Most RIA deals don't fall apart over valuation. They fall apart over things that were knowable before the letter of intent was ever signed. Compliance red flags are the most common of these — and the most avoidable, because the information that surfaces them is largely public, structured, and accessible to any buyer willing to look before they engage.

The SEC's Investment Adviser Public Disclosure database (IAPD) contains the full regulatory history of every registered investment adviser in the country. Form ADV filings are updated annually and amended when material changes occur. The information is there. The question is whether acquirers are reading it — and reading it correctly — before they invest weeks of management time and legal fees in a deal that a five-minute disclosure review would have killed.

This article covers the compliance red flags that most frequently derail RIA acquisitions, how to identify them before LOI, and how to think about the ones that don't automatically disqualify a target but require careful structuring.

Why Compliance Risk Is Different from Financial Risk

It Compounds Post-Close

Financial risk in an RIA deal — revenue concentration, margin compression, client attrition — is largely quantifiable and can be mitigated through earnout structures and purchase price adjustments. Compliance risk is different. Regulatory exposure that exists at close doesn't stay static. An open SEC examination that finds deficiencies post-close becomes the acquirer's problem. A pattern of supervisory failures that predates the acquisition can surface in a FINRA or SEC sweep after close, triggering remediation costs and reputational damage that no earnout structure anticipates.

It Can Follow the Acquirer

In an asset purchase, buyers typically seek to leave liabilities with the seller. But regulatory exposure tied to the acquired firm's advisory contracts, client relationships, and ongoing supervision obligations can attach to the acquiring entity regardless of deal structure — particularly when the acquiring firm becomes the registered investment adviser of record for the clients being transferred. Due diligence that surfaces compliance risk before LOI is not just protective for the target; it protects the acquirer's own regulatory standing.

It Is Largely Predictable

Unlike client attrition or market-driven AUM changes, compliance red flags are almost always documented somewhere. SEC examination findings, regulatory actions, disclosure events, and supervisory failures leave trails in Form ADV, the IAPD database, and state regulatory records. Buyers who build systematic compliance screening into the pre-LOI process consistently avoid the deals that would have cost them the most.

The Red Flags: What to Look for and What They Mean

Disciplinary History and Regulatory Actions

The most visible compliance signal is a formal regulatory action — an SEC order, a state regulatory sanction, a FINRA disciplinary proceeding, or a consent order. These are disclosed in Form ADV Part 1, Item 11, and are searchable through the IAPD.

Not all regulatory actions are equal. A settled proceeding from twelve years ago involving a minor disclosure violation carries different weight than an active SEC investigation or a recent order requiring disgorgement and remediation. The key questions are recency, severity, and pattern.

Recency: A regulatory action within the past five years is a serious flag. The closer to the present, the more likely it reflects the firm's current culture and controls.

Severity: Findings that resulted in disgorgement, suspension, a bar from the industry, or mandatory compliance monitors are materially different from technical disclosure deficiencies that were corrected on exam.

Pattern: A single isolated incident is very different from a recurring pattern of the same type of violation. If a firm has been cited three times in ten years for inadequate supervision of outside business activities, that is a control culture problem — not a historical anomaly.

Customer Complaints and Civil Litigation

Item 11 of Form ADV Part 1 also captures civil litigation, arbitration, and customer complaints. These are frequently underweighted in early screening because they feel less "official" than regulatory actions. They shouldn't be.

A pattern of customer complaints — particularly complaints alleging unsuitable recommendations, failure to disclose conflicts, or misrepresentation — is a leading indicator of regulatory exposure that may not yet have crystallized into a formal proceeding. It is also a direct indicator of client relationship fragility: clients who have complained are clients who are more likely to leave in a transition.

Civil judgments or arbitration awards that remain unsatisfied are an immediate red flag. They signal financial instability at the firm level and, depending on the amount, may affect the adviser's ability to maintain registration.

Regulatory Examination Findings

The SEC does not publish examination findings for individual firms, but it does publish risk alerts and exam priorities that signal where enforcement attention is concentrated. More importantly, the acquiring firm's legal team should request copies of recent examination findings and deficiency letters as part of diligence. A firm that has received multiple deficiency letters — particularly for the same categories of issues across successive examinations — is demonstrating a compliance program that is not self-correcting.

Common examination findings that warrant particular attention include: inadequate compliance policies and procedures, failure to maintain required books and records, conflicts of interest not disclosed in Form ADV, and failures in the supervision of advisory personnel.

Outside Business Activities (OBAs)

Undisclosed or inadequately disclosed outside business activities are one of the most common sources of regulatory exposure in smaller RIA firms. If a founding advisor sits on the board of a company whose stock appears in client portfolios, or if firm personnel are receiving compensation from third parties for client referrals without proper disclosure, the firm has a conflict of interest disclosure problem regardless of whether it has been cited for it.

During pre-LOI screening, review Form ADV Part 2 for the disclosure of compensation arrangements, third-party referral agreements, and any description of outside business activities. Cross-reference what's disclosed against what you can independently verify through public records, LinkedIn, and direct conversation.

Custody Rule Violations

The SEC's custody rule requires that advisers who have custody of client assets comply with specific safekeeping, reporting, and audit requirements. Custody rule violations — particularly unreported custody arrangements — are among the SEC's current examination priorities and a frequent finding in examinations of smaller RIA firms.

A firm that has operated with an undisclosed custody arrangement, failed to obtain required surprise audits, or commingled client assets has a compliance deficiency that will require remediation regardless of how the deal is structured. The cost and timeline of that remediation should be modeled before any offer is made.

Fee and Billing Irregularities

Overcharging clients — whether through billing errors, applying incorrect fee schedules, or charging for services not rendered — is one of the SEC's most consistently cited exam findings. It is also one of the most damaging to client relationships when it surfaces post-close.

Review the target's billing practices and fee schedule during diligence. If the firm's advisory agreements don't match what clients are actually being charged, or if the firm cannot produce a systematic billing reconciliation process, assume a remediation obligation.

Red Flag Severity Matrix

All assessments are illustrative. Consult legal counsel before making deal decisions based on compliance findings.

When Red Flags Don't Automatically Kill the Deal

Not every compliance finding is a deal-stopper. Experienced acquirers distinguish between findings that are historical and remediated, findings that are ongoing and controllable, and findings that represent fundamental cultural problems that won't change post-close.

A firm that received an SEC deficiency letter six years ago for inadequate compliance policies, hired a dedicated CCO, implemented a written supervisory procedures manual, and has had clean examinations since is a very different situation from a firm that has received the same finding in three successive examinations and still hasn't built a functioning compliance program.

The relevant questions are: Has the firm demonstrated that it can identify and correct compliance failures? Is the current leadership the same as when the violations occurred, or has the management and compliance infrastructure changed? And critically — is there any ongoing regulatory exposure that would survive the close of the transaction regardless of what the purchase agreement says?

When red flags exist but don't disqualify, they almost always affect deal structure. Escrow holdbacks tied to compliance representations, indemnification for pre-close regulatory exposure, and purchase price adjustments that reflect the cost of remediation are standard tools for pricing compliance risk into a deal rather than walking away from it entirely.

Data Advantage: Surfacing Compliance Risk Before the First Meeting

RIA Catalyst aggregates and structures Form ADV data — including disciplinary history, disclosure events, and regulatory registration details — across 15,000+ SEC-registered RIAs. Buyers who use the platform for early-stage screening can flag firms with material compliance history before making an outreach call, ensuring that relationship-building time and diligence resources are directed toward targets that can actually close. Compliance screening is not a diligence activity — it is a sourcing filter.

FAQ

How do I access a firm's compliance history before engaging them directly?

The SEC's Investment Adviser Public Disclosure (IAPD) database at adviserinfo.sec.gov provides public access to every registered investment adviser's Form ADV, including their full disciplinary history. Search by firm name or CRD number. The information is free and updated in real time as firms file amendments.

What is the difference between a regulatory action and an examination finding?

A regulatory action is a formal proceeding — an SEC order, consent order, or state sanction — that results in documented findings, penalties, or conditions on registration. An examination finding is a deficiency letter or similar communication from an SEC examination that identifies issues requiring remediation but does not necessarily result in formal action. Both are important, but regulatory actions are more severe and are publicly disclosed in Form ADV. Examination findings are not publicly disclosed and must be requested directly during diligence.

Can a buyer protect itself from pre-close compliance liability through deal structure?

Partially. An asset purchase structure can insulate the buyer from certain pre-close liabilities, but regulatory exposure tied to ongoing client relationships and advisory obligations can attach to the acquiring firm regardless of deal structure. Representations and warranties insurance, escrow holdbacks, and specific indemnification provisions tied to pre-close compliance events are the most common structural protections — but none of them substitute for identifying the exposure before the deal is signed.

How should compliance red flags affect purchase price negotiations?

The impact depends on severity and whether the exposure is quantifiable. Systemic billing errors with a calculable remediation cost can be modeled as a direct price adjustment. Ongoing regulatory exposure with uncertain outcomes is harder to price and more often results in escrow arrangements or earnout adjustments tied to regulatory resolution milestones. Findings that cannot be quantified or resolved — active investigations, unresolved civil judgments — are typically deal-stoppers rather than pricing variables.

How recent does a compliance issue need to be before it's considered material?

There is no universal rule, but most experienced acquirers treat findings within the past five years as requiring active explanation and verification of remediation. Findings within the past two years are treated as presumptively material unless the firm can demonstrate compelling evidence of correction. The recency threshold also depends on severity — a minor disclosure gap from four years ago is very different from a formal SEC order from the same period.

Conclusion

Compliance red flags are the most predictable deal-killers in RIA M&A — which makes them the most avoidable. The information required to identify material compliance risk is largely public, structured, and accessible before the first management meeting. Buyers who build systematic compliance screening into their sourcing process — using Form ADV data, the IAPD database, and structured firm intelligence platforms — consistently avoid the deals that would have cost them the most. Compliance due diligence is not a late-stage activity. It is the first thing a disciplined buyer checks.