Supervising Held-Away Accounts: Compliance Controls

Among its fiscal 2026 priorities for investment advisers, the SEC's Division of Examinations listed "advisers utilizing third-parties to access clients' accounts, where controls may be insufficient to protect client assets and data." A firm that advises on clients' held-away 401(k)s and other workplace plan accounts through a platform fits that description.

Supervision comes down to six controls a firm can show an examiner: a custody analysis, a credentials policy, trade review, records, AUM reporting and vendor oversight. Sources are SEC rules, forms, staff answers and risk alerts, NASAA and an Oregon regulator's alert, all checked on November 1, 2026. For the monitoring workflow, see held-away account monitoring. For fees, see the business case.

1. A custody analysis for each access method

Rule 206(4)-2 defines custody as holding client funds or securities, directly or indirectly, "or having any authority to obtain possession of them." It includes any arrangement, a general power of attorney among them, under which the adviser may withdraw client funds or securities from a custodian on its instruction.

Access to a held-away account can meet that test without anyone intending it. SEC staff answered in 2010, in custody FAQ II.6, that an adviser with a client's ID and password to a pension account has custody if that access lets it withdraw funds or securities or move them to an account not in the client's name. A February 2017 SEC risk alert on the five most frequent compliance topics in adviser exams reported advisers that did not recognize custody arising from online access with clients' usernames and passwords.

Oregon's March 17, 2025 alert tells advisers to review the agreements themselves: powers of attorney, the client's agreement with the platform, and the client's agreement with each custodian. It notes that at least one platform may add the adviser as a supplemental or authorized user on the client's account, and that the question is whether that user can withdraw funds or securities, "whether used or not."

The control is a written custody memo for each access method, with the agreements attached, signed by the chief compliance officer and reviewed whenever a platform or recordkeeper changes its terms. If the answer is custody, the rule's requirements follow unless an exception applies, among them a qualified custodian, account statements to clients at least quarterly, and a surprise examination by an independent public accountant each calendar year.

2. Credentials and access

NASAA's Account Access Model Rule prohibits investment advisers from accessing client accounts with the client's own login, such as a username and password. NASAA's Q&A says it does not apply to access the client authorizes through the adviser's own unique login, though custody and recordkeeping questions remain. Aggregation software is outside the rule only if the adviser does not know or have access to the client's password, the aggregator has an agreement with the custodian, and access is entirely read-only. Each state decides whether to adopt the model rule.

Amended Regulation S-P counts an online user name combined with something like an access code or security code as sensitive customer information. A client password in a CRM note is a data security problem as well as a custody one.

Controls:

• A written rule that no one at the firm stores or uses a client's login to any outside account.
• A periodic search of CRM notes, shared drives and email for stored credentials. A pattern search or a language model can scan for credential-like text, and a person reviews each hit, deletes it and asks the client to change the password.
• For every platform, a written answer to three questions: how it authenticates to each recordkeeper, whether the recordkeeper has agreed to that access, and what rights any user it adds to the client's account holds. Oregon's alert says at least one platform appears to use client usernames and passwords "without the knowledge or consent of the custodians."

3. Trade review

Platforms run held-away trading differently. Pontera describes a discretionary workflow "designed for advisors who can directly manage workplace retirement accounts" and a non-discretionary workflow that "provides a client-implemented workflow," and tells advisers to check with their home office on which applies. Supervision differs for each:

• Discretionary trades: a pre-trade check that the new allocation uses only funds on the plan's menu and matches the client's agreed model, and a post-trade review of a sample, with every exception reviewed.
• Client-implemented trades: a review of the written recommendation before it goes to the client, and a later check of what the client did.
• Stale data: no trade or recommendation on an account until its balance has been refreshed.

AI is useful for the comparison work: lining up each held-away allocation against the target model and drafting the exception list. A supervisor approves or rejects each item, and the record shows who did.

4. Books and records

Rule 204-2 requires a memorandum of each order the adviser gives, showing its terms, the person who recommended the trade and the person who placed it, the account, the date and the executing broker where appropriate. Discretionary orders must be marked as such. The rule also covers written communications about recommendations or advice and about placing or executing orders, and every written agreement with a client. Records are kept for at least five years from the end of the fiscal year of the last entry, the first two in an appropriate office.

Electronic records must be indexed and retrievable, produced promptly when the SEC asks, backed by a separate duplicate copy, and protected from loss or alteration. Pontera describes "a complete, uneditable auditable rebalancing record." Confirm the firm can export it on demand and keep it after the contract ends. The 2017 risk alert also cites advisers that "maintained contradictory information in separate sets of records," the risk when held-away balances sit in the CRM, the platform and the billing file at once.

5. AUM reporting

The Form ADV instructions count an account toward regulatory assets under management only if the firm provides "continuous and regular supervisory or management services" for it. That means one of two things:

• the firm has discretionary authority and provides ongoing supervisory or management services, or
• without discretion, it has ongoing responsibility to select or recommend specific investments based on the client's needs and, if the client accepts, is responsible for arranging or effecting the purchase or sale.

The instructions weigh the advisory contract, the form of pay and actual practice. A fee based on the average value of assets suggests continuous services. A retainer based on a percentage of assets covered by a financial plan suggests the opposite, as does advice given only on request or on a set date. Value is current market value within 90 days before filing, using the method the firm uses for client reports or fee calculations.

A client-implemented account needs care under the second test, because the client places the trade. Write down the conclusion for each access method and apply it consistently to regulatory AUM, the brochure and billing. The 2017 risk alert lists inaccurate reporting of regulatory assets under management among common filing deficiencies.

6. Vendor oversight under Regulation S-P

Regulation S-P defines a service provider as "any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information." A held-away platform fits. The firm's incident response program must require oversight of service providers, including through due diligence and monitoring, and must make sure each provider gives notice no later than 72 hours after becoming aware of a breach. The firm must notify affected customers as soon as practicable and within 30 days of learning of unauthorized access, with limited exceptions.

Oregon's alert says no financial regulator reviews the privacy and security practices of an unregistered platform, and urges advisers to "conduct and adequately document their own due diligence." In practice:

• a current SOC 2 Type II report, read for exceptions (how to read one). Pontera says it holds SOC 2 Type II and ISO 27001 certification.
• contract terms covering the 72-hour notice, limits on data use, and return of data at termination
• a yearly look at each platform's custody-relevant terms in the annual compliance review

Writing it into the compliance manual

The Compliance Rule, as the 2017 risk alert describes it, requires written policies and procedures reasonably designed to prevent violations, a review of them at least annually, and a chief compliance officer. The alert's typical deficiencies include manuals not tailored to the firm's practices and annual reviews that were never performed. A held-away section should name each access method, its custody conclusion, who reviews trades, where records live and how each vendor is reviewed.

AI helps keep that section current. A model can read a platform's updated terms and flag any clause granting withdrawal, transfer or authorized-user rights, and compare held-away balances across the CRM, the platform and billing before a Form ADV filing. Compliance decides every flag.