Almost every registered adviser has a code of ethics. Far fewer operate one. The document gets adopted at registration, everyone signs the acknowledgement, it goes into a folder, and the firm moves on believing the requirement is met. Then an examiner asks to see the last four quarters of access person transaction reports and the CCO’s review notes, and the gap between having a code and enforcing one turns into a finding.
That gap is the whole subject. Rule 204A-1 is not satisfied by the existence of a code. It is satisfied by a process: identifying who is covered, collecting their holdings and trades on a fixed schedule, and actually reviewing what comes in. The firms that get cited are rarely the ones with no code. They are the ones with a code nobody ran.
The short answer: Rule 204A-1 requires every SEC-registered investment adviser to adopt a written code of ethics that sets a standard of conduct reflecting the firm’s fiduciary duty, requires compliance with federal securities laws, and requires the firm’s access persons to report their personal securities holdings and transactions so the firm can review them for conflicts. Adopting the code is step one. Enforcing the reporting and reviewing the reports is where compliance is actually won or lost.
What is an RIA code of ethics under Rule 204A-1?
The code of ethics rule, adopted by the SEC in 2004 and effective in 2005, requires every adviser registered with the SEC to establish, maintain, and enforce a written code of ethics. At a minimum, the code must contain five things:
- A standard of business conduct that reflects the firm’s fiduciary obligations and those of its supervised persons. The code is downstream of fiduciary duty, not a substitute for it.
- A requirement that supervised persons comply with applicable federal securities laws.
- Personal securities reporting by access persons, covering both holdings and transactions, submitted to the CCO or another designated person.
- Pre-approval of certain investments, specifically initial public offerings and limited offerings, before an access person acquires them.
- Prompt internal reporting of violations of the code, plus delivery of the code and any amendments to every supervised person and a written acknowledgment of receipt from each.
Notice the split built into the rule. The standard of conduct, the securities-law compliance obligation, and the acknowledgment apply to all supervised persons. The reporting and pre-approval obligations apply specifically to access persons. Getting that distinction right is the first place firms go wrong, because it decides whose trades you have to collect.
Who is an “access person,” and why firms scope it wrong
An access person is any supervised person who has access to nonpublic information about clients’ securities transactions or portfolio holdings, or who is involved in making securities recommendations to clients or has nonpublic access to those recommendations. If providing investment advice is the firm’s primary business, the rule presumes that all of the firm’s directors, officers, and partners are access persons.
The common failure is under-scoping. A firm decides that an operations hire or a junior team member “does not really trade” or “does not make recommendations,” leaves them off the access person list, and therefore never collects their reports. The rule does not turn on whether someone trades. It turns on access to information. Someone who can see model changes before they are executed, or who supports the portfolio team, may be an access person even if they never place a personal trade in their life.
Over-scoping has a cost too, in the form of collecting and reviewing reports you did not need, but under-scoping is the one that produces findings. When you are unsure, the defensible move is to designate and document your reasoning, not to quietly exclude. Maintaining an accurate, dated access person list is itself a recordkeeping obligation, which is why this belongs inside your live compliance program and your trade monitoring workflow rather than in a static list someone built once.
What access persons must report: holdings and transactions
The rule requires two kinds of reports, on two different clocks. This is the mechanical heart of 204A-1, and the timing is exact.
- Holdings reports. An access person must submit an initial holdings report within 10 days of becoming an access person, and at least annually after that. The information in each report must be current as of a date no more than 45 days before the person became an access person (for the initial report) or before the report is submitted (for the annual report).
- Transaction reports. An access person must submit a report of personal securities transactions no later than 30 days after the end of each calendar quarter, covering every reportable transaction during that quarter.
Two nuances save firms real work and are worth building into the policy deliberately. First, not everything is reportable. The rule excludes direct obligations of the US government, money market instruments and other high-quality short-term debt, shares of money market funds, and shares of most open-end mutual funds, unless your firm or an affiliate advises or underwrites the fund. That is why “I only own index mutual funds and Treasuries” is often a true statement that still requires the person to be on the list and confirm it. Second, the rule provides relief where the firm already receives duplicate brokerage statements or confirmations containing all the required information, and for transactions in accounts over which the access person has no direct or indirect influence or control, and for automatic investment plans.
Here is the part firms skip, and it is the part examiners check. Collecting the reports is not enough. The rule requires the firm to review them. A stack of unread transaction reports is arguably worse than none, because it documents that the firm had the information needed to catch a conflict and did not look. Reviewing for front-running, for trading ahead of client transactions, and for patterns that suggest misuse of information is the entire point of the reporting regime, and it is where real personal trading compliance lives, well beyond the signed acknowledgment.
Pre-clearance, IPOs, and private placements: the rule versus firm practice
This is where accurate scoping of the obligation matters, because a lot of what firms call “the code of ethics rule” is actually their own added policy, and confusing the two leads to sloppy enforcement.
What the rule itself mandates is narrow: an access person must get the firm’s pre-approval before acquiring beneficial ownership of a security in an initial public offering or a limited offering, which in practice means private placements. That is the specific pre-approval 204A-1 requires.
Broader controls, meaning pre-clearance of all personal trades, restricted lists, blackout periods around client transactions, and holding-period requirements, are common, sensible, and often expected of larger or higher-risk firms. But most of them are firm-adopted best practice built on top of the rule, not line items the rule spells out. That distinction matters for two reasons. It keeps you honest about what is legally required versus what you chose to promise, and whatever you put in your code becomes enforceable against you. An examiner will hold you to your own code. If you wrote a pre-clearance requirement into it and then did not pre-clear, you created your own deficiency. Write the controls you will actually run, and run the controls you write.
The part that fails an exam: enforcement, review, and records
Personal trading and code of ethics deficiencies are a recurring feature of the most common SEC exam deficiencies, and they almost never look like fraud. They look like process decay. Late transaction reports that no one chased. An access person list that was never updated after three hires. Annual holdings reports that came in but show no evidence of review. A pre-clearance policy in the code that the firm stopped following two years ago.
Records are what turn a good process into a defensible one. Amended Rule 204-2 requires you to keep your code, records of violations and how they were resolved, the personal securities reports, your access person list, records of pre-approval decisions, and the signed acknowledgments, generally for five years. If you cannot produce the review trail, the SEC’s position is effectively that the review did not happen. This is the same evidentiary logic that governs books and records across your whole program: compliance you cannot evidence is compliance you cannot defend.
The reason so many firms let this decay is not negligence. It is that the manual version of this workflow, chasing brokerage statements, transcribing trades, matching them against client activity, and logging reviews by hand, scales badly the moment the firm adds people. Moving from spreadsheets to automated data feeds is how firms keep the process alive as they grow, which is the practical case for automating employee trade monitoring rather than relying on quarter-end heroics.
How to operationalize a code that survives an exam
A code of ethics that holds up is less about wording and more about cadence. Build the process, then let the document describe it, not the other way around.
- Identify and document access persons. Maintain a dated list, revisit it whenever you hire or change roles, and record why anyone advising-adjacent is or is not included.
- Set the reporting calendar and enforce it. Initial holdings within 10 days, annual holdings each year, transaction reports within 30 days of quarter end. Put the deadlines on a schedule with reminders, not in someone’s memory.
- Actually review, and prove it. Review holdings and transactions for front-running and conflicts, and leave a dated record of each review. The review trail is the deliverable.
- Match your pre-approval and pre-clearance controls to what you will run. Require IPO and limited-offering pre-approval as the rule demands. Add broader controls only if you will consistently follow them.
- Distribute, acknowledge, and retain. Deliver the code and amendments to every supervised person, collect written acknowledgments, and keep the full record set for five years.
The firms that pass this cleanly are not the ones with the longest codes. They are the ones whose access person list is current, whose reports arrive on time, and whose review notes exist. Treat the code as a running system inside your RIA compliance software, and the exam question answers itself.
Frequently asked questions:
Rule 204A-1 under the Investment Advisers Act of 1940 requires every SEC-registered investment adviser to adopt, maintain, and enforce a written code of ethics. The code must set a standard of business conduct, require compliance with federal securities laws, require access persons to report personal securities holdings and transactions, require pre-approval of IPOs and limited offerings, and be delivered to and acknowledged by all supervised persons.
An access person is any supervised person with access to nonpublic information about clients’ securities transactions or holdings, or who is involved in or has nonpublic access to securities recommendations. If the firm’s primary business is investment advice, its directors, officers, and partners are presumed to be access persons.
All employees and others subject to the firm’s supervision are supervised persons, and the code’s standard of conduct and acknowledgment requirements apply to all of them. Access persons are the subset with access to sensitive information, and only they are subject to the personal securities reporting and pre-approval requirements.
Two. A holdings report, submitted initially within 10 days of becoming an access person and at least annually thereafter, current as of a date within 45 days. And a transaction report, submitted no later than 30 days after the end of each calendar quarter.
The rule excludes direct US government obligations, money market instruments and other high-quality short-term debt, money market fund shares, and shares of most open-end mutual funds, unless your firm or an affiliate advises or underwrites the fund. Reporting relief also applies where the firm already receives complete duplicate statements, for no-influence accounts, and for automatic investment plans.
No. The rule requires access persons to obtain pre-approval only for initial public offerings and limited offerings. Broader controls such as full pre-clearance, restricted lists, and blackout periods are firm-adopted best practices, and once written into your code they become enforceable against your firm.
Under Rule 204-2, advisers must retain the code, records of violations and their resolution, personal securities reports, the access person list, pre-approval records, and signed acknowledgments, generally for five years.
