Do You Have Custody AND Are You Compliant? Part II
Main Contributor: Elizabeth Cope, CPA, CSCP, CIPM, CEO & Lead Consultant
Let’s Continue with the Examples and Tips, Shall We?
If you haven’t checked out the initial article of this custody series, “Do You Have Custody and Are You Compliant? PART I,” I suggest you go back and review it first, as it sets the stage for the content in this second article. Here, I continue to explore more complex examples and application tips to comply with the custody rule requirements.
Money Movement - Custody
In the first article, I just covered the easy stuff. This is when it starts to get really confusing, so buckle up. The SEC has distinguished custody and the requirements between first- and third-party money movement authorities of the advisor. What they haven’t done is define first and third party, but the basic understanding is that first party is going to be liked named accounts and third party will be from one account to another account not in the same name (with some twists).
If you have the authority to move money from the client’s account to a third party, through a Standing Letter of Authorization (“SLOA”), Schwab MoneyLink®, ACH authority, or similar authority provided by written instructions you WILL be deemed to have custody.
Examples of third-party transfers:
Jon and Jane Smith Checking —> Jon Smith IRA
Jon Smith IRA —> IRS
What’s required?
Have written policies and procedures in place to mitigate the risks of having access to client funds, including Red Flags Identify Theft Prevention policies.
Disclose in ADV Part 1, Item 9 that you have custody by addressing the relevant questions.
Disclose in ADV Part 2A, Item 15 how you have custody and the controls in place.
Comply with the books and records requirements (identified at end of this article).
You will NOT have to obtain a surprise custody examination if the following criteria are met:
Client provides instruction to the custodian, in writing, that includes the client’s signature, the third party’s name, and either the third party’s address or account number for which the money would be transferred.
Client authorizes the RIA, in writing, either on the qualified custodian’s form or separately, to direct transfers to the third party either on a specified schedule or from time to time.
The client’s custodian performs appropriate verification of the instruction, such as a signature review or other method to verify the client’s authorization and provides a transfer of funds notice to the client promptly after each transfer.
The client has the ability to terminate or change the instruction to the client’s qualified custodian.
The RIA has NO authority or ability to designate or change the identity of the third party, the address, or any other information about the third party in the client’s instructions.
The RIA maintains records showing that the third party is not a related party of the RIA or located at the same address as the RIA.
The client’s custodian sends the client, in writing, an initial notice confirming the instruction and an annual notice reconfirming the instructions.
You WILL have to obtain a surprise custody examination annually by an independent accountant (they do not have to be subject to the oversight and examination of PCAOB) if you do not meet all 7 criteria listed above. I will state that in my experience, the custodian can in almost all cases support all but one of the requirements: whether or not the third party is a related party of your firm. If the third party is a related party, you will have to obtain the surprise custody exam.
Money Movement - Not Custody
If you have the authority to move money from the client’s account to a first party, through a SLOA, Schwab MoneyLink®, ACH authority, or similar authority provided by written instructions you WILL NOT be deemed to have custody.
Examples:
Jon and Jane Smith Trust —> Jon and Jane Smith Checking
Jane Smith Checking —> Jane and Jon Smith Taxable Account (moving money from a single to a joint has been viewed as first party)
Smith Trust (Jon = trustee; Jane = beneficiary) —> Jane Smith Checking (if Jane is explicitly identified as the beneficiary in legal documents it may be considered as first party)
What’s Required?
Maintain written authorization, signed by the client, that includes both the account numbers and the names of sending and receiving custodians.
Keep a copy of the authorization with you and the sending custodian.
Develop written policies and procedures for the review of authorizations imposed on you.
Note: When in doubt, consider the money movement as third party, disclose as if you have custody, and confirm that all 7 criteria are being met to avoid the surprise custody examination, keeping in mind that if the party receiving the funds is related, you have to obtain the surprise custody examination regardless.
Trustee - Custody
If you or any supervised person acts as trustee for an advisory client, you WILL be deemed to have Custody.
What’s required?
Must obtain a surprise custody examination annually by an independent accountant (they do not have to be subject to the oversight and examination of PCAOB).
Have written policies and procedures in place to mitigate the risks of having access to client funds.
Disclose in ADV Part 1, Item 9 that you have Custody by addressing the relevant questions.
Disclose in ADV Part 2A, Item 15 how you have custody and the controls in place.
Comply with the books and records requirements (identified at end of this article).
Note: Trustee is most common, but acting as executor or conservator also applies.
Trustee – Not Custody
If you or any supervised person acts as trustee for an advisory client only as a result of family or personal relationship and not as a result of employment with your firm or there is a co-trustee that is an independent qualified custodian, you WILL NOT be deemed to have custody.
What’s required?
Have written policies and procedures surrounding the approval and reporting of these types of relationships.
Maintain the support necessary to substantiate the family or personal relationship.
For co-trustee relationships, maintain written consent from all trustees for the withdrawal of assets.
401(K) Plan for Advisory Employees – Custody
If BOTH a) a related person or your advisory firm acts as trustee AND b) your firm is the investment manager making the recommendations to the 401(K) Plan of the firm and its employees you WILL be deemed to have custody.
What’s required?
Must obtain a surprise custody examination annually by an independent accountant (they do not have to be subject to the oversight and examination of PCAOB).
Disclose in ADV Part 1, Item 9 that you have custody by addressing the relevant questions.
Disclose in ADV Part 2A, Item 15 how you have custody and the controls in place.
Comply with the books and records requirements (identified at end of this article).
401(K) Plan for Advisory Employees – Not Custody
You WILL NOT be deemed to have custody if:
Your firm is the investment advisor to the plan, but an independent (not related) party acts as the trustee,
Your advisory firm is the trustee, but an independent firm is acting as the investment advisor, or
The plan is self-directed.
Client Login Credentials – Custody
If your firm or any supervised person is in possession of client login credentials for custodian or third-party websites that grant unrestricted access to client funds, you WILL be deemed to have custody.
What’s required?
Must obtain a surprise custody examination annually by an independent accountant (they do not have to be subject to the oversight and examination of PCAOB).
Have written policies and procedures in place to mitigate the risks of having access to client funds.
Disclose in ADV Part 1, Item 9 that you have custody by addressing the relevant questions.
Disclose in ADV Part 2A, Item 15 how you have custody and the controls in place.
Comply with the books and records requirements (identified at end of this article).
Note 1: Some custodians and third-party websites have dual-factor authentication set up where the client has to approve your access each time you enter. The SEC has not explicitly specified whether this exempts your firm from having custody. I would recommend you still consider yourself to have custody and follow the aforementioned requirements.
Note 2: If your access is limited to trading authority only, you will NOT be deemed to have custody. But if with that access you have the ability (doesn’t mean you actually do it) to change the address or have any general access to funds you WILL be deemed to have custody.
Digital Assets – Custody
If your firm or any related party has any arrangement where you have the authority or are permitted to withdraw Bitcoin or other digital currencies from a client’s account (wallet) you WILL be deemed to have custody.
What’s required?
Must obtain a surprise custody examination annually by an independent accountant (they do not have to be subject to the oversight and examination of PCAOB).
Have written policies and procedures in place to mitigate the risks of having access to client funds.
Disclose in ADV Part 1, Item 9 that you have custody by addressing the relevant questions.
Disclose in ADV Part 2A, Item 15 how you have custody and the controls in place.
Comply with the books and records requirements (identified at end of this article).
Private Fund – Custody
If you (the advisor) or a related party acts as a general partner (or similar capacity) to a private fund that your firm is also the investment manager for, you WILL be deemed to have custody.
What’s required?
Have written policies and procedures in place to mitigate the risks of having custody in this capacity.
Disclose in ADV Part 1, Item 9 that you have custody by addressing the relevant questions.
Disclose in ADV Part 2A, Item 15 how you have custody and the controls in place.
Option 1: Obtain a surprise custody examination annually by an independent accountant (they do not have to be subject to the oversight and examination of PCAOB); however, you must also confirm that all assets are held at an independent qualified custodian that is delivering account statements directly to the investors or independent representative of the fund on at least a quarterly basis.
Option 2: Obtain a financial statement audit by an accounting firm that is subject to the oversight and examination of PCAOB and deliver those audited statements to the investors within 120 days (180 days for a fund of funds) following the fund’s fiscal year-end. The assets do not need to be held with a qualified custodian that is sending statements to the investors (however common practice is to still have the assets held at the custodian unless they are privately held).
Privately Offered Securities Held by the Private Fund:
If you are obtaining a financial statement audit, it is OKAY for privately offered securities to NOT be held at a qualified custodian, as long as the following criteria are met:
What’s required?
Must be transferable only with the prior consent of the issuer or holders of the issuer’s outstanding securities, and the private stock certificate must contain a legend restriction transfer.
Ownership of the security must be recorded on the books of the issuer or its transfer agent in the name of the client.
The private stock certificate must be appropriately safeguarded by the Adviser.
Must be able to replace upon loss or destruction.
Related Custodian – Custody
If your firm has custody AND is related to or IS the qualified custodian for its advisory clients, additional requirements must be met:
What’s required?
Must obtain a surprise custody examination annually by an independent accountant (this time they MUST be subject to the oversight and examination of PCAOB).
Have written policies and procedures in place to mitigate the risks of having the related party.
Disclose in ADV Part 1, Item 9 that you have custody by addressing the relevant questions.
Disclose in ADV Part 2A, Item 15 how you have custody and the controls in place.
The custodian must also obtain an internal control report, annually, prepared by an independent accounting firm both registered and subject to the examination of the PCAOB, unless the custodian is considered operationally independent.
Comply with books and records requirements (identified at end of this article).
Books and Records Requirements
A journal or other record showing all purchases, sales, receipts, and deliveries of securities (including certificate numbers) for such accounts and all other debits and credits to such accounts.
Copies of confirmations of all transactions effected by or for the account of any such client.
A record for each security in which any such client has a position, which record shall show the name of each such client having any interest in such security, the amount or interest of each such client, and the location of each such security.
A memorandum describing the basis upon which you have determined that the presumption that any related person is not operationally independent under §275.206(4)-2(d)(5) has been overcome.
Conclusion
Though custody can be an overwhelming and complex topic, we hope this breakdown of requirements and application tips has proven helpful in navigating your firm’s custody situations. Take it slow and analyze each situation to ensure you are adequately complying with the requirements. Tedious as it may seem, it will help you in the long term, especially during an SEC exam.