Custody is an access problem, NASAA reminds state RIAs

When NASAA published its custody awareness primer in late October, state-registered RIAs got a reminder that custody under model rule 102(e)(1)-1 begins with access. The rule reaches an adviser or a related person who holds client funds or securities, and the guidance warns that business practices short of outright holding can still cross the line. Access through a third party counts as access.

That breadth is why the document spends much of its energy on avoidance: many states permit two common forms of custody without the full heightened regime, provided the adviser satisfies safe harbor conditions. Full custody carries additional recordkeeping and heightened regulatory requirements, and NASAA is direct about the trade: the regime is costly enough that most advisers choose to avoid it.

The paper labels itself as the views of NASAA's Investment Adviser Section Resources and Publications Project Group rather than the association as a whole, and says it is not legal advice; questions should go to the applicable state securities regulator. The first recommended steps are a review of the specific state rule and an evaluation of whether the firm's business practices give the firm or its representatives any direct or indirect access to client funds or securities; custody should then be addressed comprehensively in the firm's written supervisory procedures.

NASAA puts the written procedures after the access review, which suggests the regulator's real interest is in the design of the business, not the policy language. An RIA that maps its money-touching workflows and narrows them is buying its way out of the most expensive compliance regime in the rulebook; an RIA that writes a custody policy over unchanged workflows still has the underlying exposure.

The guidance lands on an active rulemaking calendar; as this publication reported in August, NASAA also cut the retest wait to 60 days after a third failure. State-registered firms are getting both mobility and reminders on the same channel.

For a practice owner, the comparison runs through budget as much as law: hours spent mapping where client money can be touched are cheaper than the recordkeeping and heightened requirements that follow if one access point is missed. Run the map before the regulator does.