Your Next Examination
Is Already Scheduled.

Cybersecurity

No written cybersecurity policy. No incident response plan. No vendor due diligence documentation.

Reg S-P compliant cybersecurity program adopted. Incident response plan tested and documented. All third-party vendors assessed and agreements updated.

Form ADV Part 2

Brochure last updated 2021. Fee schedule materially changed. Three new services not disclosed.

ADV Part 2A/2B fully revised. Annual amendment filed. Delivery records updated for all 847 clients.

Outside Business Activities

3 of 14 advisors have undisclosed OBAs. No annual attestation process in place.

OBA disclosure forms collected for all advisors. Annual attestation policy implemented. FINRA disclosures reconciled.

Books & Records

Email archiving vendor not SEC Rule 17a-4 compliant. 14-month gap in archived records.

WORM-compliant archiving solution deployed. Historical records restored from backup. Retention schedule documented.

Supervisory Procedures

WSP manual references repealed rules. No evidence of annual review or attestation.

WSP manual fully rewritten to current regulatory standards. Annual review process established with calendar reminders.

SOC 2 Readiness

No formal information security policies. No access control reviews. No vendor management program. SOC 2 audit would fail on Trust Service Criteria Day 1.

Full SOC 2 Type II control environment built. 47 controls documented and evidenced. Pre-audit gap assessment passed with zero high-risk findings.

AML Program

BSA/AML program not updated since 2022. No independent testing completed. Customer risk rating model undocumented.

AML program rebuilt to current FinCEN guidance. Risk-based customer due diligence model documented. Independent testing completed and report filed.

MTL Renewals (4 states)

TX and FL licenses expired 60 days prior. NY and CA renewals not initiated. Surety bond amounts insufficient for current transaction volume.

All four renewals submitted with updated financials. Bond amounts increased. State examiner inquiries responded to in writing within required deadlines.

Privacy Program

Privacy policy references GDPR but firm has no EU operations. CCPA compliance undocumented. No data subject request process.

Privacy policy rewritten to reflect actual data practices. CCPA compliance program implemented. DSR intake and response workflow documented.

Investor Disclosures

Series B investor deck contained forward-looking statements without safe harbor language. No regulatory risk disclosures.

Investor materials reviewed and updated. Regulatory risk section added. Outside securities counsel sign-off obtained.

BSA/AML Program Consolidation

Three entities operating under three incompatible AML programs. Transaction monitoring thresholds inconsistent. No consolidated suspicious activity reporting process.

Single enterprise-wide BSA/AML program adopted. Unified transaction monitoring thresholds established. Consolidated SAR filing process with single BSA Officer designation.

OFAC Sanctions Screening

Two subsidiaries using outdated OFAC list (47 days stale). No automated screening for wire transfers above $5,000. No documentation of screening results.

Real-time OFAC screening integrated into wire transfer workflow. All entities on same SDN list update schedule. Screening result documentation policy implemented.

Section 1071 Readiness

No data collection infrastructure for small business lending demographic data. CFPB compliance date missed for institutions of this asset size.

Section 1071 data fields mapped to loan origination system. Collection procedures drafted. Compliance date extension request filed and approved.

Fiduciary Controls (Trust Cos.)

Investment policy statements for 23 trust accounts not reviewed in 3+ years. Annual account reviews not documented. Fee disclosure conflicts unresolved.

All 23 IPS documents reviewed and updated. Annual review calendar established. Fee disclosure conflicts identified and resolved with beneficiary notification.

Audit Trail Integrity

Post-merger system migration created gaps in transaction audit trail for Q3–Q4 2023. No remediation documentation exists.

Historical audit trail gaps documented and explained in examination response. Remediation memo drafted and signed by Chief Compliance Officer.

Customer Risk Ratings

High-risk customer segment (MSBs) not flagged consistently across entities. Enhanced due diligence not applied uniformly.

Unified customer risk rating methodology deployed across all entities. MSB segment re-screened. EDD documentation completed for 47 accounts.