Registered investment advisers that have custody of client assets must have an independent public accountant verify those assets once a year, at a time the accountant chooses without notice. CPA firms that serve advisers perform this surprise examination, and the rule sets timing, filing and notification duties that differ from a typical attest engagement. This guide reads Rule 206(4)-2, 17 CFR 275.206(4)-2, from the accountant's side.
Who has custody
The rule defines custody as holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them. It includes possession of client funds or securities (other than checks drawn by clients and made payable to third parties, and assets received inadvertently and returned to the sender within three business days), any arrangement, including a general power of attorney, under which the adviser is authorized to withdraw client funds or securities held at a custodian on its instruction, and any capacity such as general partner of a limited partnership that gives legal ownership of or access to client assets. Custody also exists when a related person holds client assets in connection with the adviser's services. Client assets must otherwise be held by a qualified custodian, such as a bank, a registered broker-dealer holding assets in customer accounts, a registered futures commission merchant (for futures-related assets) or a foreign financial institution that keeps client assets segregated from its own.
The accountant must be an independent public accountant, meaning one that meets the independence standards in Rule 2-01(b) and (c) of Regulation S-X (paragraph (d)(3)).
The verification requirement
Under paragraph (a)(4), client funds and securities of which the adviser has custody must be verified by actual examination at least once during each calendar year by an independent public accountant, under a written agreement, at a time chosen by the accountant without prior notice or announcement to the adviser and that is irregular from year to year. The written agreement must:
- provide for the first examination within six months of the adviser becoming subject to the paragraph;
- require the accountant to file a certificate on Form ADV-E with the SEC within 120 days of the time chosen by the accountant, stating that it has examined the funds and securities and describing the nature and extent of the examination;
- require notice to the SEC within one business day of finding any material discrepancy during the examination, by facsimile or email followed by first class mail; and
- require the accountant, on resignation, dismissal, removal or other termination, to file Form ADV-E within four business days with the date and an explanation of any problems relating to examination scope or procedure that contributed to the termination.
Exceptions the accountant should recognize
- Fee deduction. Under paragraph (b)(3), no independent verification is required if the adviser has custody solely because it can withdraw its advisory fee from client accounts at a qualified custodian, subject to the related-person condition.
- Pooled vehicles with an audit. Under paragraph (b)(4), a limited partnership or similar pooled vehicle that is audited at least annually by a PCAOB-registered and inspected independent public accountant, with audited GAAP financial statements distributed to all limited partners within 120 days of fiscal year end (and promptly after an audit on liquidation), is deemed to comply with the verification requirement. See private equity fund audits.
- Registered investment companies. Paragraph (b)(5) excludes accounts of registered investment companies.
- Certain privately offered securities. Paragraph (b)(2) relieves the adviser only of the qualified custodian requirement in paragraph (a)(1), for securities acquired from the issuer without a public offering, uncertificated and recorded only on the issuer's books in the client's name, and transferable only with the issuer's or holders' consent. For a pooled vehicle it applies only if the vehicle is audited and distributes its statements as paragraph (b)(4) describes.
- Operationally independent related persons. Under paragraph (b)(6), no verification is required if custody arises solely because a related person holds the assets in connection with the adviser's services and the related person is operationally independent of the adviser.
- Advisers acting as qualified custodians. Under paragraph (a)(6), the accountant must be PCAOB-registered and subject to inspection, and the adviser must obtain an internal control report, which affects timing of the first examination.
Planning timeline: worked example
An adviser with custody engages a firm in January. The firm picks August 12, 2026 as the examination date and tells only the engagement partner and manager.
- Examination date: August 12.
- Form ADV-E due within 120 days of that date. August 12 to August 31 is 19 days, September 30 brings the count to 49, October 31 to 80, November 30 to 110, and December 10 to 120. The certificate is due by December 10.
- If the firm finds that a client account holds 500 fewer shares than the adviser's records on August 14, notice goes to the SEC by August 17 (a Monday) if August 14 is a Friday: one business day after August 14 is August 17.
The discrepancy clock is one business day, not the 120-day filing window.
Second example: which advisers need the examination
- Adviser A has custody only because it deducts its advisory fee from client accounts held at a qualified custodian. Paragraph (b)(3) removes the verification requirement.
- Adviser B is general partner of a fund audited each year by a PCAOB-registered and inspected firm, and distributes the audited GAAP statements to the limited partners within 120 days of year end. For a December 31 year end in a non-leap year, that is April 30 (31 days in January, 28 in February, 31 in March and 30 in April make 120). Paragraph (b)(4) deems it compliant, so no surprise examination is needed for that fund.
- Adviser C is general partner of an unaudited fund. It has custody through that capacity, and paragraph (a)(4) applies. The first examination must occur within six months of the adviser becoming subject to the paragraph.
Common errors
- Telling the adviser the date in advance or choosing the same month every year. The rule requires a time chosen by the accountant without notice and irregular from year to year.
- Treating the Form ADV-E 120-day window as the deadline for reporting a discrepancy.
- Omitting the four-business-day Form ADV-E filing, with an explanation of scope or procedure problems, when the engagement ends early.
- Relying on the fee-deduction exception when the adviser also has a power to withdraw funds for other purposes, or is general partner of a fund.
- Assuming a fund audit qualifies without checking the auditor's PCAOB registration and inspection and the 120-day distribution to every limited partner.
Engagement checklist
- Engagement letter with the four rule-required terms in the written agreement.
- Independence assessment, since the examination is an attest engagement.
- Population of client accounts and custodians at the examination date, and the approach to selecting accounts.
- Custodian confirmations, reconciliations of adviser records to custodian records, and tracing of cash and securities.
- A protocol for the one-business-day notification and who authorizes it.
- Form ADV-E filing calendar and evidence of filing.
For related guidance, see independence and nonattest services for small firms and the engagement completion checklist.
Sources
- Legal Information Institute, 17 CFR 275.206(4)-2, Custody of funds or securities of clients by investment advisers: https://www.law.cornell.edu/cfr/text/17/275.206(4)-2
- Electronic Code of Federal Regulations, 17 CFR 275.206(4)-2 (current text of the custody rule): https://www.ecfr.gov/current/title-17/section-275.206(4)-2
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Engagement and acceptance: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error