Client Funds and Securities

This file covers fiduciary duty, custody rules, discretionary authority, the prudent investor standard, and anti-money laundering requirements.

What Fiduciary Duty Do Investment Advisers Owe?

An investment adviser (IA) is a fiduciary and has a duty to act primarily for the benefit of its clients.

Fiduciary duty has two core components:

• Duty of Care - provide advice that is in the client's best interest, based on thorough understanding of the client's objectives, risk tolerance, and financial situation
• Duty of Loyalty - place the client's interests ahead of the adviser's own; fully disclose all material conflicts of interest

Key points:

• The duty applies to investment advisers, investment adviser representatives, and federal covered advisers
• The extent and nature of fiduciary duty varies according to the nature of the relationship and the circumstances of each case
• Fiduciary duty cannot be waived by the client

Exam Tip: Gotchas

• Investment advisers owe a fiduciary duty to clients. Broker-dealers owe a suitability obligation (and now Reg BI's "best interest" standard). The exam tests whether you know which standard applies to which role. An investment adviser representative (IAR) always has the higher fiduciary standard.

What Creates Custody?

Custody exists when an investment adviser (IA) directly or indirectly holds client funds or securities, or has authority to obtain possession of them.

Think of it this way: Custody is about access to client assets. If you can touch the money or securities (physically or through legal authority), you have custody and must follow strict safeguard rules.

What Situations Create Custody?

An adviser has custody if it:

• Has physical possession of client assets
• Has the ability to deduct fees directly from client accounts
• Acts as trustee for a client
• Has access to client funds through passwords or authority (but NOT read-only data aggregation)
• Has signatory power over a client's bank account or brokerage account

Exam Tip: Gotchas

• A limited power of attorney (LPOA) covering only trading = discretion, NOT custody. Custody requires authority to withdraw or transfer assets.
• "Can I touch the money?" If yes = custody. Authority to withdraw = custody, even without physical possession.

What Must an Adviser Do Once It Has Custody?

Where Must Assets Be Held?

Client assets must be maintained with a qualified custodian (bank, broker-dealer, trust company, or futures commission merchant).

How Often Must Custodians Send Statements?

The qualified custodian must send account statements to clients at least quarterly.

When the adviser opens an account with a qualified custodian on a client's behalf, it must tell the client in writing the custodian's name and address and how the assets are held, and urge the client to compare the custodian's statements against the adviser's own.

How Is the Administrator Notified?

Adviser must report custody status on Form ADV (which reaches the state Administrator through the IARD/CRD system).

What Is the Annual Surprise Examination?

An independent certified public accountant (CPA) must conduct an annual surprise examination to verify client assets. The CPA must be registered with the Public Company Accounting Oversight Board (PCAOB) only when the adviser itself acts as the qualified custodian or for the audit of a pooled investment vehicle, not for the ordinary surprise examination.

• Must be conducted at an irregular time chosen by the accountant without prior notice
• CPA has 120 days from the surprise date to file Form ADV-E with the Administrator (the state securities regulator)
• If the CPA finds a material discrepancy during the examination, it must notify the Administrator within one business day of the finding

Exam Tip: Gotchas

• Two clocks, and the exam swaps them. The 120 days is the deadline to file the exam report on Form ADV-E. A material discrepancy found during the exam is a separate, far shorter obligation: notice to the Administrator within one business day. A stem describing missing client assets is asking for one business day, not 120 days.

Audit exception: A pooled investment vehicle is exempt from the surprise examination only if every condition holds: it is audited at least annually under Generally Accepted Accounting Principles (GAAP); the audited financial statements are distributed to all beneficial owners within 120 days of fiscal year-end; the auditor is an independent CPA registered with and inspected by the PCAOB; on liquidation, the final audited statements are distributed promptly; and the engagement requires the auditor to notify the Administrator on resignation, dismissal, or removal.

What Are the Minimum Financial Requirements?

State-registered advisers with custody or discretion must maintain a minimum net worth for the firm itself (not the client's net worth):

Exam Tip: Gotchas

• Deducting advisory fees directly from a client's account = custody. Many advisers do not realize this. But there's a carve-out: an adviser whose ONLY custody is fee deduction is exempt from the annual surprise examination if it has written client authorization, sends an invoice to the custodian and the client each time it deducts, and notifies the Administrator it relies on this safeguard. The other custody duties (qualified custodian, quarterly statements, etc.) still apply.
• This is the adviser's net worth, not the client's. A client's own net worth is never a factor in these requirements.
• Using the client's own username and password to access their account is an unethical business practice.

What Is the Commingling Prohibition?

The NASAA Statement of Policy on Dishonest or Unethical Business Practices prohibits commingling client assets with the firm's own proprietary assets. The rule applies to both broker-dealers and investment advisers, regardless of whether the firm has full custody or only fee-deduction authority.

• Commingling is mixing client and firm assets in the same account
• Record-keeping alone is NOT sufficient; actual account separation is required
• Commingling is prohibited even if no client assets are lost or misused
• Commingling vs. conversion: commingling is mixing assets; conversion is taking client assets for personal use. Conversion is the more severe violation, but commingling is independently prohibited.

What Is Proper Safekeeping via Street Name Segregation?

When customer securities are held by a broker-dealer or qualified custodian, they are typically registered in the firm's name (or its nominee). This is known as street name registration. The customer remains the beneficial owner with all economic rights (dividends, voting, gains and losses).

To satisfy safekeeping obligations, customer securities held in street name must be in segregated accounts physically separate from the firm's proprietary holdings.

Exam Tip: Gotchas

• Commingling does not require a loss. The violation occurs the moment client and firm assets are placed in the same account, even if every dollar is later returned.
• Internal tracking does not cure commingling. A firm cannot keep client funds in its operating account "with notations" identifying which dollars belong to which client. The accounts must be physically separate.
• Street name in a segregated account is proper safekeeping, not commingling. The customer retains beneficial ownership; the firm's name appears only for operational and settlement convenience.

What Distinguishes Discretionary From Non-Discretionary Accounts?

What Is Discretionary Authority?

The adviser determines which security to buy/sell, in what quantity, and when, WITHOUT obtaining prior client approval for each transaction.

Memory Aid: AAA

An order is discretionary if any of these is missing:

• Asset (which security)
• Action (buy or sell)
• Amount (number of shares)

Why Isn't Time and Price Discretion?

If the client chooses the security and quantity and only delegates timing/price, this is NOT discretionary, and no power of attorney is required.

What Are the Authorization Requirements?

• Written discretionary authority must be obtained within 10 business days of the first transaction placed under oral discretionary authority
• Determining only price or time of execution (not what or how much to trade) does not constitute discretion

What Is Third-Party Trading Authorization?

• Placing orders on instruction of a third party requires written third-party trading authorization from the client
• Example: a family member calling to place trades in the client's account needs prior written authorization
• A limited trading authorization lets the third party buy and sell securities, but does not let them withdraw cash or securities
• A full trading authorization lets the third party buy, sell, and withdraw cash or securities from the account
• Even full trading authorization does not make the third party the account owner; ownership-level changes, such as changing a beneficiary, still require the client's direct action

Exam Tip: Gotchas

• If a client says "buy some tech stocks when you think the time is right," the adviser is exercising discretion (choosing security, amount, and timing). The adviser must obtain written discretionary authority within 10 business days of the first trade. Verbal authority covers the gap but only for 10 business days.
• Limited = trade only; full = trade plus withdraw. Full trading authorization creates custody because the adviser has authority to obtain client assets.

What Standard of Care Applies to Recommendations?

IAs must have reasonable grounds to believe a recommendation is suitable based on:

• Client's investment objectives
• Financial situation and needs
• Information furnished by the client after reasonable inquiry
• Any other information known to the adviser

Suitability obligation applies to each recommendation, not just account opening.

What Are the UPIA's Core Principles?

How compliance is judged: the UPIA measures a trustee's decisions against the facts and circumstances that existed at the time of the decision, not by hindsight. An investment that turned out badly is not thereby imprudent.

Exam Tip: Gotchas

• Judgment is made at the time of the decision, never with hindsight. A stem that walks you through a loss and asks whether the trustee breached is usually testing this. Ask what the trustee knew and how they decided, not how it ended.
• Impartiality is not equal treatment. The trustee balances differing interests among beneficiaries; it does not mean giving each one an identical outcome.
• Under UPIA, a speculative stock is not automatically imprudent. It depends on how it fits within the total portfolio. The old "prudent man" rule judged each investment individually; the UPIA judges the portfolio as a whole. The exam frequently tests this distinction.
• Total return is not the same as portfolio context. Portfolio context asks whether an investment's risk fits the whole portfolio; total return asks whether the trustee is weighing income and capital appreciation together, instead of maximizing income alone or preserving principal at the expense of growth.

What Are the Anti-Money Laundering Requirements?

The Bank Secrecy Act (BSA) requires financial institutions to assist in detecting and preventing money laundering. A FinCEN final rule will bring investment advisers (Securities and Exchange Commission (SEC)-registered investment advisers (RIAs) and exempt reporting advisers (ERAs)) within the BSA definition of "financial institution."

This rule is not yet in effect: the original January 1, 2026 effective date was pushed back two years to January 1, 2028, and FinCEN has said it may further tailor the rule before then.

What Are the Key AML Requirements?

The $10,000 CTR threshold is not per transaction, it's per person, per business day. If a financial institution knows that multiple cash transactions belong to the same customer, it aggregates them.

Example: a customer makes three $4,000 cash deposits at the same bank on the same day. That's $12,000 in same-day cash activity, so the bank files a CTR, even though no single deposit crossed $10,000 on its own.

How Does CIP Verify a Client's Identity?

The Customer Identification Program (CIP) rule requires broker-dealers and banks to verify each new customer's identity using documentary or non-documentary methods, or a combination of both:

• Documentary methods: an unexpired government-issued photo ID (driver's license, passport) for an individual; formation documents (articles of incorporation, business license) for an entity
• Non-documentary methods: checking references with other financial institutions, obtaining a financial statement, or independently verifying identity through a credit bureau or public database

Non-documentary methods exist specifically for a customer who cannot present an unexpired government-issued photo ID, is unfamiliar to the firm, or opens the account without appearing in person. A missing photo ID does not by itself block account opening if a non-documentary method can establish identity.

Exam Tip: Gotchas

• Same-day transactions by the same person are aggregated for CTR purposes. Three $4,000 deposits at the same bank on the same day add up to $12,000 and require a CTR, even though each individual deposit is under $10,000. Read "cash transactions exceeding $10,000" as the customer's same-day total, not each transaction in isolation.
• Structuring (breaking up deposits to stay under $10,000 each) is itself a federal crime, even if the underlying funds are legitimate. A client who deposits $9,500 on Monday and $9,500 on Tuesday to avoid the CTR is committing structuring. This is different from the aggregation rule above: aggregation is the bank combining same-day deposits it already knows about; structuring is the customer deliberately spreading deposits out (often across days) specifically to keep each one under the threshold.
• CIP is codified as a broker-dealer and bank obligation; the standalone-adviser CIP rule referenced above remains only proposed. Know the verification mechanics as general AML knowledge: a client who cannot produce a government-issued photo ID is verified through non-documentary methods (credit check, reference from another institution), not turned away, and not asked for a notarized affidavit or a family member's verbal confirmation; neither is an accepted CIP method.

What Should You Check on Exam Day?

• Fiduciary duty (Duty of Care + Duty of Loyalty) applies to IAs, IARs, and federal covered advisers, and cannot be waived by the client
• Custody is created by physical possession, fee-deduction authority, trustee status, account access via passwords, or signatory power; a trading-only LPOA is discretion, not custody
• Custody requires a qualified custodian, quarterly client statements, written notice to the client of the custodian's name/address and how assets are held, notice to the Administrator on Form ADV, and an annual surprise examination (CPA files Form ADV-E within 120 days), except fee-deduction-only custody with the specific safeguards in place
• Minimum net worth: $35,000 for advisers with custody, $10,000 for advisers with discretion only, and positive net worth for prepaid fees of more than $500 per client collected six months or more in advance
• Commingling client and firm assets is prohibited even without loss; internal tracking does not cure it, but proper street-name segregation is not commingling
• Discretionary authority requires all three of asset, action, and amount; written authority is due within 10 business days of the first trade under oral authority
• Full trading authorization (trade plus withdraw) creates custody; limited trading authorization (trade only) does not
• Under the UPIA, investments are judged by their role in the total portfolio, not in isolation; diversification is a duty; and the trustee weighs income and capital appreciation together as total return, not income alone
• The UPIA also imposes impartiality between two or more beneficiaries with differing interests, and limits the trustee to appropriate and reasonable costs; compliance is judged at the time of the decision, never by hindsight
• A material discrepancy found during the surprise examination goes to the Administrator within one business day, separate from the CPA's 120-day Form ADV-E filing
• CIP verifies identity through documentary methods (government-issued photo ID) or non-documentary methods (credit check, institutional reference); a missing photo ID alone does not block account opening
• CTR filing is triggered by a customer's aggregated same-day cash transactions exceeding $10,000, not by each transaction individually, and the report is due within 15 days; a SAR is a separate report for suspicious activity ($5,000+)