Executive Summary
Utah’s RIA compliance regime directly incorporates SEC standards through Rule R164-5-1, making federal compliance best practices mandatory for state-registered advisers. This framework optimizes ECIC’s compliance approach while preparing for growth and SEC transition.
Key Finding: Utah Rule R164-5-1 states that advisers “shall make, maintain and preserve books and records in compliance with SEC Rule 204-2” - making our current SEC-based framework appropriate, not over-compliance.
Utah Regulatory Framework
Governing Authorities
- Primary Regulator: Utah Division of Securities (Department of Commerce)
- Legal Foundation: Utah Uniform Securities Act (Title 61, Chapter 1)
- Administrative Rules: Utah Code R164 (Securities)
- Federal Integration: Direct adoption of SEC rules by reference
Fiduciary Duty Standard
Utah maintains the overarching fiduciary duty requiring advisers to: - Act in clients’ best interests - Maintain duty of care and loyalty - Justify all actions as consistent with fiduciary obligations
Recent Example: August 2025 - Division removed hourly fee caps but increased scrutiny of “reasonable” fees during examinations.
Core Compliance Obligations
2. Custody Requirements (Rule R164-2-2)
Custody Triggers: - Direct holding of client funds/securities - Authority to obtain possession - Hidden trigger: Possessing client login credentials = custody
If ECIC Has Custody: - [ ] Qualified custodian maintenance - [ ] Quarterly client statements (direct from custodian) - [ ] Annual surprise examination by independent CPA - [ ] Audited balance sheet filed within 90 days of fiscal year-end
3. Cybersecurity Requirements
Utah Standard: Written cybersecurity policy required Best Practice Standard: SEC Regulation S-P model (recommended by Division)
Required Components: - [ ] Written Incident Response Program - [ ] Client notification within 30 days of breach determination - [ ] Vendor due diligence and monitoring - [ ] Regular testing and CCO oversight
4. Annual Requirements
- License Renewal: Payment due mid-December ($40 RIA + $30 per IAR)
- IAR Continuing Education: 12 hours annually (6 products/practices + 6 ethics)
- Form ADV Annual Amendment: Within 90 days of fiscal year-end
Record-Keeping Compliance Matrix
Utah Rule R164-5-1 = SEC Rule 204-2
Direct adoption means federal standards are Utah requirements.
| Financial Records |
Journals, ledgers, bank statements |
5 years (2 on-site) |
✅ Compliant |
Monthly reconciliation |
| Trade Records |
Order memoranda, execution details |
5 years (2 on-site) |
✅ Automated |
Verify trade blotter archive |
| Client Communications |
All written communications |
5 years (2 on-site) |
✅ Automated |
Email archival system active |
| Advertising |
All marketing to 2+ persons |
5 years from last use |
✅ Compliant |
Central advertising file |
| Disclosure Documents |
Form ADV, contracts, delivery dates |
5 years from last use |
🔍 Audit needed |
CRM delivery tracking |
| Code of Ethics |
Code + violations + acknowledgements |
5 years from last effective |
🔍 Audit needed |
Annual attestations |
| Personal Trading |
Access person transactions/holdings |
5 years from report |
🔍 Audit needed |
Quarterly review system |
Off-Channel Communications Risk
High Priority: SEC enforcement actions for unapproved messaging platforms Required Controls: - [ ] Written policy prohibiting personal messaging for business - [ ] Annual training and attestations - [ ] Periodic surveillance of approved channels - [ ] Documented disciplinary procedures
Examination Readiness Framework
Utah Division Examination Process
- Pre-Exam: Document request list (often advance notice)
- On-Site: CCO interview, premises tour, document review
- Post-Exam: Additional requests continue for weeks
- Resolution: No action letter or deficiency letter with required response
Primary Examination Focus Areas
| Policies & Procedures |
Generic manual not tailored to business |
✅ Customized manual |
| Form ADV Accuracy |
Discrepancies between ADV and actual practices |
🔍 Verification needed |
| Client Files |
Missing contracts, suitability docs, delivery records |
🔍 File audit required |
| Billing Practices |
Fee calculation errors, unreasonable fees |
🔍 Sample verification needed |
| Record Keeping |
Inadequate client suitability documentation |
✅ Hooks system compliant |
Exam-Ready Best Practices
Scaling Strategy & AUM Thresholds
State to Federal Registration Transition
| Under $90M |
Utah mandatory |
Maintain state compliance |
Perfect Utah framework |
| $90M - $100M |
Utah mandatory |
Prepare for SEC transition |
Draft SEC-level policies |
| $100M - $110M |
Eligible for SEC |
Optimal transition window |
Proactive SEC registration |
| Over $110M |
SEC mandatory |
Must register within 90 days |
Mandatory compliance |
Multi-State Expansion Framework
De Minimis Rule: Up to 5 clients per state without registration (no in-state office)
ECIC Multi-State Strategy: 1. Client Tracking: CRM system tracks all client state residency 2. Internal Trigger: Begin registration process with 4th client in new state 3. Proactive Registration: Complete before 5th client triggers requirement 4. Most Restrictive Standard: Adopt highest compliance standard across all states
Integration with Existing Systems
Hooks Data Catalog Compliance
- ✅ Electronic Records: DuckDB system meets SEC Rule 204-2(g) requirements
- ✅ Communication Archival: Gmail metadata capture (180 days rolling)
- ✅ Audit Trail: Complete execution tracking for compliance verification
- 🔍 Missing: Personal trading pre-clearance and reporting system
LACRM CRM Integration
- ✅ Client Contracts: Storage and version control
- ✅ Disclosure Delivery: Date tracking capability
- 🔍 Enhancement Needed: Suitability information documentation
- 🔍 Enhancement Needed: Billing calculation verification
This framework positions ECIC for sustainable growth while maintaining Utah compliance excellence and preparing for federal registration transition.