Client Funds and Securities

Now that you understand how advisers are compensated, the next question is: who holds the client's money and securities, and what rules govern that custody?

What Triggers Custody?

An adviser has custody when it holds, directly or indirectly, client funds or securities, or has the authority to obtain possession of them.

What triggers custody:

• Physical possession of client funds or securities
• Authority to deduct advisory fees directly from client accounts
• Acting as trustee for a client trust
• Holding login credentials that carry the authority to withdraw or transfer client assets (mere view-only access, without withdrawal/transfer authority, is not itself custody)

Can an Adviser Touch Client Assets Without Having Custody?

Yes, in two narrow situations. Assets sometimes reach an adviser's office that the adviser never asked for. The rule gives a short window to undo that, called a safe harbor. Both windows run three business days, and both carry the same second condition.

Miss either condition and the adviser has custody, with every safeguard below attached.

Exam Tip: Gotchas

• The record is a condition, not paperwork you catch up on later. An adviser who returns a certificate on day two but never records the receipt still has custody. Both halves are required.
• "Inadvertently" is doing real work in that sentence. The safe harbor covers assets that showed up unasked. Assets the adviser requested, expected, or arranged to receive were never inadvertent, so no window ever opens.
• Return goes to the sender, not onward to the custodian. Forwarding a misdirected stock certificate to the qualified custodian is not the safe harbor.
• The payee decides the second route. A client check payable to a third party may be forwarded. A client check payable to the adviser creates custody the moment it is received, no matter how fast the money reaches the custodian afterward.

What Safeguards Apply Once Custody Is Triggered?

When an adviser has custody, the SEC's IA custody rule imposes strict safeguards:

Surprise examination details:

• The accountant selects the exam date without prior notice
• Must vary the date each year
• Accountant has 120 days from the exam date to complete and file Form ADV-E with the SEC
• PCAOB registration/inspection is required only when the adviser (or a related person) itself acts as the qualified custodian for client assets; an ordinary surprise exam using an independent, unrelated qualified custodian does not require a PCAOB-registered accountant

Audit exception: Advisers to pooled investment vehicles can bypass the surprise examination if the fund undergoes an annual audit conducted under Generally Accepted Accounting Principles (GAAP) by a PCAOB-inspected accountant, with audited statements distributed to investors within 120 days of fiscal year-end.

Fee-deduction exception: Under the federal custody rule, an adviser whose only form of custody is the authority to deduct its own advisory fee from a client account is generally excepted from the independent-verification (surprise-exam) requirement. State-registered advisers should also know the NASAA model custody rule's own version of this exception, which conditions it on written client authorization to deduct fees, an itemized invoice sent to the qualified custodian and the client every time a fee is deducted, and written notice to the Administrator that the adviser is using this safeguard. Either way, this is a separate, narrower exception from the pooled-vehicle audit exception above; it applies only to fee-deduction custody, not to any other form of custody.

Exam Tip: Gotchas

• Fee-deduction custody and pooled-vehicle custody each have their own way to avoid the surprise exam. Do not assume every adviser with custody must undergo a surprise exam. Mixing up the two exceptions, or applying the pooled-vehicle GAAP-audit path to a fee-deduction-only adviser, is a common wrong answer.
• All the fee-deduction exception's conditions apply together, not individually. An adviser with written client authorization and concurrent invoices but no Form ADV notice to the Administrator does not qualify. It must arrange the annual surprise examination until the missing notice is provided.

How Do State Custody Rules Differ From the SEC's?

• NASAA Model Rule on custody: state-level custody requirements that generally mirror the SEC's IA custody rule
• NASAA Model Rule on minimum financial requirements: higher net worth or surety bonding for advisers with custody or discretion
• States may impose higher minimum net worth requirements on advisers that maintain custody

Exam Tip: Gotchas

• Custody isn't just holding a client's check. Deducting fees from a client account = custody, and so does holding login credentials with withdrawal/transfer authority (mere view-only login access is not custody). Neither trigger automatically means a surprise exam: fee-deduction-only custody has its own narrower safeguards instead, described above.

What Counts as Discretionary Authority?

Discretionary authority is the power to make investment decisions (what to buy/sell, which security, how much) without getting the client's approval before each transaction.

Memory Aid: AAA

An order is discretionary if any of these is missing:

• Asset (which security)
• Action (buy or sell)
• Amount (number of shares)

Time and price-only direction is NOT discretion.

Key requirements:

• For an investment adviser: oral discretionary authority is permitted starting with the FIRST transaction. Written authority (typically in the advisory contract or a separate limited power of attorney) must be obtained within 10 business days after that first transaction, not after every subsequent oral trade in that window. Broker-dealer agents are held to a stricter standard: prior written authority before exercising any discretion at all
• Discretion is not custody by itself, but it can trigger separate state minimum-financial-requirement obligations (higher net worth or bonding) even when the adviser never holds client assets
• Even with discretion, the adviser retains full fiduciary duties of suitability and best execution

Non-discretionary accounts:

• Adviser recommends; client approves each transaction before execution
• The adviser cannot act without prior client consent

Exam Tip: Gotchas

• Discretion means the adviser decides the security, action, and amount, NOT just timing or price. But discretion over trading does NOT remove the adviser's obligation to act in the client's best interest. Suitability and best execution still apply.

What Does the Prudent Investor Standard Require?

The Uniform Prudent Investor Act (UPIA) modernized the fiduciary standard for managing trust assets. Adopted by 44 states and D.C., it replaced the older "Prudent Man Rule."

Core principles:

• Trustees must invest and manage trust assets as a prudent investor would
• Must consider the purposes, distribution requirements, and other circumstances of the trust
• Diversification is mandatory unless circumstances specifically indicate otherwise
• Individual investments are judged in the context of the total portfolio, not in isolation
• Trustee weighs income and capital appreciation together as total return, not income alone
• Fiduciaries may delegate investment decisions to qualified agents when appropriate

Key shift from old standard: Under the old Prudent Man Rule, each individual investment was evaluated on its own. Under UPIA, the entire portfolio's risk/return profile is what matters.

Exam Tip: Gotchas

• Under UPIA, a single risky investment is not automatically imprudent. It is judged in the context of the total portfolio, not on its own.
• Diversification is required under UPIA, not just recommended. The only exception is when specific trust circumstances indicate otherwise.
• Total return is not the same as portfolio context. Portfolio context asks whether an investment's risk fits the whole portfolio; total return asks whether the trustee is weighing income and capital appreciation together, instead of maximizing income alone or preserving principal at the expense of growth.

What Are the Two Layers of Suitability?

Recommendations must be appropriate for the specific client. There are two layers of suitability analysis:

Client profile factors:

• Financial situation (income, net worth, liquidity needs)
• Investment objectives (growth, income, preservation)
• Risk tolerance
• Time horizon
• Other relevant factors (tax status, existing holdings)

Exam Tip: Gotchas

• Reasonable-basis suitability (good for at least some investors) is different from customer-specific suitability (good for this particular client). Both must be satisfied before making a recommendation.

What Does AML Compliance Require?

Financial institutions, including broker-dealers currently, must establish Anti-Money Laundering (AML) compliance programs to detect and prevent money laundering.

Key requirements (broker-dealers, today):

• SARs must be filed within 30 calendar days of initial detection; if no suspect has been identified by that date, filing may be delayed up to another 30 days, but never more than 60 calendar days after initial detection
• The $10,000 CTR threshold is per customer, per business day, not per transaction. A firm that knows multiple cash transactions belong to the same customer aggregates them: three $4,000 cash deposits on the same day total $12,000 and require a CTR, even though no single deposit exceeded $10,000

Investment advisers: FinCEN's rule extending the AML/CFT program and SAR-filing obligations to SEC-registered investment advisers and exempt reporting advisers has been delayed and is not yet in effect (currently set for January 1, 2028). It does not reach state-only registered advisers at all. A separate Customer Identification Program requirement for advisers has only been proposed and is not yet finalized. Don't treat any of these as current investment-adviser duties.

Exam Tip: Gotchas

• The two dollar thresholds are often mixed up: SARs = $5,000 (suspicious activity), CTRs = $10,000 (cash transactions).
• CTRs aggregate same-day cash transactions by the same customer. Read "exceeding $10,000" as the customer's same-day total, not each transaction in isolation.
• Tipping off a client about a SAR filing is prohibited. The client can never be informed that a report was filed.
• These are established broker-dealer obligations today. The parallel investment-adviser AML/SAR rule exists on paper but its effective date has been pushed back, and a separate adviser CIP rule remains only proposed; don't teach either as a current adviser requirement.

What Should You Check on Exam Day?

• Can you list what triggers custody besides physically holding a check (fee deduction, trustee role, withdrawal/transfer-capable login access, not mere view access)?
• Do you know the five custody safeguards (qualified custodian, quarterly statements, reasonable basis, own-statement legend, surprise exam) and the surprise exam's 120-day Form ADV-E filing window?
• Do you know the two 3-business-day safe harbors that avoid custody (inadvertent receipt returned to the sender, a third-party check forwarded on), and that a check payable to the adviser never qualifies?
• Can you name the AAA test for discretion (Asset, Action, Amount), and state that an adviser may accept ORAL authority with writing within 10 business days while a BD agent needs prior written authority?
• Do you know the SAR ($5,000, suspected activity) and CTR ($10,000, cash, aggregated same-day) thresholds, that these are BROKER-DEALER duties for now, and why tipping off a client is prohibited?