. When determining how to mitigate and manage potential risks of outsourcing in light of any subcontracting arrangement, the adviser could consider relying on written representations the service provider makes about steps it is taking to mitigate and manage such risks.

Service providers may utilize subcontracting arrangements for any advisory services and functions, which creates a chain of service providers to an adviser. The absence of a direct relationship with a subcontractor may affect the adviser's ability to assess and manage risks that develop as a result of outsourcing. Outsourcing risks are heightened when an adviser uses service providers for “covered functions” that, by definition under the proposed rule, if not performed or performed negligently would be reasonably likely to cause a material negative impact on an adviser's clients or its ability to provide advisory services. Because the adviser ultimately has the responsibility for providing advisory services and complying with the Federal securities laws, we believe it is important that the adviser know about material subcontracting arrangements so that it can oversee the covered function properly.

Requiring the adviser to determine whether the service provider has any subcontracting arrangements might provide more visibility into the outsourcing chain by the adviser. However, we also recognize that a service provider may use a large number of subcontractors for a variety of functions or services at various points in time. As a way to balance the burden of having to determine how the adviser will mitigate and manage potential risks with respect to every subcontractor with the benefit of the adviser having some visibility into the use of subcontractors, we believe that the determination should be limited to subcontracting arrangements that would be material to the service provider's performance of the covered function. To determine whether a subcontracting arrangement is material, we believe it is appropriate generally to follow the standard used in the proposed definition of covered function. Thus, a subcontracting arrangement would be material if nonperformance or negligent performance would be reasonably likely to cause a significant negative impact on the service provider's ability to perform the covered function. A subcontracting arrangement that is subject to this standard would depend on the type of subcontractor being used and the nature and scope of the subcontracting arrangement. For example, if an adviser engaged a subadviser to manage certain of its clients' portfolios, and the subadviser outsourced some or all of its portfolio management to a subcontractor, we generally would consider this to be material because the subadviser would be outsourcing the function that the adviser had engaged the subadviser to perform. In such an instance, we believe the subcontractor's failure to perform or negligent performance of portfolio management would be reasonably likely to cause a significant negative impact on the subadviser's performance of the covered function, which would be reasonably likely to cause a material negative impact on the adviser's ability to provide its investment advisory services.

We believe that requiring this determination and risk assessment of any subcontracting arrangements that would be material to performance of a covered function is important because having a chain of providers increases the risk of lack of transparency and control by the adviser if there were an issue within the chain. We believe that to the extent a service provider uses any subcontractors that are material to the performance of its covered function, the adviser generally should conduct further monitoring and put in place risk management processes to mitigate potential harm to the adviser, and its advisory clients.

5. Compliance Coordination

The proposed due diligence provision would require an adviser to obtain reasonable assurance from a service provider that it is able to, and will, coordinate with the adviser for purposes of the adviser's compliance with the Federal securities laws, as applicable to the covered function. An adviser remains liable for its obligations, including under the Advisers Act, other Federal securities laws and any contract entered into with the client, even if the adviser outsources functions. The proposed requirement would alert the service provider to those responsibilities

and obtaining reasonable assurances would help the adviser ensure that it can continue to meet its compliance obligations despite outsourcing those functions.

For example, an adviser may rely on a service provider for part of its portfolio management function. While not required under the proposed rule, that adviser may wish to consider obtaining written assurances or written representations from the service provider that it is aware of the adviser's obligations under the Advisers Act, and that it will assist the adviser, as applicable, in complying with its obligations as a fiduciary. For additional clarity, the adviser may wish to consider articulating specific responsibilities of the service provider in relation to assisting the adviser to comply with its legal obligations. As another example, an adviser may rely on an outsourced chief compliance officer or compliance consultant for updating and filing the adviser's Form ADV, including Form CRS. Such an adviser may want to obtain assurances or representations from the service provider that it has sufficient knowledge of the adviser's business such that the adviser's Form ADV will be accurate and contain all required disclosure. In discussions with our staff regarding Form ADV compliance, some advisers have claimed ignorance of a filing not having been made, or of missing, inadequate or inaccurate disclosure, due to the adviser's reliance on an outsourced chief compliance officer or compliance consultant. Similarly, in response to our staff's requests for documents, advisers often indicate that they lack access to information necessary to demonstrate compliance with a provision of the Advisers Act and its rules or other Federal securities laws because of outsourcing. In instances where our staff has requested records demonstrating compliance with the brochure delivery rule,

some advisers that use client relationship management providers have asserted that they have complied with the rule because brochure delivery is programmed into the providers' software, though they cannot produce records to evidence that delivery took place.

See

rule 204-3.

6. Orderly Termination

The proposed rule would require an investment adviser to obtain reasonable assurance from the Service Provider that it is able to, and will, provide a process for orderly termination of its performance of the covered function.

This provision is designed to mitigate risks of an interruption in advisory services or the adviser's compliance with the Federal securities laws in the event that the outsourced relationship is discontinued. An abrupt termination of a covered function without a process to continue services in another way, transfer records, and otherwise provide a smooth transition could have a material negative impact on an adviser's clients or an adviser's ability to provide investment advisory services to clients. For example, if an adviser relied on a software provider to provide an order management and trading application for the purposes of placing orders on behalf of the adviser's clients, and the software provider abruptly terminated its services without the adviser being able to replace the provider or move the services in-house, then the termination would be reasonably likely to cause a material negative impact on the adviser's ability to provide investment advisory services. This is because the adviser may not be able to place orders at or near normal volumes or as efficiently. Such harm could be mitigated by the proposed due diligence requirement to obtain reasonable assurance from a service provider that it is able to, and will, provide a process for orderly termination of its performance of the covered function.

Proposed rule 206(4)-11(a)(2)(vi).

Orderly termination of a service provider's performance of a covered function might include the adviser ensuring that no ongoing operational and technological dependency on the service provider remains after the termination of the relationship with the service provider. For example, an adviser might consider obtaining reasonable assurance, whether through a written agreement or some other means, from the service provider that it will provide a notice of intent to terminate in a specified amount of time or other similar process so that the service provider does not abruptly terminate its services to the detriment of the adviser and its clients.

Given the variety of advisers and providers and different levels of complexity with respect to outsourced functions, the proposed rule is designed to afford advisers and service providers the flexibility to establish what would constitute “orderly” termination in light of the risks involved. The adviser must be able to stay in compliance with its obligations under the Advisers Act and its rules during and after termination. Accordingly, the process that allows for “orderly” termination generally should reflect consideration of certain factors such as the type of covered function and applicable regulatory requirements. For example, if the covered function were recordkeeping services, then the adviser should account for how to continue to stay in compliance with the regulatory requirements with respect to recordkeeping after termination of the agreement. If the covered function were valuation services, then the adviser should consider how to transition different client accounts prior to complete termination and how to stay in compliance with any valuation requirements. In addition to ensuring proper transfer or retention of records, advisers generally should consider how they would maintain operational, regulatory, or other capabilities as a result of terminating the service provider engagement.

An “orderly” termination process also should be designed to handle confidential and other sensitive information securely. The adviser and service provider generally should consider ways to ensure that no confidential data or information remains with the service provider other than that required to meet the service provider's contractual obligations or the service provider's own legal obligations, if any. For example, a service provider that performs valuation services may have been granted access to certain adviser back-office or middle-office systems and internal reports, and the adviser and service provider might wish to agree to allow for verification that the provider's access is terminated either immediately upon notification of termination or after a reasonable amount of time once all accounts have been closed by the service provider. The adviser and service provider might also agree to the return or destruction of any copies of reports or confidential information after the terms of termination are satisfied, depending on the length of time it would take.

Relatedly, an “orderly” termination process also generally should contemplate reasonable time frames to allow for timely transfer or destruction of any data, as appropriate or necessary. Such provisions would facilitate the continuity and quality of the outsourced functions in the event of termination. For example, if an adviser wants to protect its ability to change its subadviser when appropriate without undue restrictions, limitations, or cost, then the adviser generally should consider termination and transfer arrangements with reasonable time frames to allow for timely transfer of confidential adviser and client information from the original service provider to the new service provider.

In addition to ensuring the adviser stays in compliance with its regulatory

obligations during and post-termination of a relationship with a service provider, the adviser might consider provisions in a written agreement or some other form to protect itself against certain failures or breaches by the service provider such as termination rights, clear delineation of ownership of intellectual property, and the obligation of the service provider to assist and provide support for a successful and complete transition or termination.

7. Recordkeeping Provisions Related to Due Diligence

Finally, the proposal would amend the Advisers Act books and records rule to require advisers to make and retain specific records related to their due diligence assessment.

These records include a list or other record of covered functions the adviser outsourced to a service provider including the name of each service provider, the factors that led to listing it as a covered function on Form ADV, and documentation of the adviser's due diligence assessment. The due diligence records would include any policies or procedures or other documentation showing how the adviser would mitigate and manage the risks it identifies, both at a covered function and a service provider level. The proposed amendments would also revise the books and records rule to require a copy of any written agreement, including any amendments, appendices, exhibits, and attachments, entered into with a service provider regarding covered functions. The records would have to be maintained in an easily accessible place while the adviser outsources the covered function and for a period of five years thereafter.

This aspect of the proposal is designed to facilitate our staff's ability to assess an adviser's compliance with the proposed rule. We believe it would similarly enhance an adviser's compliance efforts as well.

See

proposed rule 204-2(a)(24).

See

proposed rule 204-2(e)(4).

We request comment on all aspects of the proposed due diligence requirement and corresponding proposed amendments to the Advisers Act books and records rule, including the following items:

31. Should we adopt the due diligence requirements as proposed? Are there other aspects of due diligence that should be required additionally or instead? Conversely, should we exclude any of the proposed due diligence requirements?

32. Should we require advisers to obtain third-party experts, audits, and/or other assistance to oversee a service provider when the adviser is outsourcing a function that is highly technical, or the oversight requires expertise or data the adviser lacks? For example, if an adviser is outsourcing to a service provider that provides valuation or pricing of complex or private securities, or a service provider that incorporates artificial intelligence into its services, should that adviser be required to confirm it has sufficient internal expertise to effectively oversee the service provider, and if not, obtain a third-party expert to provide such oversight?

33. Advisers are currently required under rule 206(4)-7 to have policies and procedures reasonably designed to prevent violations of the Advisers Act and rules under the Act, and this requirement would apply to the proposed rule. The proposed rule does not require additional explicit written policies and procedures related to service provider oversight. Should the rule require specific policies and procedures in addition to or instead of the requirements in the proposed rule? And if so, what specific provisions should be required? Should we also include changes to rule 38a-1 under the Investment Company Act?

34. Should we exempt certain service providers or covered functions from some or all of the due diligence requirements? If so, which service providers should we exempt, which due diligence requirements should we exempt, and why?

35. Should we exempt certain categories of advisers or service providers from the due diligence requirements, such as smaller (

e.g.,

a small business or small organization as defined in 17 CFR 275.0-7 or a small business as defined by the U.S. Small Business Administration) advisers or service providers or newly registered advisers? If so, which ones and why? Alternatively, should we provide scaled due diligence requirements, and if so, how? Would the proposed due diligence requirements raise any particular challenges for smaller or different types of advisers? If so, what could we do to help mitigate these challenges?

36. The proposed rule requires that the due diligence be conducted before the service provider is engaged. Are there reasons that due diligence cannot be completed prior to engaging a service provider? If so, please explain and provide examples. For example, should there be an exception for emergencies? How would we define emergency? Should an exception for emergencies be time-limited (

e.g.,

one month) or permitted for the duration of the emergency?

37. Are there other core factors that advisers should be required to consider in conducting due diligence? If so, what are those factors? For example, should advisers be required to confirm the financial stability of a service provider through the review of audited financials, or should certain service providers be required to provide certain third-party certifications or reports such as a Systems and Organizational Controls report

(“SOC 1”) or other internal control report? Should service providers be required to have third-party financial support, such as fidelity bonds, errors and omissions insurance, or other support? If so, what type and level of support should be required?

See

System and Organizational Controls: SOC Suite of Services, AICPA,

available at https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome.html.

38. Is it clear what we mean by identifying the “nature and scope” of the services? If not, how can it be made clearer?

39. The proposed rule is intended to provide flexibility to investment advisers in the methods they use to identify outsourcing risks. Should we dictate a specific method by which risks are identified? For example, should we require that investment advisers prioritize the identified risks and create a record of that prioritization?

40. For purposes of identifying the risks of engaging a service provider in the due diligence process, should the rule include a materiality threshold?

41. Should the rule require advisers to adopt and implement service provider risk management strategies, as proposed? Should the Commission take a different approach to address these risks instead, such as requiring disclosure of the risks to clients, or limiting the services that can be outsourced?

42. Should the proposed rule require advisers to make determinations about the service providers' competence, capacity, and resources as proposed? Should the Commission take a different approach instead? For example, should we require advisers to make reasonable assessments instead? How much independent research would advisers be able to accomplish to comply with this requirement?

43. Should the proposed due diligence books and records amendments be expanded or limited in any way? Are there alternative, explicit, or additional recordkeeping requirements we should impose?

44. The proposed due diligence provision requires that the adviser determine whether the service provider

has any subcontracting arrangements that are

material

to the service provider's performance of the covered function (emphasis added). Should we provide more guidance on the term “material”? Should we broaden the requirement to

any

subcontracting arrangements? Should we exempt or alter this requirement for service providers that are also investment advisers? Finally, should we omit the requirement that the adviser determine whether the service provider has any subcontracting arrangements?

45. The proposed due diligence provision requires an adviser to determine how it will mitigate and manage potential risks to clients or the adviser's ability to perform its services in light of subcontracting arrangements that would be material to a service provider's performance of a covered function. Should we exempt certain advisers from, alter, or delete this requirement, and if so why?

46. Is the provision requiring the adviser to obtain reasonable assurance from the service provider that it is able to, and will, coordinate with the adviser for purposes of compliance with the Federal securities laws, as applicable to the covered function, appropriate? Maintaining records required by the Federal securities laws is one component of an adviser's regulatory compliance. Is there any overlap between this provision requiring coordination for legal compliance more broadly and the proposed requirement discussed below for an adviser to obtain reasonable assurance from third-party recordkeepers to provide required records to the adviser and Commission? If so, should we address any potentially duplicative requirements?

47. Is the proposed requirement to obtain reasonable assurance that the service provider is able, and will, provide a process for orderly termination appropriate? Is it clear what we mean by “orderly?” Should we define what “orderly” means instead? If so, how should we define it?

48. Are there circumstances in which an adviser might determine that abrupt termination was reasonably necessary to protect clients? If so, should the provision requiring obtaining reasonable assurance for orderly termination of the performance of a covered function be revised to permit advisers to exercise their judgment in such cases? For advisers to registered investment companies, should abrupt termination by the adviser require notification to the investment company board?

49. Should the Commission adopt the related recordkeeping provisions as proposed or should they be changed? For example, should the time period of retention be changed to five years after the entry was made or three years after the relationship between the adviser and service provider has been terminated?

C. Monitoring

Once a service provider is engaged, the proposed rule would require the adviser to periodically monitor the service provider's performance of the covered function and reassess the retention of the service provider in accordance with the due diligence requirements of the proposed rule with a manner and frequency such that the adviser can reasonably determine that it is appropriate to continue to outsource the covered function and that it remains appropriate to outsource it to the service provider.

Monitoring is critical to an adviser's ability to discover and address problems in a timely manner, continue providing its advisory services to clients, and comply with the Federal securities laws.

For example, if an adviser is relying on a service provider's robo advice platform, the adviser generally should monitor to ensure that the platform continues to operate and adjust to client inputs as the adviser understands it should perform. The proposed monitoring obligation also helps to support an adviser's duty to monitor a client's account over the course of the relationship.

Therefore, it would be inappropriate for an adviser to take a “set-it-and-forget-it” mentality when outsourcing a function or service that the adviser has agreed to perform or would otherwise be performing itself in order to provide its advisory services or to satisfy compliance obligations.

See

proposed rule 206(4)-11(a)(2).

See

In the Matter of Virtus Investment Advisers, Inc., Investment Advisers Act Release No. 4266, at 7 (Nov. 16, 2015) (settled order) (“Virtus had no written policies and procedures for evaluating and monitoring the accuracy of third-party-produced performance information or third-party marketing materials that Virtus directly or indirectly circulated or distributed to other persons.”).

See

Standard of Conduct Release,

supra

footnote 21, at 72 (stating that the duty of care includes, among other things, the duty to provide advice and monitoring over the course of the advisory relationship).

When considering the manner and frequency of monitoring, an adviser should be mindful that it remains liable for its obligations, including under the Advisers Act, other Federal securities laws and any contract entered into with the client, even if the adviser outsources functions. If an adviser cannot sufficiently monitor a service provider, or is concerned that the service provider's actions or inactions may harm the adviser's clients or result in a regulatory violation, then the adviser may need to terminate the service provider relationship if possible. In such an instance, an adviser generally should be cognizant of any contractual limitations with a service provider that may impose additional risks on the adviser's clients or otherwise affect the adviser's analysis of whether to terminate the relationship.

The proposed monitoring requirement leverages processes similar to due diligence, which we have stated above is not a one-size-fits-all analysis. Thus, all monitoring generally should continue to take into account all of the required elements for due diligence, including the nature and scope of the service provider's services as well as the risks of engaging the particular service provider performing that function. The adviser generally should periodically evaluate the validity of its conclusions drawn during the initial due diligence process, and should adjust its monitoring to reflect changes in the functions or services the service provider is engaged to perform, industry or market changes that may affect the covered function, and also adjust to reflect the findings of any preceding monitoring. In order to continue outsourcing the service or function to the service provider, the adviser should be able to determine reasonably that the outsourcing remains appropriate.

The proposed rule would require an adviser to monitor its service providers with a manner and frequency such that the adviser reasonably determines that it is appropriate to continue (i) to outsource the covered function and (ii) to outsource to the service provider. The manner and frequency of an adviser's monitoring would depend on the facts and circumstances applicable to the covered function, such as the materiality and criticality of the outsourced function to the ongoing business of the adviser and its clients.

For example, certain functions may require periodic onsite visits where other services may be monitored remotely. Methods of monitoring could include, for example, automated scans or reviews of service provider data feeds, periodic meetings with the provider to review service metrics, or contractual obligations to test and approve new systems prior to implementation. The frequency of an

adviser's periodic monitoring also would be subject to factors such as the frequency with which the covered function is conducted, the complexity of the function, or the risk to clients of a failure to perform or of negligently performing the function.

The Commission similarly concluded that different frequencies of the required periodic re-assessment of valuation risks may be appropriate for different funds or risks.

See

Good Faith Determinations of Fair Value, Investment Company Act Release No. 34128 at 14 (Dec. 3, 2020) [86 FR 748 (Jan. 6, 2021)].

In determining an appropriate frequency of monitoring, advisers should consider whether there has been any change in the risk profile of the covered function or the service provider. For example, if a service provider announced significant layoffs of personnel, then it may be necessary for the adviser to increase temporarily or permanently the frequency and alter the manner of its monitoring to determine whether the service provider continues to have the competence, capacity, and resources necessary to perform the covered function in a timely and effective manner. Alternatively, if new laws or regulations were implemented that affected a specific function, then it similarly may be necessary to alter temporarily or permanently the frequency and manner of monitoring to determine that the service provider continues to perform its services properly.

1. Recordkeeping Provisions Related to Monitoring

Finally, the proposal would amend the Advisers Act books and records rule to require advisers to make and keep records documenting the periodic monitoring of a service provider of a covered function.

Advisers generally should consider including information such as performance reports received from the service provider, the time, location, and summary of findings of any financial, operational, or third-party assessments of the service provider, identification of any new or increased service provider risks and a summary of how the adviser will mitigate or manage those risks, any amendments to written agreements with a service provider, the adviser's written policies and procedures applicable to monitoring, a record of any changes to the nature and scope of the covered function the service provider is to perform, and a record of any inadequate or failed performance by a service provider of a covered function and responses from the adviser. The records would have to be maintained in an easily accessible place while the adviser outsources the covered function and for a period of five years after the adviser ceases outsourcing the covered function.

Like other proposed amendments to the books and records rule, this aspect of the proposal is designed to facilitate our staff's ability to assess an adviser's compliance with the proposed rule. We believe it would similarly enhance an adviser's compliance efforts as well.

See

proposed rule 204-2(a)(24)(iv).

See

proposed rule 204-2(e)(4).

We request comment on all aspects of the proposed monitoring requirement, including the following items:

50. Should we adopt the monitoring requirements as proposed? Are there other aspects of monitoring that should be required under the rule? Conversely, should we exclude any of the proposed monitoring requirements from the rule?

51. Should we prescribe the frequency of monitoring instead of requiring an adviser to monitor its service providers with a manner and frequency such that the adviser reasonably determines that it is appropriate to continue to outsource the covered function and to outsource to the service provider, as proposed? Or should we prescribe a minimum frequency of monitoring? For example should we require that monitoring of service providers be conducted monthly? Quarterly? No less than annually? Why or why not?

52. As proposed, the rule requires that advisers make and maintain records documenting the periodic monitoring of a service provider, but it does not specify the specific records that must be maintained. Should the rule identify specific records to be maintained? If so, what records should be made and maintained and why? For example, should the rule require retention of due diligence questionnaires, third party audits, memos to file, or service provider reports?

53. Should we exempt certain categories of advisers or service providers from the proposed monitoring requirements, such as smaller or newer advisers or service providers? If so, which ones and why? Alternatively, should we provide for scaled monitoring requirements by any of these categories of advisers, and if so, how?

54. Should we prescribe the manner in which monitoring is conducted? For example, should we require that advisers conduct onsite visits of service providers on a periodic basis, or that advisers require periodic written certifications of compliance on a periodic basis, or engage third-party experts to conduct formal reviews? Why or why not? Are there any other monitoring actions that we should require?

55. Should the proposed monitoring books and records amendments be expanded or limited in any way? If so, how?

D. Form ADV

Data collected from Form ADV is of critical importance to our regulatory program and our ability to protect clients and investors.

We use information reported to us on Form ADV Part 1A for a number of purposes, one of which is to allocate our examination resources efficiently based on the risks we discern or the identification of common business activities from information provided by advisers. The data disclosed in Form ADV Part 1A is structured such that it is readily used to create risk profiles of investment advisers and permits our examiners to prepare better for, and more efficiently conduct, their examinations. Moreover, the information in Form ADV Part 1A allows us to understand better the investment advisory industry as well as evaluate and form regulatory policies and improve the efficiency and effectiveness of the Commission's oversight of markets for investor protection.

Advisers use Form ADV to apply for registration with us (Part 1A) or with state securities authorities (Part 1B), and must keep it current by filing periodic amendments as long as they are registered.

See

Advisers Act rules 203-1 and 204-1. Form ADV has three parts. Part 1(A and B) of Form ADV provides regulators with information to process registrations and to manage their regulatory and examination programs. Part 2 is a uniform form used by investment advisers registered with both the Commission and the state securities authorities.

See

Instruction 2 of General Instructions to Form ADV. Part 3: Form CRS describes the requirements for a relationship summary.

See

General Instructions to Form ADV. This release discusses proposed changes to Form ADV Part 1A. To the extent that state securities authorities consider making similar changes that affect advisers registered with the states, we would forward comments to the North American Securities Administrators Association for consideration by the state securities authorities.

To enhance our ability to oversee investment advisers and provide additional public information about the use of service providers as defined in proposed rule 206(4)-11, we are proposing to amend Form ADV Part 1A to require registered advisers to identify their service providers that perform covered functions, provide the location of the office principally responsible for the covered functions, provide the date they were first engaged to provide covered functions, and state whether they are related persons of the adviser. For each of these service providers, we would also require specific information that would clarify the services or functions they provide.

This information would provide us with a better understanding of the material services and functions that advisers

outsource to service providers, would help us better understand potential broader market effects of outsourcing to service providers, and would permit us to enhance our assessment of advisers' reliance on service providers for purposes of targeting our examinations. The information also would help us identify advisers' use of particular service providers that may pose a risk to clients and investors, such as in situations where we learn that a service provider experiences a significant and ongoing disruption to its operations. Finally, the information would provide public information about advisers' use of third party service providers.

See

proposed Form ADV, Part 1A, Item 7.C., and Section 7.C. of Schedule D.

This new reporting item would appear in Item 7 of Form ADV and consistent with the scope of proposed rule 206(4)-11, would only require reporting by investment advisers registered or required to be registered with the Commission.

Currently, Item 7 requires advisers to disclose information about financial industry affiliations and activities, and to state whether they advise any private funds, and if so, provide certain information related to those private funds.

New Item 7.C. would require SEC-registered advisers to check a box to indicate whether they outsourced any covered functions to a service provider. The required reporting will be limited to covered functions that are outsourced to service providers, as defined in proposed rule 206(4)-11(b).

The determination of what is a covered function would vary depending on the facts and circumstances and, as a result, some advisers may report a service on Form ADV as a covered function while other firms may not. For those services determined to be covered functions and outsourced to one or more service providers, advisers would report more detailed information about each such service provider in new Section 7.C. of Schedule D. This would include the legal and primary business names of the service provider, the legal entity identifier (if applicable), and the address of the service provider. Having this identifying information for each listed service provider would give us a more complete picture of the extent to which the adviser's operations depend on one or more service providers, and help us consider the potential effects in the event of an industry wide failure by a particular service provider.

See

proposed rule 206(4)-11(a). We are also proposing conforming amendments to Form ADV Part 1A, General Instructions and Glossary of Terms. Because Form ADV Part 1A is submitted in a structured, XML-based data language specific to that Form, the information in proposed new Item 7.C would be structured (

i.e.,

machine-readable) as well. Advisers submitting an other-than-annual amendment to Form ADV Part 1 would not be required to update their responses to Item 7.C, even if the responses to those items have become inaccurate, which is consistent with the updating requirements for the rest of Item 7.

See

Instruction 4 to General Instructions to Form ADV.

These new Form ADV reporting requirements are being proposed in conjunction with proposed Rule 206(4)-11. Proposed rule 206(4)-11 would not apply to exempt reporting advisers, and therefore proposed Item 7.C. would not apply to exempt reporting advisers. We believe that requiring only investment advisers registered or required to be registered to complete the items we propose appropriately enhances our ability to oversee investment advisers that are subject to the proposed rule and enhances client and investor disclosure as it relates to the proposed rule.

See also

proposed rule 204-2(a)(24)(i) (requiring a record of covered functions that the adviser has outsourced to a service provider).

Section 7.C. also would require noting whether the identified service provider is a related person

of the adviser, and noting the date the service provider was first engaged. Both of these data points would be helpful to us in conducting our risk assessments for developing and targeting examinations. Knowing whether a service provider is a related person would assist us and clients or investors in understanding the conflicts of interest that may be present, and would also assist in understanding better the potential impacts of a service provider's non-performance or negligent performance. Finally, Section 7.C. would require an adviser to report those covered functions or services the service provider is actively engaged in providing from predetermined categories of covered functions or services set forth in the item. The non-exhaustive list of categories is intended to encompass those services or functions that may be commonly outsourced and could fall within the definition of a covered function. If the service or function performed by the service provider was not represented in a predetermined category, the adviser would be permitted to select “other” with a free form field to identify the unlisted category. The covered function categories that we are proposing to include in Item 7.C of Schedule D are: Adviser/Subadviser; Client Services; Cybersecurity; Investment Guideline/Restriction Compliance; Investment Risk; Portfolio Management (excluding Adviser/Subadviser); Portfolio Accounting; Pricing ; Reconciliation; Regulatory Compliance; Trading Desk; Trade Communication and Allocation; Valuation; and Other. For example, we believe regulatory compliance would generally include outsourced chief compliance officer and other compliance consultant functions.

See

Glossary of Terms to Form ADV. A related person includes “[a]ny

advisory affiliate

and any

person

that is under common

control

with your firm.”

This proposed disclosure would improve our ability to assess service provider conflicts for those service providers that perform a covered function as defined by the proposed rule, and could serve as an input to the risk metrics by which our staff identifies potential risk and allocates examination resources. The staff conducts similar analyses today, but have limited inputs, which constrains their effectiveness. For instance, it would be relevant to us to identify easily advisers using a service provider that we are separately investigating for involvement in alleged misconduct. The ability to identify readily other advisers using such a service provider would allow us to assess quickly and take appropriate actions. The proposed disclosure would also improve our ability to evaluate the adequacy and completeness of advisers' conflicts of interest disclosures by identifying additional potential sources of conflict.

The information would be publicly available as is other information on Form ADV, and we believe it may benefit the public in supplementing the information available about the adviser and may provide investors with additional context in which to consider an investment adviser's provision of advisory services. The public would be able to identify quickly and consider any implications of an adviser's use of one or more service providers or the outsourcing of any service or function. For example, if a client learns of a significant disruption at a major service provider, that client could easily and quickly determine whether its adviser uses that service provider for a service or function the client considers material and whether to take remedial action.

We request comment on the proposed Form ADV requirements:

56. Are the proposed requirements to disclose service providers that perform a covered function as defined in rule 206(4)-11 appropriate? Should we instead require all registered advisers that outsource any services to provide the specified information and then mark each service to indicate whether it is a covered function within rule 206(4)-11 or not? Or should we include a broader Form ADV reporting requirement, such as requiring all advisers (

e.g.,

exempt reporting advisers and advisers registering with state securities authorities) to provide the specified information regarding any outsourced service or function or only those that are subject to rule 206(4)-11 or any substantially similar regulation?

57. Do commenters agree with the proposed list of covered functions categories under Section 7.C of Schedule D? Do the proposed categories adequately capture the range of covered functions? Are the categories understandable? If not, which categories require additional explanation? Should we add or remove any categories? If so, please identify the category and explain why the change is appropriate. For example, should we include additional categories relating to investment data/analytics, information technology (

e.g.,

IT infrastructure or application software and support), or middle and back office functions (

e.g.,

client reporting and/or billing, performance measurement, collateral management, post-trade processing, etc.)? Alternatively, should the categories be consolidated (

e.g.,

pricing and valuation), retitled or otherwise revised? For example, do commenters agree that regulatory compliance would generally include such services as outsourced chief compliance officer and other compliance consultant functions? If not, how should the category be revised to encompass these types of outsourced functions?

58. Should we require additional or different reporting with respect to service providers that perform functions related to books and records required under rule 204-2? If so, how should reporting requirements be changed for these service providers and/or what additional information should be reported?

59. Do advisers have concerns with the public disclosure of service providers that perform covered functions? If so, what are those concerns? For example, are there categories of service providers that should not be disclosed publicly due to competitive, trade secret, compliance, or other risks? Should we require such disclosure to be reported non-publicly to the Commission in a format other than the Form ADV? If so, how?

60. Should the proposed ADV disclosure include the ability to incorporate by reference to other parts of the form? For example, should we allow advisers to cross reference private fund service providers that are currently req

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.