SEC Outsourcing Rules
Definition
SEC Outsourcing Rules
SEC outsourcing rules is the phrase investment advisers use for the Securities and Exchange Commission’s expectations when they hand functions out to service providers. There is no dedicated outsourcing rule, because the proposed one was formally withdrawn in 2025.
The Commission proposed such a rule in November 2022 and it drew heavy comment.
It would have imposed due diligence and monitoring duties on advisers using service providers for covered functions, with new recordkeeping and form disclosure attached.
Then it went away — and advisers who built programmes around the draft now need to know what actually binds them.
Key takeaways
- The proposed outsourcing rule was withdrawn on 12 June 2025 and will not be finalised.
- Adviser outsourcing is still governed by fiduciary duty and the compliance rule.
- The compliance rule requires written policies, an annual review and a named officer.
- A withdrawn proposal is not a safe harbour; the underlying obligations never lapsed.
How it works
Start with what was withdrawn. The Commission listed Release IA-6176, File S7-25-22, among the proposals it dropped, stating that the Commission does not intend to issue final rules with respect to these proposals.
It left the door ajar — if the Commission decides to pursue future regulatory action in these areas, it will issue a new proposed rule rather than revive the old one.
What remains is the compliance rule. An adviser must adopt and implement written policies and procedures reasonably designed to prevent violation of the Advisers Act and the rules under it.
| Obligation | Status | Effect on outsourcing |
|---|---|---|
| Proposed outsourcing rule | Withdrawn June 2025 | No standalone diligence mandate |
| Compliance rule policies | In force | Policies must cover outsourced functions |
| Annual compliance review | In force | The review has to reach provider performance |
| Chief compliance officer | In force | A named supervised person, not a vendor role |
| Fiduciary duty | In force | Applies to the outcome, however delivered |
| Books and records | In force | Records must exist and be producible on request |
The annual review is the practical hook. An adviser must review the adequacy of its policies and procedures no less frequently than annually, and outsourced functions fall inside that review.
The officer requirement resists outsourcing entirely — the rule requires designating an individual who is a supervised person to administer the policies, which is a person rather than a firm.
Examples
Advisers outsource more than clients realise, and the obligations survive the delegation. Each example here shows what happens when the regime meets an offshore delivery floor.
A registered adviser outsources trade reconciliation to a Manila team. No standalone rule governs the choice, but the adviser’s policies must cover it and the annual review must test it.
A wealth manager uses an outsourced chief compliance officer service. The named officer must be a supervised person of the adviser, so the arrangement has to be structured around that requirement.
A fund manager relies on an administrator for books and records. The records obligation stays with the adviser, which is why examination requests land on it rather than on the administrator.
A firm that built a diligence programme for the proposed rule keeps it anyway. Nothing requires it, and abandoning it would be a poor answer to an examiner’s question about oversight.
Related terms
Adviser obligations are easily confused with the bank supervisory regimes that sit nearby. The entries below are the nearest neighbours, and each has a distinct scope.
- SOX compliance: the financial reporting regime for issuers rather than advisers.
- SOC 1 outsourcing: the controls report advisers request from administrators.
- Compliance outsourcing: contracting compliance support, subject to the officer requirement.
- Regulated outsourcing: supervised sector outsourcing generally.
- Vendor management outsourcing: the programme that evidences oversight.
- Finance and accounting outsourcing: the service category most advisers buy.
- Risk outsourcing: moving risk work out without moving the fiduciary duty.
FAQ
Is there an SEC rule on outsourcing?
Not a dedicated one. The proposed rule was withdrawn in June 2025, so advisers are governed by fiduciary duty, the compliance rule and recordkeeping obligations.
Does the withdrawal reduce our obligations?
No. It removes a proposed additional layer. Everything that applied before the proposal still applies now.
Can we outsource the chief compliance officer role?
Only in part. The rule requires designating an individual who is a supervised person, so a firm cannot be the designee.
What does the annual review have to cover?
The adequacy of the policies and procedures and the effectiveness of their implementation, which includes functions performed by providers.
Who holds the records if an administrator keeps them?
The adviser remains responsible for the books and records obligation, regardless of where the data physically sits.
Should we keep our outsourcing diligence programme?
Yes. It is evidence of oversight, and an examiner will read its absence unfavourably.
Start at verified partners in the Outsource Accelerator directory and work through the firms whose governance you can verify.
Independent
