The SEC's Division of Examinations issued a Risk Alert on April 26, 2022, flagging recurring deficiencies at registered investment advisers. The alert focuses on Section 204A of the Investment Advisers Act—which requires policies to prevent misuse of material non-public information (MNPI)—and Rule 204A-1, the Code of Ethics Rule.
Examiners found two broad problem areas: weak MNPI controls, particularly around nontraditional data sources, and widespread failures in access-person oversight. For compliance teams, the alert functions as a pre-examination checklist. For firms that have deferred updates to their codes of ethics, it is a warning.
What the SEC examiners actually flagged
MNPI and information barriers.** Advisers lacked policies for identifying and supervising "value-add investors" who may carry inside information. More striking: firms using alternative data, metadata, or expert networks often had no written procedures governing receipt of that information. Where expert networks were involved, there were no controls on consultant conversations that might transmit MNPI.
Code of Ethics Rule compliance.** Examiners documented access persons who were never identified, IPO and limited-offering purchases that bypassed preapproval, and missing or incomplete supervisory reviews of personal trade reports. Additional failures included reports submitted late, incorrect information in reports, codes that did not require submissions, and supervised persons who never acknowledged receipt of the code.
Who should care
| Stakeholder | Primary concern | Immediate action |
|---|---|---|
| Chief compliance officers | Deficiency letters and exam findings | Audit policies against the Risk Alert checklist |
| General counsel / legal | Enforcement exposure from "failure to enforce" | Review whether written procedures are actually implemented |
| Portfolio managers | Reputational and legal risk if MNPI enters investment decisions | Confirm restricted-list procedures are active and documented |
| Operations / trading desk | Trade preapproval and reporting deadlines | Verify access-person lists are current and reports are timely |
| Boards / management committees | Fiduciary duty oversight | Request compliance posture update using the Risk Alert as benchmark |
Why this matters
The SEC is signaling that compliance manuals written for a pre-digital era are insufficient. The explicit focus on alternative data, metadata, and expert networks tells firms to expect examiners who understand modern information-gathering—and to have written policies that govern it.
The agency also continues to find basic paperwork failures. Missing trade reports, unsigned code acknowledgments, and absent preapprovals may seem procedural, but they are the evidence examiners use to demonstrate a firm "failed to enforce" its own code—a finding that carries real weight in enforcement actions.
A practical scenario
A mid-sized adviser uses an expert network to consult former industry executives before sector positioning. Under review: Does the current policy specify who may engage which consultants? Does it require MNPI flags to be logged and transmitted to a compliance officer? Can the firm produce documentation that this actually occurred?
If the answer to any of these is no, the Risk Alert has identified the gap. The fix typically involves a code addendum, a preapproval form for IPOs and private offerings, and a quarterly verification that access-person reports are complete and signed.
What to watch
Two developments will determine whether this alert reshapes practice or fades into background noise. First, whether examiners maintain focus on alternative data and expert networks in subsequent exam cycles—consistent attention signals that firms can expect scrutiny on these topics. Second, whether the alert precedes a broader enforcement initiative, as past risk alerts have.
Key takeaways
- Treat the April 2022 Risk Alert as a gap assessment tool; compare your current policies against each flagged deficiency.
- For firms using alternative data or expert networks, written procedures are no longer optional—examiners are specifically looking for them.
- Prioritize the unglamorous fixes: current access-person lists, IPO preapproval workflows, timely trade reporting, and signed code acknowledgments.
Frequently asked questions
Does this Risk Alert create new legal obligations?
No. The underlying obligations stem from Section 204A of the Advisers Act and Rule 204A-1. The alert clarifies where examiners are finding existing requirements unmet.
What counts as "alternative data" under this alert?
The alert references nontraditional data sources broadly, including metadata and third-party information aggregators. Advisers should evaluate any external data used in investment decisions for MNPI risk.
Who qualifies as an "access person"?
Generally, supervised persons with access to non-public client recommendations or who participate in producing them. The precise definition is firm-specific and set in each adviser's code of ethics.
Why does the alert emphasize expert networks?
Consultants may have access to MNPI through industry relationships. Without written engagement procedures and oversight, conversations with them can become a conduit for inside information.
What is a restricted list, and why does the alert recommend it?
A restricted list documents issuers about which the firm holds inside information. While not explicitly required, the alert cites it as a best practice because it creates a clear, auditable mechanism to block trading while sensitive information exists.