Investment Adviser Compliance Software: Why Preclearance by Email Collapses the Week the Examination Letter Arrives

Why the exam letter is the moment everything is revealed

The document request list arrives and gives you a short window to produce a great deal of material. Among the items: all personal securities transaction reports for access persons for the review period, evidence of preclearance decisions, the restricted list as it stood on specific dates, the code of ethics acknowledgements, the annual compliance review and the records supporting it. The chief compliance officer opens a folder structure built over four years, a shared drive of PDF brokerage statements, an Outlook folder called Preclear, and a spreadsheet where the restricted list has been overwritten in place since 2022, so the version that existed on the date in question no longer exists anywhere.

That last detail is the one that hurts. A firm can be entirely honest, with employees who never traded anything improper, and still look uncontrolled because it cannot reproduce the state of its own controls on a past date. Examiners assess whether a compliance programme is reasonably designed and actually implemented, and implementation is demonstrated with records. The tools most firms use, ComplySci, MyComplianceOffice and SmartRIA, exist precisely because this is hard, and they are genuinely good at the standard shape of the problem. Where they run out of road is when your restricted list is generated from your own research pipeline, your strategies trade instruments their feeds do not model, or your compliance data needs to sit next to your CRM (Customer Relationship Management) and portfolio system rather than in a separate silo your team logs into twice a week.

The cost of the current state is measurable in a way most firms never count. In adviser projects we have worked on, the recurring pattern is a compliance officer spending several days a quarter chasing statements and attestations, a preclearance turnaround that is slow enough that employees quietly stop asking, and an examination that consumes two to three weeks of senior time because the evidence has to be assembled rather than exported. The reputational and enforcement downside sits on top of that, and it is not a downside you can insure your way out of.

Problem 1: preclearance is a real-time decision, not a form

An analyst wants to buy a position. The decision depends on whether the issuer is on the restricted list, whether the firm has traded it in a window your policy defines, whether the employee has an existing position subject to a holding period, whether the security is exempt under your code, and whether the request even needs a decision. Today that is an email to compliance, a human check against a spreadsheet, and a reply that arrives sometime.

Off-the-shelf systems automate the workflow but generally require you to maintain the restricted list by hand in their tool. That is the flaw. Your restricted list has sources: the deal pipeline, research coverage, a board seat an executive holds, an issuer where a colleague has material non-public information. Every one of those sources lives in a different system, and the manual copy step is where the list goes stale.

What a custom build does: derive the restricted list from its actual sources with a manual override, and make every version of it immutable and timestamped so you can answer what the list contained at 10:14am on a Tuesday in March. Preclearance then becomes a decision evaluated against that snapshot, returned in seconds for the clear cases and routed to a human only for the genuinely ambiguous ones. Decisions carry the rule and the list version that produced them. The behavioural effect matters as much as the record: when preclearance answers in seconds, employees use it, and when it takes a day, they stop.

Problem 2: brokerage data arrives in shapes nobody agreed on

Some employees have accounts at custodians that send electronic duplicate feeds. Some have accounts at brokers that send paper. Some hold crypto, some hold private investments, some hold an account for a spouse at a firm that will not send anything. Reconciling reported transactions against actual holdings is the substance of a code of ethics review, and it is currently a person opening PDFs.

What a custom build does: ingest the electronic feeds you can get, then handle the rest with document extraction that reads uploaded statements and produces structured transactions matched to the account and the person. The system reconciles what was precleared against what was executed and flags the differences, which is the check that actually matters and the one manual processes almost never perform properly. Holdings reports and quarterly transaction reports generate from the same store rather than being typed. Private investments and outside accounts that cannot feed become tracked exceptions with attestation evidence rather than blind spots nobody has written down. Confirm the specific reporting content and timing your code requires with counsel, since codes differ by firm.

Problem 3: attestations are a survey nobody wants to complete

Annual code acknowledgement, outside business activities, political contributions, gifts and entertainment, private investment disclosures, and confirmation that the employee has no undisclosed accounts. Each is a form, each has a cycle, and each is chased by email until the compliance officer gives up and marks it done.

What a custom build does: pre-populate. An attestation that shows the employee what the firm already believes and asks them to confirm or correct it gets completed far more often than a blank form. Outside business activities carry forward from last year. Accounts on file are listed with a prompt to add any missing. Political contributions can be checked against public disclosure data where available, which turns a self-report into a verification. Escalation goes to the employee's manager on a schedule you set, not to a mailbox. The record you keep is the completed attestation, the version of the question set, and the reminder history, because the examiner will ask how you followed up on the people who did not respond.

Problem 4: marketing review is now a records problem

Every piece of client-facing material needs review before use, performance figures need supporting calculations, and any statement of fact needs substantiation on file. Firms handle this in email and a folder, so the reviewed version and the version that actually went out are frequently not the same file, and the substantiation is in an analyst's inbox.

What a custom build does: a review workflow where the material, its reviewer, the review comments, the approved version and the substantiation package are one record with an approval state, and the approved version is the one the marketing team can retrieve. Performance material links to the calculation inputs. Distribution is logged, so you can answer which clients received which version. This is not glamorous engineering, it is document state management done properly, and it converts one of the most common examination findings into a report you can run.

Problem 5: the annual review is a document, and it should be an output

Rule-driven firms have to test their own programme and record what they found. Most firms write a document each year that describes the policies and asserts they were followed. Examiners are more interested in testing evidence: samples pulled, exceptions found, remediation completed and dates.

What a custom build does: make testing a scheduled activity within the system. A sample of preclearance decisions is pulled automatically, a reviewer signs off, exceptions become tracked items with owners and due dates, and the annual review assembles from the year's testing record rather than being composed from memory in a quiet week. The examination evidence pack becomes an export with a date range and a scope, and producing it takes an afternoon. Firms that reach this state describe examinations very differently afterwards, because the conversation moves from assembling evidence to discussing judgement, which is where a compliance officer wants to be.

What this costs and how long it takes

Across the 2,000-plus projects Digital Heroes has delivered, the shape for adviser compliance builds is fairly consistent. A focused first release covering preclearance against a versioned restricted list, brokerage feed and statement ingestion with reconciliation, and the attestation cycle runs $60,000 to $130,000 and ships in 10 to 16 weeks. A full platform adding marketing review, gifts and entertainment, political contributions, trade surveillance rules, testing and the examination evidence pack runs $150,000 to $360,000 phased over 6 to 12 months.

What drives cost up: the number of custodian and broker feeds, since each is its own connection and format. Instrument coverage, because a firm trading options, futures, private credit or digital assets needs a security master that models what it actually trades rather than equities only. Affiliate structure, if you have a broker dealer or a fund complex with information barriers to enforce. Integration with your CRM and portfolio accounting, which is usually the reason to build in the first place. And the policy work itself, which is not engineering: your code has to be written precisely enough to be encoded, and firms often discover their policy language contains judgement calls that nobody had noticed.

What keeps cost down: starting with preclearance and personal trading, which is where the enforcement risk concentrates, and leaving marketing and gifts to a second phase.

Build versus buy, and when buying is right

Buy if you are a smaller adviser with a conventional long-only strategy and fewer than about twenty employees. SmartRIA and its peers cost a fraction of a build and will carry you a long way. ComplySci and MyComplianceOffice are also the sensible answer if you need broad coverage across many policies quickly and your feeds are mainstream. Firms that build without needing to end up maintaining software instead of running a compliance programme, which is a poor trade.

Build when two or more of these are true. Your restricted list is generated from internal sources such as a research pipeline or a deal list, and copying it into a vendor tool by hand is the weak point. You trade instruments the vendor's security master handles badly. You have information barriers between teams that must be enforced technically, not by policy alone. Your compliance data needs to sit alongside your CRM and portfolio system to be useful. Or you have already been through an examination where the finding was about evidence rather than conduct, which tells you the problem is records architecture and not effort.

Our opinion, stated plainly: the value of building here is not features, it is the immutable record. Any tool can capture a preclearance request. Very few can prove what your restricted list contained on a specific past morning, and that single capability is what turns an examination from an excavation into an export.

How to choose a developer for compliance software

Ask how they store the restricted list. If the answer is a table that gets updated, stop. You need an append-only, point-in-time structure where every version is preserved and queryable by date, and a developer who does not reach for that instinctively will build you the same spreadsheet with a login screen.

Ask what they have built where the audit trail was the product. Financial services, clinical or regulated manufacturing experience all count. What matters is whether they have designed systems where records cannot be edited quietly and approvals are cryptographically or structurally verifiable.

Ask about feed handling in specifics. Which custodians, which formats, what happens when a statement arrives for an account nobody disclosed, and how a personal trade that was never precleared is surfaced. Vague answers here mean they have not done this before.

Ask who owns the code, the cloud accounts and the compliance records, in writing, before kickoff. At Digital Heroes the client owns everything from the first commit. Your books and records obligations outlive any vendor relationship, and a firm that cannot extract its own compliance history in a usable form has created exactly the kind of dependency an examiner will find interesting.