By the Office of Compliance Inspections and Examinations1

1 
 
          National Examination Risk Alert 
By the Office of Compliance Inspections and Examinations
1
 
 
Volume II, Issue 1                                                    January 4,  2012   
  
Investment Adviser Use of Social 
Media 
I. Introduction 
 Social media
2
 
 is landscape-shifting.  It converts the 
traditional two-party, adviser-to-client communication into an 
interactive, multi-party dialogue among advisers, clients, and 
prospects, within an open architecture accessible to third-party 
observers.  It also converts a static medium, such as a website, 
where viewers passively receive content, into a medium where 
users actively create content.  
 The use of social media by the financial services industry 
is rapidly accelerating.  In growing numbers, registered 
investment advisers (“RIAs” or “firms”) are using social media 
to communicate with existing and potential clients, promote 
services, educate investors and recruit new employees.  Pursuant 
to Advisers Act Rule 206(4)-7,
3
                                                           
1
  The Securities and Exchange Commission (“SEC”), as a matter of policy, disclaims responsibility 
for any private publication or statement by any of its employees.  The views expressed herein are 
those of the staff of the Office of Compliance Inspections and Examinations, in coordination with 
other SEC staff, including in the Division of Enforcement’s Asset Management Unit and the 
Division of Investment Management, and do not necessarily reflect the views of the Commission or 
the other staff members of the SEC.  The staff of the Financial Industry Regulatory Authority 
(“FINRA”) was also consulted in the preparation of this Risk Alert.  This document was prepared by 
the SEC staff and is not legal advice. 
 firms using social media should 
adopt, and periodically review the effectiveness of, policies and 
2
  “Social media” is an umbrella term that encompasses various activities that integrate technology, 
social interaction and content creation.  Social media may use many technologies, including, but not 
limited to, blogs, microblogs, wikis, photos and video sharing, podcasts, social networking, and 
virtual worlds.  The terms “social media,” “social media sites,” “sites” and “social networking sites” 
are used interchangeably in this communication. 
3
         17 C.F.R. §206(4)-7.  
In this Alert:  
Topic: Observations related to the use 
of social media by registered 
investment advisers.  
Key Takeaways:  
Investment advisers that use or permit 
the use of social media by their 
representatives, solicitors and/or third 
parties should consider periodically 
evaluating the effectiveness of their 
compliance program as it relates to 
social media.  Factors that might be 
considered include usage guidelines, 
content standards, sufficient 
monitoring, approval of content, 
training, etc.  Particular attention 
should be paid to third party content 
(if permitted) and recordkeeping 
responsibilities. 
 

2 
 
procedures regarding social media in the face of rapidly changing technology.
4
 
   
Firms’ use of social media must comply with various provisions of the federal securities 
laws, including, but not limited to, the antifraud provisions,
5
 compliance provisions,
6
 and 
recordkeeping provisions.
7
RIAs’ use of social media has been a matter of interest to the staff, which recently identified 
registered investment advisers of varying sizes and strategies that were using social media to 
evaluate whether their use complied with the federal securities laws.
    
8
II. Staff Observations 
  Below are some 
observations from that review, as well as factors that the staff believes a firm that permits the use 
of social media may want to consider in complying with its obligations under the federal 
securities laws.   
A. Compliance Program Related to the Use of Social Media 
 
Many firms have policies and procedures within their compliance programs that 
specifically apply to the use of social media by the firm and its IARs; however, the staff 
observed variation in the form and substance of the policies and procedures.  The staff noted that 
many firms have multiple overlapping procedures that apply to advertisements, client 
communications or electronic communications generally, which may or may not specifically 
include social media use.  Such lack of specificity may cause confusion as to what procedures or 
standards apply to social media use.  Many procedures were also not specific as to which types 
of social networking activity are permitted or prohibited by the firm and many did not address 
the use of social media by solicitors.   
 
                                                           
4
          This Alert is not intended as a comprehensive summary of all compliance matters pertaining to the 
use of social media by RIAs.  Rather, it discusses measures that may assist RIAs in designing 
reasonable procedures designed to prevent violations of the Advisers Act and other federal securities 
laws with respect to firm, investment advisory representative (“IAR”) and solicitor (employees or 
third parties that solicit or “find” new  advisory clients) use of social media.   
5
  See, e.g., Section 17(a) of the Securities Act of 1933 (“Securities Act”), 15 U.S.C. §77q(a), Section 
10(b) of the Securities Exchange Act of 1934 (“Exchange Act”), 15 U.S.C. §78j(b), and Rule 10b-5 
thereunder, 17 C.F.R. §240.10b-5, and Sections 206(1), 206(2), and 206(4) of the Advisers Act, 15 
U.S.C. §§806-6(2), 806-6(4),  and Rule 206(4)-1 thereunder, 17 C.F.R. §206(4)-1. 
6
  See, e.g., Section 206(4) of the Advisers Act, 15 U.S.C. § 806-6(4), and Rule 206(4)-7 thereunder, 
17 C.F.R. §206(4)-7.    
7
  See, e.g., Section 204 of the Advisers Act, 15 U.S.C. § 804, and Rule 204(2) thereunder, 17 C.F.R. 
§204(2). 
8
  To the extent that a firm provides both brokerage and investment advisory services (“dual 
registrant”), it is required to adhere to both the federal securities laws and FINRA applicable rules, 
including but not limited to, depending on the circumstances, Rule 17a-4(b) (recordkeeping) under 
the Exchange Act, 17 C.F.R §240.17a-4(b), and NASD Rules 2210 and 3010.  FINRA has issued 
guidance regarding the application of the federal securities laws and its rules to the use of social 
media by broker-dealers or their representatives.  See FINRA Regulatory Notice 11-39 (Aug. 2011); 
FINRA Regulatory Notice 10-06 (Jan. 2010). 

3 
 
When evaluating its controls and compliance program, a firm should first identify conflicts 
and other compliance factors currently creating risk exposure for the firm and its clients in light 
of the firm's particular operations, and then test whether its existing policies and procedures 
effectively address those risks.
9
 
   
Below is a non-exhaustive list of factors
10
  that an investment adviser
11
• Usage Guidelines.  A firm may consider whether to create firm usage guidelines that 
provide guidance to IARs and solicitors on the appropriate and inappropriate use of 
social media.  A firm may also consider addressing appropriate restrictions and 
prohibitions regarding the use of social media sites based on the firm’s analysis of the 
risk to the firm and its clients.  For example, a firm may choose to provide an 
exclusive list of approved social media networking sites for IARs’ use or prohibit the 
use of specific functionalities on a site. 
 may want to consider 
when evaluating the effectiveness of its compliance program with respect to firm, IAR or 
solicitor use of social media: 
 
• Content Standards.  A firm may consider the risks that content created by the firm 
or its IARs or solicitors implicates its fiduciary duty or other regulatory issues (e.g., 
such as content that contains investment recommendations, information on specific 
investment services or investment performance).  A firm may also consider whether 
to articulate clear guidelines with respect to such content, and whether to prohibit 
specific content or impose other content restrictions.
12
 
     
• Monitoring.  A firm may consider how to effectively monitor the firm’s social media 
sites or firm use of third-party sites, taking into account that many third-party sites 
may not provide complete access to a supervisor or compliance personnel.   
 
• Frequency of Monitoring.  A firm may consider the frequency with which it 
monitors IAR or solicitor activity on a social media site.  For example, using a risk-
based approach, a firm may conclude that periodic, daily or real-time monitoring of 
the postings on a site is appropriate.  This determination could depend on the volume 
and pace of communications posted on a site or the nature of, and the probability to 
                                                           
9
  See Rule 206(4)-7 .  See generally Compliance Programs of Investment Companies and Investment 
Advisers, 68 FR 74714, 74716 (Dec. 24, 2003)(“Compliance Release”).  
10
         Firms are encouraged to consider the factors described herein in assessing the effectiveness of their 
compliance program and implementing improvements that will best protect their clients.  Firms are 
cautioned that these factors and suggestions are neither exhaustive nor will they constitute a safe 
harbor nor a “checklist” for SEC examiners.   Other factors besides those highlighted here may also 
be appropriate.  While some of the factors discussed herein reflect existing regulatory requirements, 
the adequacy of a compliance program can be determined only with reference to the profile of the 
specific firm and the specific facts and circumstances. 
11
        Dual registrants may also want to consider these factors, although they do not modify or displace 
firms’ obligations under the federal securities laws, FINRA or other rules relevant to social media, or 
FINRA guidance in this area, as referenced in footnote 7 supra. 
12
  A majority of the advisers we observed prohibited the posting of recommendations or information on 
specific products or services on their social media sites.   

4 
 
mislead contained in, the subject matter discussed in particular conversation streams.  
The after-the fact review of violative content days after it was posted on a firm’s 
social networking site, depending on the circumstances, may not be reasonable, 
particularly where social media content can be rapidly and broadly disseminated to 
investors and the markets. 
 
• Approval of Content.  A firm may want to consider the appropriateness of pre-
approval requirements (as opposed to after-the-fact review, as discussed above).
13
 
 
• Firm Resources.  A firm may consider whether it has dedicated sufficient 
compliance resources to adequately monitor IAR or solicitor activity on social media 
sites, including the ability to monitor the activity of numerous IARs or solicitors. A 
firm may also consider employing conversation monitoring or similar services from 
outside vendors, if, for example, the firm has many I ARs or solicitors who use social 
media sites.  A firm may consider using sampling, spot checking, or lexicon-based or 
other search methodologies, or a combination of methodologies, to monitor social 
media use and content.
14
 
    
• Criteria for Approving Participation.  In analyzing the risk exposure for a firm and 
its clients due to the use of a social networking site, the firm’s compliance procedures 
may consider, without limitation, the reputation of the site, the site’s privacy policy, 
the ability to remove third-party posts, controls on anonymous posting and the 
advertising practices of any social media site that the firm, or its IARs or solicitors 
use to conduct business.   
 
• Training. In establishing or reviewing any training requirements for its IARs, a firm 
may consider implementing training related to social media that seeks to promote 
compliance and to prevent potential violations of the federal securities laws and the 
firm’s internal policies.   
 
• Certification.  A firm may consider whether to require a certification by IARs and 
advisory solicitors confirming that those individuals understand and are complying 
with the firm’s social media policies and procedures.  
   
• Functionality.  A firm may consider the functionality of each social media site 
approved for use, including the continuing obligation to address any upgrades or 
modifications to the functionality that affect the risk exposure for the firm or its 
clients.  Such consideration is particularly significant given the rapidly evolving 
nature of this new media.   For example, a firm that chooses to host social media on a 
site that includes a functionality or engages in a practice that exposes a client-user’s 
                                                           
13
       The pre-approval of postings on a social media site is presently only required for broker-dealers in 
certain circumstances.  See NASD Rule 2210. 
14
        While the firm may use third-party services for this purpose, the firm is ultimately responsible for its 
IARs’ or solicitors’ use of social media.    

5 
 
privacy, which practice or policy cannot be disabled or modified, may need to 
consider whether the firm’s participation is appropriate. 
 
• Personal/Professional Sites.  A firm may consider whether to adopt policies and 
procedures to address an IAR or solicitor conducting firm business on personal (non-
business) or third-party social media sites.  For example, a firm may choose to specify 
what types of firm communications or content are permitted on a site that is not 
operated, supervised or sponsored by the firm.  While a firm may determine that it is 
appropriate to permit business card information on a specific personal site or third-
party site, it may choose to prohibit conducting firm business on that site.  
 
• Information Security.   A firm may consider whether permitting its IARs to have 
access to social media sites poses any information security risks.  Protecting 
information and information systems from unauthorized access, use, disclosure, 
disruption, modification, perusal, inspection, recording or destruction is an important 
risk faced by all firms.  Although hacking and other breaches of information security 
can be posed in multiple ways, use of social media, especially third party social media 
sites, may pose elevated risks.  Firms may consider adopting compliance policies and 
procedures to create appropriate firewalls between sensitive customer information, as 
well as the firm’s own proprietary information, and any social media site to the extent 
that the firm permits access to such sites by its IARs.   
 
• Enterprise Wide Sites.  An RIA that is part of a larger financial services or other 
corporate enterprise may consider whether to create usage guidelines reasonably 
designed to prevent the advertising practices of a firm-wide social media site from 
violations of the Advisers Act 
B. Third-Party Content 
 
Most firms allow third parties to make postings on their social media sites, but the 
policies and procedures governing such third-party postings vary in what types of postings are 
permissible.  Some firms allow third parties to post messages, forward links, and post articles on 
the firms’ social media sites, while other firms have explicit policies limiting third-party use to 
“one way postings,” where the firms’  IARs or solicitors post on the firms’ social media sites but 
do not interact with third parties or respond to third-party postings.  More conservatively, some 
firms limit third-party postings to authorized users and prohibit postings by the general public.  
Many firms post disclaimers directly on their site stating that they do not approve or endorse any 
third-party communications posted on their site in an attempt to avoid having a third-party 
posting attributed to the firm.   
 
Firms that allow for third-party postings on their social media sites may consider having 
policies and procedures concerning third-party postings, including the posting of testimonials 
about the firm or its IARs as well as reasonable safeguards in place to avoid any violation of the 
federal securities laws.  
 

6 
 
• Testimonials. Whether a third-party statement is a testimonial
15
 depends upon all of 
the facts and circumstances relating to the statement. The term “testimonial” is not 
defined in Rule 206(4)-1(a)(1), but SEC staff consistently interprets that term to 
include a statement of a client's experience with, or endorsement of, an investment 
adviser.  Therefore, the staff believes that, depending on the facts and circumstances, 
the use of “social plug-ins” such as the “like” button could be a testimonial under the 
Advisers Act.
16
C. Recordkeeping Responsibilities 
  Third-party use of the “like” feature on an investment adviser’s 
social media site could be deemed to be a testimonial if it is an explicit or implicit 
statement of a client's or clients' experience with an investment adviser or IAR.  If, for 
example, the public is invited to “like” an IAR’s biography posted on a social media 
site, that election could be viewed as a type of testimonial prohibited by rule 206(4)-
1(a)(1).
   
 
 The Advisers Act sets forth the recordkeeping obligations of registered investment 
advisers.
17
 The recordkeeping obligation does not differentiate between various media, including 
paper and electronic communications, such as e-mails, instant messages and other Internet 
communications that relate to the advisers’ recommendations or advice.  RIAs that communicate 
through social media must retain records of those communications if they contain information 
that satisfies an investment adviser’s recordkeeping obligations under the Advisers Act.
18
 
  In the 
staff’s view the content of the communication is determinative.  A firm that intends to 
communicate, or permit its IARs to communicate, through social media sites may wish to 
determine that it can retain all required records related to social media communications and make 
them available for inspection. 
 Social media offers multiple ways to communicate with existing or potential clients from 
status updates, discussion boards, emails, texting, direct messaging or chat rooms.  RIAs should 
consider reviewing their document retention policies to ensure that any required records 
generated by social media communications are retained in compliance with the federal securities 
laws, including in a manner that is easily accessible for a period not less than five years.  RIAs 
                                                           
15
  Rule 206(4)-1(a)(1) states that: 
           [i]t shall constitute a fraudulent, deceptive, or manipulative act, practice, or course of business ... 
for any investment adviser registered or required to be registered under [the Advisers Act], directly 
or indirectly, to publish, circulate, or distribute any advertisement which refers, directly or 
indirectly, to any testimonial of any kind concerning the investment adviser or concerning any 
advice, analysis, report or other service rendered by such investment adviser. 
           
16
  Some social media sites do not permit an investment adviser to disable the “like” or similar feature, 
which may require an investment adviser to develop a system to monitor and, if necessary, remove 
third-party postings.   
17
  Rule 204-2 requires investment advisers to make certain books and records relating to their advisory 
business (“required records”) and to keep them for a specified period of time.  In addition, the rule 
requires investment advisers that keep required records in an electronic format to keep them in a 
manner that
 allows the records to be arranged and indexed.  See Section 204 of the Advisers Act and 
Rule 204-2 thereunder. 
18
  See Rule 204-2. 

7 
 
should consider whether their retention policies account for the volume of communication and 
unique communication channels available to each particular social media site.  Investment 
advisers may consider adopting compliance policies and procedures that address (if relevant) the 
following factors, among others, relating to the recordkeeping and production requirements of 
required records generated by social media communications: 
 
• Determining, among other things, (1) whether each social media communication used 
is a required record, and, if so, (2) the applicable retention period, and (3) the 
accessibility of the records.  
• Maintaining social media communications in electronic or paper format (e.g., screen 
print or pdf of social media page, if practicable). 
• Conducting employee training programs to educate advisory personnel about 
recordkeeping provisions. 
• Arranging and indexing social media communications that are required records and 
kept in an electronic format to promote easy location, access and retrieval of a 
particular record. 
• Periodic test checking (using key word searches or otherwise) to ascertain whether 
employees are complying with the compliance policies and procedures (e.g., whether 
employees are improperly destroying required records).  
• Using third parties to keep records consistent with the recordkeeping requirements. 
 
IV. Conclusion 
 
 While many RIAs are eager to leverage social media to market and communicate with 
existing clients, and to promote general visibility, RIAs should ensure that they are in 
compliance with all of the regulatory requirements and be aware of the risks associated with 
using various forms of social media.  The staff hopes that sharing observations from its recent 
review of RIAs’ use of social media as well as its suggestions regarding factors that firms may 
wish to consider is helpful to firms in strengthening their compliance and risk management 
programs.  The staff also welcomes comments and suggestions about how the Commission’s 
examination program can better fulfill its mission to promote compliance, prevent fraud, monitor 
risk, and inform SEC policy.  If you suspect or observe activity that may violate the federal 
securities laws or otherwise operates to harm investors, please notify us at 
http://www.sec.gov/complaint/info_tipscomplaint.shtml. 

1 
 

          National Examination Risk Alert 
By the Office of Compliance Inspections and Examinations1

 

 

Volume II, Issue 1                                                    January 4, 2012   
  

Investment Adviser Use of Social 
Media 

I. Introduction 
 Social media2

 

 is landscape-shifting.  It converts the 
traditional two-party, adviser-to-client communication into an 
interactive, multi-party dialogue among advisers, clients, and 
prospects, within an open architecture accessible to third-party 
observers.  It also converts a static medium, such as a website, 
where viewers passively receive content, into a medium where 
users actively create content.  

 The use of social media by the financial services industry 
is rapidly accelerating.  In growing numbers, registered 
investment advisers (“RIAs” or “firms”) are using social media 
to communicate with existing and potential clients, promote 
services, educate investors and recruit new employees.  Pursuant 
to Advisers Act Rule 206(4)-7,3

                                                           
1  The Securities and Exchange Commission (“SEC”), as a matter of policy, disclaims responsibility 

for any private publication or statement by any of its employees.  The views expressed herein are 
those of the staff of the Office of Compliance Inspections and Examinations, in coordination with 
other SEC staff, including in the Division of Enforcement’s Asset Management Unit and the 
Division of Investment Management, and do not necessarily reflect the views of the Commission or 
the other staff members of the SEC.  The staff of the Financial Industry Regulatory Authority 
(“FINRA”) was also consulted in the preparation of this Risk Alert.  This document was prepared by 
the SEC staff and is not legal advice. 

 firms using social media should 
adopt, and periodically review the effectiveness of, policies and 

2  “Social media” is an umbrella term that encompasses various activities that integrate technology, 
social interaction and content creation.  Social media may use many technologies, including, but not 
limited to, blogs, microblogs, wikis, photos and video sharing, podcasts, social networking, and 
virtual worlds.  The terms “social media,” “social media sites,” “sites” and “social networking sites” 
are used interchangeably in this communication. 

3         17 C.F.R. §206(4)-7.  

In this Alert:  

Topic: Observations related to the use 
of social media by registered 
investment advisers.  

Key Takeaways:  

Investment advisers that use or permit 
the use of social media by their 
representatives, solicitors and/or third 
parties should consider periodically 
evaluating the effectiveness of their 
compliance program as it relates to 
social media.  Factors that might be 
considered include usage guidelines, 
content standards, sufficient 
monitoring, approval of content, 
training, etc.  Particular attention 
should be paid to third party content 
(if permitted) and recordkeeping 
responsibilities. 

 



2 
 

procedures regarding social media in the face of rapidly changing technology.4

 
   

Firms’ use of social media must comply with various provisions of the federal securities 
laws, including, but not limited to, the antifraud provisions,5 compliance provisions,6 and 
recordkeeping provisions.7

RIAs’ use of social media has been a matter of interest to the staff, which recently identified 
registered investment advisers of varying sizes and strategies that were using social media to 
evaluate whether their use complied with the federal securities laws.

    

8

II. Staff Observations 

  Below are some 
observations from that review, as well as factors that the staff believes a firm that permits the use 
of social media may want to consider in complying with its obligations under the federal 
securities laws.   

A. Compliance Program Related to the Use of Social Media 
 

Many firms have policies and procedures within their compliance programs that 
specifically apply to the use of social media by the firm and its IARs; however, the staff 
observed variation in the form and substance of the policies and procedures.  The staff noted that 
many firms have multiple overlapping procedures that apply to advertisements, client 
communications or electronic communications generally, which may or may not specifically 
include social media use.  Such lack of specificity may cause confusion as to what procedures or 
standards apply to social media use.  Many procedures were also not specific as to which types 
of social networking activity are permitted or prohibited by the firm and many did not address 
the use of social media by solicitors.   

 
                                                           

4          This Alert is not intended as a comprehensive summary of all compliance matters pertaining to the 
use of social media by RIAs.  Rather, it discusses measures that may assist RIAs in designing 
reasonable procedures designed to prevent violations of the Advisers Act and other federal securities 
laws with respect to firm, investment advisory representative (“IAR”) and solicitor (employees or 
third parties that solicit or “find” new  advisory clients) use of social media.   

5  See, e.g., Section 17(a) of the Securities Act of 1933 (“Securities Act”), 15 U.S.C. §77q(a), Section 
10(b) of the Securities Exchange Act of 1934 (“Exchange Act”), 15 U.S.C. §78j(b), and Rule 10b-5 
thereunder, 17 C.F.R. §240.10b-5, and Sections 206(1), 206(2), and 206(4) of the Advisers Act, 15 
U.S.C. §§806-6(2), 806-6(4),  and Rule 206(4)-1 thereunder, 17 C.F.R. §206(4)-1. 

6  See, e.g., Section 206(4) of the Advisers Act, 15 U.S.C. § 806-6(4), and Rule 206(4)-7 thereunder, 
17 C.F.R. §206(4)-7.  

7  See, e.g., Section 204 of the Advisers Act, 15 U.S.C. § 804, and Rule 204(2) thereunder, 17 C.F.R. 
§204(2). 

8  To the extent that a firm provides both brokerage and investment advisory services (“dual 
registrant”), it is required to adhere to both the federal securities laws and FINRA applicable rules, 
including but not limited to, depending on the circumstances, Rule 17a-4(b) (recordkeeping) under 
the Exchange Act, 17 C.F.R §240.17a-4(b), and NASD Rules 2210 and 3010.  FINRA has issued 
guidance regarding the application of the federal securities laws and its rules to the use of social 
media by broker-dealers or their representatives.  See FINRA Regulatory Notice 11-39 (Aug. 2011); 
FINRA Regulatory Notice 10-06 (Jan. 2010). 



3 
 

When evaluating its controls and compliance program, a firm should first identify conflicts 
and other compliance factors currently creating risk exposure for the firm and its clients in light 
of the firm's particular operations, and then test whether its existing policies and procedures 
effectively address those risks.9

 
   

Below is a non-exhaustive list of factors10  that an investment adviser11

• Usage Guidelines.  A firm may consider whether to create firm usage guidelines that 
provide guidance to IARs and solicitors on the appropriate and inappropriate use of 
social media.  A firm may also consider addressing appropriate restrictions and 
prohibitions regarding the use of social media sites based on the firm’s analysis of the 
risk to the firm and its clients.  For example, a firm may choose to provide an 
exclusive list of approved social media networking sites for IARs’ use or prohibit the 
use of specific functionalities on a site. 

 may want to consider 
when evaluating the effectiveness of its compliance program with respect to firm, IAR or 
solicitor use of social media: 

 
• Content Standards.  A firm may consider the risks that content created by the firm 

or its IARs or solicitors implicates its fiduciary duty or other regulatory issues (e.g., 
such as content that contains investment recommendations, information on specific 
investment services or investment performance).  A firm may also consider whether 
to articulate clear guidelines with respect to such content, and whether to prohibit 
specific content or impose other content restrictions.12

 
     

• Monitoring.  A firm may consider how to effectively monitor the firm’s social media 
sites or firm use of third-party sites, taking into account that many third-party sites 
may not provide complete access to a supervisor or compliance personnel.   
 

• Frequency of Monitoring.  A firm may consider the frequency with which it 
monitors IAR or solicitor activity on a social media site.  For example, using a risk-
based approach, a firm may conclude that periodic, daily or real-time monitoring of 
the postings on a site is appropriate.  This determination could depend on the volume 
and pace of communications posted on a site or the nature of, and the probability to 

                                                           
9  See Rule 206(4)-7.  See generally Compliance Programs of Investment Companies and Investment 

Advisers, 68 FR 74714, 74716 (Dec. 24, 2003)(“Compliance Release”).  
10         Firms are encouraged to consider the factors described herein in assessing the effectiveness of their 

compliance program and implementing improvements that will best protect their clients.  Firms are 
cautioned that these factors and suggestions are neither exhaustive nor will they constitute a safe 
harbor nor a “checklist” for SEC examiners.   Other factors besides those highlighted here may also 
be appropriate. While some of the factors discussed herein reflect existing regulatory requirements, 
the adequacy of a compliance program can be determined only with reference to the profile of the 
specific firm and the specific facts and circumstances. 

11        Dual registrants may also want to consider these factors, although they do not modify or displace 
firms’ obligations under the federal securities laws, FINRA or other rules relevant to social media, or 
FINRA guidance in this area, as referenced in footnote 7 supra. 

12  A majority of the advisers we observed prohibited the posting of recommendations or information on 
specific products or services on their social media sites.   



4 
 

mislead contained in, the subject matter discussed in particular conversation streams.  
The after-the fact review of violative content days after it was posted on a firm’s 
social networking site, depending on the circumstances, may not be reasonable, 
particularly where social media content can be rapidly and broadly disseminated to 
investors and the markets. 

 
• Approval of Content.  A firm may want to consider the appropriateness of pre-

approval requirements (as opposed to after-the-fact review, as discussed above).13

 
 

• Firm Resources.  A firm may consider whether it has dedicated sufficient 
compliance resources to adequately monitor IAR or solicitor activity on social media 
sites, including the ability to monitor the activity of numerous IARs or solicitors. A 
firm may also consider employing conversation monitoring or similar services from 
outside vendors, if, for example, the firm has many IARs or solicitors who use social 
media sites.  A firm may consider using sampling, spot checking, or lexicon-based or 
other search methodologies, or a combination of methodologies, to monitor social 
media use and content.14

 
    

• Criteria for Approving Participation.  In analyzing the risk exposure for a firm and 
its clients due to the use of a social networking site, the firm’s compliance procedures 
may consider, without limitation, the reputation of the site, the site’s privacy policy, 
the ability to remove third-party posts, controls on anonymous posting and the 
advertising practices of any social media site that the firm, or its IARs or solicitors 
use to conduct business.   
 

• Training. In establishing or reviewing any training requirements for its IARs, a firm 
may consider implementing training related to social media that seeks to promote 
compliance and to prevent potential violations of the federal securities laws and the 
firm’s internal policies.   

 
• Certification.  A firm may consider whether to require a certification by IARs and 

advisory solicitors confirming that those individuals understand and are complying 
with the firm’s social media policies and procedures.  

   
• Functionality.  A firm may consider the functionality of each social media site 
approved for use, including the continuing obligation to address any upgrades or 
modifications to the functionality that affect the risk exposure for the firm or its 
clients.  Such consideration is particularly significant given the rapidly evolving 
nature of this new media.   For example, a firm that chooses to host social media on a 
site that includes a functionality or engages in a practice that exposes a client-user’s 

                                                           
13       The pre-approval of postings on a social media site is presently only required for broker-dealers in 

certain circumstances.  See NASD Rule 2210. 
14        While the firm may use third-party services for this purpose, the firm is ultimately responsible for its 

IARs’ or solicitors’ use of social media.    



5 
 

privacy, which practice or policy cannot be disabled or modified, may need to 
consider whether the firm’s participation is appropriate. 
 

• Personal/Professional Sites.  A firm may consider whether to adopt policies and 
procedures to address an IAR or solicitor conducting firm business on personal (non-
business) or third-party social media sites.  For example, a firm may choose to specify 
what types of firm communications or content are permitted on a site that is not 
operated, supervised or sponsored by the firm.  While a firm may determine that it is 
appropriate to permit business card information on a specific personal site or third-
party site, it may choose to prohibit conducting firm business on that site.  

 
• Information Security.   A firm may consider whether permitting its IARs to have 

access to social media sites poses any information security risks.  Protecting 
information and information systems from unauthorized access, use, disclosure, 
disruption, modification, perusal, inspection, recording or destruction is an important 
risk faced by all firms.  Although hacking and other breaches of information security 
can be posed in multiple ways, use of social media, especially third party social media 
sites, may pose elevated risks.  Firms may consider adopting compliance policies and 
procedures to create appropriate firewalls between sensitive customer information, as 
well as the firm’s own proprietary information, and any social media site to the extent 
that the firm permits access to such sites by its IARs.   

 
• Enterprise Wide Sites.  An RIA that is part of a larger financial services or other 

corporate enterprise may consider whether to create usage guidelines reasonably 
designed to prevent the advertising practices of a firm-wide social media site from 
violations of the Advisers Act 

B. Third-Party Content 
 

Most firms allow third parties to make postings on their social media sites, but the 
policies and procedures governing such third-party postings vary in what types of postings are 
permissible.  Some firms allow third parties to post messages, forward links, and post articles on 
the firms’ social media sites, while other firms have explicit policies limiting third-party use to 
“one way postings,” where the firms’  IARs or solicitors post on the firms’ social media sites but 
do not interact with third parties or respond to third-party postings.  More conservatively, some 
firms limit third-party postings to authorized users and prohibit postings by the general public.  
Many firms post disclaimers directly on their site stating that they do not approve or endorse any 
third-party communications posted on their site in an attempt to avoid having a third-party 
posting attributed to the firm.   
 

Firms that allow for third-party postings on their social media sites may consider having 
policies and procedures concerning third-party postings, including the posting of testimonials 
about the firm or its IARs as well as reasonable safeguards in place to avoid any violation of the 
federal securities laws.  

 

http://en.wikipedia.org/wiki/Information_system�


6 
 

• Testimonials. Whether a third-party statement is a testimonial15 depends upon all of 
the facts and circumstances relating to the statement. The term “testimonial” is not 
defined in Rule 206(4)-1(a)(1), but SEC staff consistently interprets that term to 
include a statement of a client's experience with, or endorsement of, an investment 
adviser.  Therefore, the staff believes that, depending on the facts and circumstances, 
the use of “social plug-ins” such as the “like” button could be a testimonial under the 
Advisers Act.16

C. Recordkeeping Responsibilities 

  Third-party use of the “like” feature on an investment adviser’s 
social media site could be deemed to be a testimonial if it is an explicit or implicit 
statement of a client's or clients' experience with an investment adviser or IAR.  If, for 
example, the public is invited to “like” an IAR’s biography posted on a social media 
site, that election could be viewed as a type of testimonial prohibited by rule 206(4)-
1(a)(1).   

 
 The Advisers Act sets forth the recordkeeping obligations of registered investment 
advisers.17 The recordkeeping obligation does not differentiate between various media, including 
paper and electronic communications, such as e-mails, instant messages and other Internet 
communications that relate to the advisers’ recommendations or advice.  RIAs that communicate 
through social media must retain records of those communications if they contain information 
that satisfies an investment adviser’s recordkeeping obligations under the Advisers Act.18

 

  In the 
staff’s view the content of the communication is determinative.  A firm that intends to 
communicate, or permit its IARs to communicate, through social media sites may wish to 
determine that it can retain all required records related to social media communications and make 
them available for inspection. 

 Social media offers multiple ways to communicate with existing or potential clients from 
status updates, discussion boards, emails, texting, direct messaging or chat rooms.  RIAs should 
consider reviewing their document retention policies to ensure that any required records 
generated by social media communications are retained in compliance with the federal securities 
laws, including in a manner that is easily accessible for a period not less than five years.  RIAs 
                                                           

15  Rule 206(4)-1(a)(1) states that: 
           [i]t shall constitute a fraudulent, deceptive, or manipulative act, practice, or course of business … 

for any investment adviser registered or required to be registered under [the Advisers Act], directly 
or indirectly, to publish, circulate, or distribute any advertisement which refers, directly or 
indirectly, to any testimonial of any kind concerning the investment adviser or concerning any 
advice, analysis, report or other service rendered by such investment adviser. 

           
16  Some social media sites do not permit an investment adviser to disable the “like” or similar feature, 

which may require an investment adviser to develop a system to monitor and, if necessary, remove 
third-party postings.   

17  Rule 204-2 requires investment advisers to make certain books and records relating to their advisory 
business (“required records”) and to keep them for a specified period of time.  In addition, the rule 
requires investment advisers that keep required records in an electronic format to keep them in a 
manner that allows the records to be arranged and indexed.  See Section 204 of the Advisers Act and 
Rule 204-2 thereunder. 

18  See Rule 204-2. 



7 
 

should consider whether their retention policies account for the volume of communication and 
unique communication channels available to each particular social media site.  Investment 
advisers may consider adopting compliance policies and procedures that address (if relevant) the 
following factors, among others, relating to the recordkeeping and production requirements of 
required records generated by social media communications: 
 

• Determining, among other things, (1) whether each social media communication used 
is a required record, and, if so, (2) the applicable retention period, and (3) the 
accessibility of the records.  

• Maintaining social media communications in electronic or paper format (e.g., screen 
print or pdf of social media page, if practicable). 

• Conducting employee training programs to educate advisory personnel about 
recordkeeping provisions. 

• Arranging and indexing social media communications that are required records and 
kept in an electronic format to promote easy location, access and retrieval of a 
particular record. 

• Periodic test checking (using key word searches or otherwise) to ascertain whether 
employees are complying with the compliance policies and procedures (e.g., whether 
employees are improperly destroying required records).  

• Using third parties to keep records consistent with the recordkeeping requirements. 
 

IV. Conclusion 
 
 While many RIAs are eager to leverage social media to market and communicate with 
existing clients, and to promote general visibility, RIAs should ensure that they are in 
compliance with all of the regulatory requirements and be aware of the risks associated with 
using various forms of social media.  The staff hopes that sharing observations from its recent 
review of RIAs’ use of social media as well as its suggestions regarding factors that firms may 
wish to consider is helpful to firms in strengthening their compliance and risk management 
programs.  The staff also welcomes comments and suggestions about how the Commission’s 
examination program can better fulfill its mission to promote compliance, prevent fraud, monitor 
risk, and inform SEC policy.  If you suspect or observe activity that may violate the federal 
securities laws or otherwise operates to harm investors, please notify us at 
http://www.sec.gov/complaint/info_tipscomplaint.shtml. 


	I. Introduction
	II. Staff Observations
	A. Compliance Program Related to the Use of Social Media
	B. Third-Party Content
	C. Recordkeeping Responsibilities