State to SEC: Everything You Need to Know Before You Cross $100M

— Jamila Mayfield, Chief Regulatory Services Officer, Comply

Jamila’s advice gets to the heart of what it means to be SEC-ready: take initiative, show intent, and document your diligence. A mock exam is evidence that your firm is serious about oversight and willing to invest in doing things right. That kind of preparation builds trust with regulators and clients alike.

Comply’s review of the 2026 SEC Exam Priorities echoes this approach. The SEC emphasizes fiduciary responsibility, cybersecurity, data protection, and marketing accuracy. The firms that get ahead now will enter the SEC landscape with confidence.

The Transition: What You Need to Know

Before building an SEC-ready compliance program, firms need to understand when the requirement kicks in, how to file, and what changes on the other side.

When are you required to register with the SEC?

Generally, RIA firms must register with state regulators if they manage less than $100 million in AUM. The Dodd-Frank Act, signed into law in 2010, raised this threshold from $25 million to $100 million for most states — shifting a significant number of mid-sized firms into state oversight and defining the landscape firms operate in today.

The $100M–$110M window: Under Rule 203A-1, a firm may — but is not required to — register with the SEC once it reaches $100 million in regulatory AUM. A firm is not required to withdraw its SEC registration unless its AUM falls below $90 million. This window gives firms flexibility around transition timing.

New York exception: A mid-sized adviser in New York with AUM between $25 million and $100 million is generally required to register with the SEC rather than the state if its primary office is in New York.

Other paths to SEC registration:

• Reaching $100M in AUM is the most common trigger, but there are other ways to qualify:
• Multi-state registration: Advisers required to register in 15 or more states may register with the SEC instead, regardless of AUM.
• Internet-only advisers: Firms operating exclusively online may be eligible for SEC registration rather than individual state registration.
• 120-day window: Firms that reasonably expect to qualify for SEC registration within 120 days may apply under this exemption.

Key Changes After You Register

IAR registration: Individual investment adviser representatives (IARs) do not register with the SEC — only the firm does. IARs still register at the state level, but the rules shift once their firm is SEC-registered. Most states only require an IAR to register where they are physically located, rather than in every state where clients reside. This can meaningfully reduce IAR registration fees.

Notice filing: Most states require a notice filing when a firm transitions to SEC registration. Most states follow the same de minimis exemptions for SEC-registered RIAs as for state-registered ones, though a few exceptions apply. Confirm requirements for each state where your firm operates or has clients.

Form ADV updates: SEC-registered firms serving retail investors must file a Form CRS (Part 3 of Form ADV), covering fees, conflicts of interest, and standards of conduct, via the Investment Adviser Registration Depository (IARD). Form ADV Part 2A (the Firm Brochure) must also be amended to reflect SEC requirements, and notice filings via Form ADV Part 1A must be submitted to applicable states.

EDGAR filings: Firms with $100M+ in AUM may need to file Form 13F quarterly via EDGAR if they qualify as institutional investment managers. Other Section 13 and 16 filings may apply depending on your firm’s holdings and structure.

Understanding the Shift: What Changes at $100M

Crossing $100M in AUM requires firms to register with the SEC and will be under deeper scrutiny. Firms transitioning from state oversight should prepare to align with the SEC’s broader, more rigorous expectations.

The 2026 SEC Exam Priorities highlight that examiners assess not only technical compliance but also the robustness of a firm’s culture, governance, and data integrity.

The Core Differences Between State and SEC Oversight

• Broader Scope: The SEC evaluates firms holistically, from governance and operations to marketing, cybersecurity, and data protection. Your compliance program should function as an integrated system, rather than a series of isolated tasks.
• Fiduciary Duty Focus: The SEC places greater emphasis on whether a firm acts in clients’ best interests. Examiners closely review fee structures, conflicts of interest, and the adequacy of disclosures.
• Marketing Rule Enforcement: The SEC continues to prioritize enforcement of its Marketing Rule, with focus on substantiation of performance claims and adherence to disclosure standards. Firms relying on outdated templates or informal review processes may face elevated scrutiny.
• Data Protection and Cybersecurity: A core element of becoming “SEC ready” before crossing $100M is implementing strong data protection controls. In line with 2026 regulatory priorities, examiners are focusing on compliance with Regulation S-P and Regulation S-ID, including evidence of written policies for safeguarding non-public client information. SEC examiners expect firms to demonstrate how they store, access, protect, and monitor client data, and how they respond to unauthorized access events.
• Technology and Recordkeeping: SEC registrants must be able to demonstrate secure and retrievable archiving of all business-related communications, including emails, texts, and social media. Ad hoc storage solutions or local email clients like Outlook alone are insufficient.

What Examiners Will Be Looking For

• A documented compliance framework that links written policies to actual practice
• Evidence of ongoing testing including: mock exams, risk assessments, and reviews
• Role-specific training tailored to business functions
• A demonstrable culture of compliance modeled by firm leadership and visible in daily decision-making

How to Prepare Now

• Start early: Map your state-level obligations to SEC equivalents and identify gaps.
• Prioritize high-impact areas: Fiduciary conduct, cybersecurity readiness, and marketing oversight remain top focus areas in 2026.
• Document everything: The SEC values evidence. Ensure updates to policies, tests, or training are tracked and retrievable.

Firms that treat this transition as an opportunity to modernize compliance infrastructure are more likely to exceed expectations. Building readiness now allows firms to approach federal oversight with confidence.

The SEC Readiness Framework: Five Core Foundations

Firms that successfully cross the $100 million threshold have one thing in common: they build the right structures before they’re required. This framework helps you assess your readiness and identify what to strengthen before SEC registration or examination.

1. Governance & Oversight

Strong compliance starts with clear leadership. At the SEC level, oversight must be well-designed and provide strong evidence.

• Build a compliance calendar that mirrors SEC expectations, including quarterly testing, annual reviews, and risk assessments. Comply makes this easy by offering a dynamic compliance calendar that comes pre-populated with recommended testing activities outlined by the SEC.
• Empower your CCO. The CCO should have direct access to leadership and the authority to make or recommend key operational changes.
• Document decision‑making: Keep detailed records of compliance meetings, findings, and resolutions to demonstrate accountability and support audit/tracing of key decisions.

2. Policies & Procedures (P&P)

SEC examiners will expect to see policies that are tailored, tested, and kept current.

• Customize, don’t copy. Boilerplate manuals don’t reflect your actual risks. Your P&Ps should match your firm’s structure, clients, and investment strategies.
• Review regularly, quarterly, at a minimum and more frequently for high-risk areas. Regulatory guidance evolves quickly; a quarterly review schedule helps ensure your firm stays aligned with the latest interpretations. Comply’s risk assessment tool comes with 150+ SEC related regulatory questions – allowing clients to document findings and rank risk on a scale of low, medium, and high.
• Test your procedures. Run real‑life scenarios (e.g., trade errors, overdue certifications, cybersecurity breaches, marketing approvals) to ensure procedures work in practice and your team knows how to execute them.

3. Employee Supervision & Training

Your team is the frontline of compliance. The SEC prioritizes how firms train, communicate, and reinforce expectations.

• Deliver role‑specific training. Tailor sessions for advisors, operations, marketing, and leadership. Each role should understand how compliance applies to their day‑to‑day work, consistent with the firm’s written supervisory procedures.
• Keep compliance visible. Make it a standing agenda item in team meetings, performance reviews, and senior management discussions.
• Lead from the top. When executives model compliant behavior and regularly engage in compliance discussions, it signals to regulators and your team that compliance isn’t optional.

4. Recordkeeping & Technology

The SEC requires firms to retain business records, including communications, in a tamper-evident format. Firms must implement systems that either preserve records in a non-rewritable, non-erasable format (WORM) or meet the audit-trail alternative specified in SEC Rule 17a-4. Retention periods vary by record type, with many books and records requiring a six-year retention, and certain communications requiring three years.

• Implement centralized archiving. Capture email, text, and social media communications within one secure, searchable system that meets SEC recordkeeping requirements.
• Automate supervision workflows. Link communication reviews, approvals, and documentation in your compliance platform to reduce manual risk, support audit trails, and ensure timely, compliant oversight.
• Test your retrieval. During exams, speed and accuracy matter. Ensure your system can search, export, and verify the chain of custody — so you can produce records reliably and promptly.

5. Marketing & Client Communications

With the 2026 Exam Priorities emphasizing marketing accuracy and disclosure integrity, firms must treat content oversight as a core compliance function.

• Standardize your review process. Establish who reviews what, how long it takes, where documentation (versions/approvals) is stored, and how changes are tracked.
• Track disclosures and approvals. Maintain a record of every reviewed marketing piece, performance claim, disclaimers, material changes, and required updates. Ensure your marketing practices align with the SEC’s Marketing Rule, and reflect accurate, substantiated representations.
• Use automation where possible. Technology can help streamline submissions, reviews, version‑tracking and archival, turning a compliance burden into a controlled process and supporting exam readiness.

When these five foundations work together, compliance moves from reactive to resilient. They create a system that not only meets and exceeds SEC expectations, builds investor confidence and operational strength.

Common Pitfalls on the Path to SEC Registration

Even the most diligent firms can stumble on the road to SEC registration. The difference between a smooth transition and a stressful one often comes down to preparation, documentation, and follow-through. Understanding where firms typically fall short helps you get ahead of the curve.

1. Static Policies

One of the most common missteps is treating compliance policies as a one-and-done exercise. Policies that go many years without review may raise examiner questions about whether the program is actively overseen.

• The risk: Outdated language, missing procedures, or misaligned workflows that no longer reflect how your firm operates. Under the Advisers Act Rule 206(4)-7, policies must be reasonably designed and implemented.
• The fix: Establish a periodic review cycle. Many firms review quarterly, but you should tailor frequency to your business model, risk profile, and change environment. Document when changes are made and why, and tie updates to your compliance calendar.

2. Weak Documentation

The SEC’s mantra is simple: If it’s not documented, it didn’t happen. Many firms underestimate how much evidence is required to prove compliance.

• The risk: Missing records of reviews, approvals, and client communications can raise red flags during an exam. This is especially critical under the Books and Records Rule (Rule 204-2).
• The fix: Maintain a central repository for all compliance documentation. Track completion dates for attestations, training, and marketing reviews. Use your technology tools to automate audit trails wherever possible.

3. Cybersecurity Gaps

Cybersecurity continues to be a significant area of focus for the SEC. Yet, many firms still rely on generic IT policies without conducting real testing.

• The risk: Weak or outdated data protection practices can expose client information and violate Regulation S-P (privacy) and Regulation S-ID (identity theft red flags), as well as general requirements under Rule 206(4)-7.
• The fix: Implement regular cybersecurity assessments, employee phishing training, and vendor due diligence. Have a written incident response plan and test it. Ensure documentation supports supervisory and audit trail requirements.

4. Overlooking the Marketing Rule

Marketing oversight is an area of increasing enforcement. Firms that rush to promote performance or testimonials without proper review risk scrutiny by examiners and potential deficiency findings.

• The risk: Use of unsubstantiated claims, missing disclosures, or inconsistent performance data violates Rule 206(4)-1 and can trigger enforcement action.
• The fix: Establish a clear review process and approval workflow. Keep all marketing materials archived with timestamps and reviewer notes. Train advisors on what qualifies as “advertising” under the SEC definition. Highlight risks and limitations to meet General Prohibition standards.

5. Fragmented Technology

As firms grow, so do their systems. But disconnected tools create compliance blind spots.

• The risk: Data living in separate systems can make it difficult to demonstrate consistent supervision and recordkeeping, which is a regulatory expectation under Rules 206(4)-7 and 204-2.
• The fix: Integrate your compliance technology. Link archiving, trade monitoring, and attestations into one ecosystem that supports oversight, audit trails, and supervisory reviews.

6. Neglecting Mock Exams

Too many firms wait until the SEC knocks before testing their readiness. Although not mandated by the SEC, many firms find value in conducting mock exams.

• The risk: Discovering compliance gaps under pressure, with no time to remediate before a real exam.
• The fix: Conduct a mock exam on a regular basis, annually for many, though frequency and scope should match your firm’s complexity and risk. Use findings to prioritize your next round of improvements.

What Smart Firms Are Doing Now

The most forward-thinking firms approaching $100M aren’t waiting for registration to start operating like SEC registrants. They’re already running mock exams, automating attestations and trade monitoring, and ensuring every email, text, and social post is captured and reviewable.

For these firms, readiness isn’t a checkbox — it’s how they operate. It signals to regulators, clients, and their own teams that compliance is built into the business, not bolted on after the fact.

Comply brings together regulatory guidance, SEC filing services, and compliance automation to help firms make that transition smoothly. When you’re ready to move, we’re ready to help.

Download the full PDF