On November 9, 2021, the U.S. Securities and Exchange Commission’s (SEC) Division of Examinations (the “Division”) released a Risk Alert regarding various compliance issues for investment advisory firms offering robo-advisory services, also known as internet advisers. This Risk Alert is the product of the Division’s examinations under its Electronic Investment Advice Initiative (the “Initiative”).  While firms providing investment advice have been regulated for over two decades, their prevalence has dramatically increased in recent years.  This includes both investment advisers that provide investment advice exclusively through an interactive website under Rule 203A-2(e) under the Investment Advisers Act of 1940 (the “Advisers Act”), along with traditional investment advisers who supplement their investment advice through automated means. Electronic Investment Advice Initiative In the course of the Initiative, the Division focused on the following areas: Compliance programs to assess whether compliance policies and procedures, particularly those related to the provision of robo-advisory services, were adopted, implemented, reasonably designed, and tested at least annually pursuant to the “Compliance Rule” under Rule 206(4)-7 of the Advisers Act, which requires all registered investment advisers to maintain and enforce policies and procedures reasonably designed to ensure compliance with the Advisers Act. Formulation of investment advice to evaluate whether advisers gathered sufficient information from clients to form a reasonable belief that clients were receiving investment advice that was in their best interest based on each client’s financial situation and investment objectives. Where applicable, the staff also reviewed conflicts of interest disclosures and “customization” representations for adequacy and accuracy. Marketing and performance advertising practices for compliance with the old “Advertising Rule” or new “Marketing Rule” under Rule 206(4)-1 of the Advisers Act. Also, if relevant, the Division’s staff reviewed whether the advertised securities selection and portfolio management techniques were used when managing client accounts. Data protection practices to understand the firms’ policies and procedures regarding client data protection, including cybersecurity practices. Registration information to determine whether the advisers were eligible for SEC registration as investment advisers or eligible to rely on Rule 203A-2(e). Observations The Division noted a number of observations in the course of the Initiative, including the following: Compliance programs. o   Most the examined advisers had inadequate compliance programs. Specifically, many advisers’ policies and procedures regarding robo-advisory services did not adequately assess their performance, disclose changes in asset allocation or balancing policies, or take sufficient measures to protect client log-in credentials. o   Providers of “white label” platforms often lacked policies and procedures addressing the platform providers’ attention to these matters.  This underlies the obligation that may be created for a registered investment adviser to have policies covering its service providers or users under circumstances where others may affect the advice offered. o   Additionally, advisers also often failed to adopt a strict adherence with the Code of Ethics Rule under the Advisers Act by not identifying “all access persons” and then, in turn, not receiving all access persons’ required holdings or transactions. Formulation of investment advice o   While advisers commonly used questionnaires to collect data for investment advice, the Division staff found that some firms relied on just a few data points to form their advisement advice and did not sufficiently account for evolving client needs.  This is consistent with several recent enforcement actions where the SEC settled with advisers who failed to monitor clients for changing circumstances and suitability despite still charging fees. o   A number of advisers had disclaimers in their online terms and conditions that were not consistent with the SEC’s view of an investment adviser’s fiduciary duties.  For example, the SEC long has taken the position that a waiver of claims for violations of securities laws is inconsistent with an investment adviser’s fiduciary duties. Marketing and performance advertising practices o   Robo-advisers often made inaccurate or incomplete disclosures in their Form ADV filings, particularly regarding conflicts of interest, advisory fees, investment practices, and ownership structure. o   Advertisement-related noncompliance included: Vague or unsubstituted claims regarding services provided, investment options, performance expectations, and costs incurred; and Hypothetical performance results without adequate disclosures pursuant to Rule 206(4)-1 of the Advisers Act. Data protection practices o   Only a few robo-advisers had policies and procedures that addressed the firm’s systems and response following a cybersecurity event. Therefore, those advisers were not in compliance with Regulation S-ID or Regulation S-P, as applicable, because their services did not have written policies and procedures designed to detect, prevent, and mitigate identity theft. Further, many advisers did not deliver all required privacy notices. Registration information o   Notably, nearly half of the examined robo-advisers claimed reliance on the internet adviser exemption under Rule 203A-2 of the Advisers Act. This exemption requires that the adviser (a) provides investment advice exclusively through an interactive website (subject to a 15 client de minimis exception), (b) maintain for at least 5 years an easily-accessible record of its eligibility to rely on this exemption, and (c) is not an affiliate of another registered adviser relying on umbrella registration.  Many of these advisers either (1) did not have an interactive website, (2) concurrently provided investment advice outside of the interactive website (e.g. financial planning), or (3) were actually adviser affiliates in a control relationship and therefore ineligible to the Internet adviser exemption. Discretionary Investment Advisory Programs Additionally, the Initiative included a review of over two dozen robo-advisers who sponsor “discretionary investment advisory programs” under Rule 3a-4 under the Investment Company Act of 1940 (the “Investment Company Act”).  This rule serves as a safe harbor from Investment Company Act registration for certain discretionary investment advisory services of managed accounts. o   The Risk Alert notes that certain discretionary investment programs may meet the definition of “investment company” under the Investment Company Act unless the investment adviser fully complies with the nonexclusive safe harbor for discretionary investment advisory services under Rule 3a-4 of the Investment Company Act. o   Reliance on the safe harbor requires roboadvisers to (1) obtain client’s financial information and objectives and (2) inquire into whether the client wishes to impose reasonable restrictions on the management of the client’s account. Clients are also entitled to retain “certain indicia of ownership” as well as annual communication from the robo-adviser that provides an opportunity to make any changes to the client’s financial condition or objectives or account restrictions. The “indicia of ownership” must be to the same extent as if the clients held the securities and funds outside of the discretionary investment advisory program. o   Many robo-advisers collected insufficient amounts of information from clients. In particular, many advisers asked too few questions or received too few data points to be able to provide adequately personalized investment advice. o   Further, many advisers did not adequately allow clients to impose reasonable restrictions on their own accounts, or made it difficult for clients to impose these restrictions.  In particular, this was inconsistent with the Investment Company Act Rule 3a-4 requirement that clients be able to designate securities or types of securities that should not be purchased or that should be sold. o   Additionally, clients in discretionary investment advisory programs faced restrictions on the client’s ability to withdraw funds, voting rights, bring a legal course of action against an issuer in the client’s account, or did not receive legally-required documents such as trade confirmations and prospectuses. o   The Division staff also reiterated that Rule 3a-4 is designed to address only the status of the program under the Investment Company Act, not the obligations of any investment adviser under the Advisers Act.  Accordingly, investment advisers to registered investment companies relying on this rule should ensure that they are also compliant with the Advisers Act. Key Takeaways This Risk Alert, one of the longest and most detailed it has ever issued, shows that robo-advisors clearly are in the SEC’s crosshairs.  While there is a lot of content, we believe there are a few key takeaways: There may be quite a few investment advisers relying on Advisers Act Rule 203A-2(e) who may not rely on that rule. If an adviser is providing advice outside its interactive website, it may need to look to other exceptions and if it does not have any assets under management, it might be more proper for the adviser to be registered at the state level. Robo-advisers may be at risk of enforcement action if they do not collect sufficient information in their questionnaires to be able to select an appropriate investment strategy for their clients. All investment advisers – not just robo-advisers – should ensure they are compliant with applicable marketing and advertising rules.  Even if an adviser is relying on the new “Marketing Rule,” it may also have other restrictions under applicable state laws. Tech companies in the investment advice space should ensure that their related terms, conditions, and policies relating to their websites and applications do not result in a lapse of compliance obligations by their related investment advisers In addition to reviewing internal compliance with the applicable rules under both the Investment Company Act and the Advisers Act, robo-advisory service providers may also consider referring to the SEC’s Division of Investment Management 2017 “Guidance Update” regarding robo-advisers.  Advisers who provide automated internet investment advice – particularly those relying on Advisers Act Rule 203A-2(e) – should consider having their practices, policies, and procedures audited by compliance professionals, such as Polsinelli’s Investment Management and Funds team, in light of this Risk Alert.