The Compliance Risk Hiding in Your Website Updates

A website can change overnight. Marketing updates a headline, someone replaces a chart, a new landing page goes live, or the firm adds a new investment strategy. From a business perspective, these are routine updates. From a compliance perspective, each change can affect what the firm communicates to the public and what it may need to demonstrate to the SEC later.

I have seen compliance teams put a lot of effort into reviewing marketing materials while overlooking the website. Firms often update a pitch book or a team bio and forget to make the same change online. Or someone edits the website directly and skips the review the firm would apply to a PowerPoint presentation. Either way, the firm ends up saying different things in different places, and some of it was never reviewed. Your website is a collection of public statements about your firm, and it deserves the same review and recordkeeping as any other advertisement.

Reviewing the Website Is Not a One-Time Exercise

One of the first things I tell my colleagues is that a website review is not something you check off during onboarding and revisit a year later. Websites evolve constantly, and a page that was compliant when it launched may become inaccurate or misleading after a few updates.

The review process should cover the substance of the content, not just spelling and presentation. Look at claims about investment strategies, descriptions of services, testimonials, performance information, credentials, and statements about the firm's capabilities. Under the SEC Marketing Rule (Rule 206(4)-1 under the Investment Advisers Act), applicable requirements depend on what is being communicated and how it is presented. The expectation is to identify the risks, document your review, and make sure the content is appropriate before it goes live.

Every Claim on the Website Needs Support on File

The Marketing Rule’s general prohibitions apply to the website just as they apply to a pitch book. One of them is easy to overlook: an advertisement may not include a material statement of fact that the adviser does not reasonably believe it can substantiate upon demand by the SEC. In practice, the support has to exist before the claim goes live, not after an examiner asks for it.

Websites are full of these statements: “independent,” “award-winning,” “top-rated,” assets under management, number of client families, years of experience, professional designations, and industry memberships. Each one is a factual claim. If the firm cannot pull the documentation that supports it, the statement is a problem, no matter how long it has been on the page.

The SEC has made this point repeatedly. In September 2024, it settled with nine advisers over Marketing Rule violations, and four of them were cited for “conflict-free” claims they could not substantiate. Others in the same group advertised awards and ratings they could not support, and one claimed membership in an organization that did not exist.

Testimonials, Endorsements, and Ratings Need Their Own Review

Client reviews, video interviews, social media endorsements, and “Best Advisor” badges are some of the most common features on adviser websites, and they are among the most frequently cited. The Marketing Rule permits testimonials and endorsements, but only when specific conditions are met.

Also pay attention to content the firm does not write itself. Reviews on third-party platforms, posts the firm shares or comments on, and links to outside articles can become the firm’s own advertisement if the firm adopts the content or is involved in preparing it. Decide in advance how the firm will handle third-party reviews and links, and apply that approach consistently.

Make Sure the Archive Supports SEC Recordkeeping

Website archiving is not simply about saving screenshots for convenience. Investment advisers subject to the relevant SEC recordkeeping requirements need to understand which website materials and related communications must be retained, in what form, and for how long. Depending on the content, obligations may arise under the books and records rules, including Rule 204-2, as well as other applicable requirements.

For advertisements, Rule 204-2 generally requires advisers to keep a copy of each advertisement disseminated, the records needed to support performance information, and records relating to testimonials, endorsements, and third-party ratings, including the required disclosures and promoter agreements. These records are generally retained for five years from the end of the fiscal year in which the advertisement was last published.

Do not assume that a web developer's backup or a generic website history feature satisfies those obligations. Confirm that the records are complete, accessible, preserved for the required period, and retrievable when needed. Your archive should help the firm produce relevant records during an examination, not create another technical problem for compliance to solve.

The Goal Is to Be Able to Show Your Work

When I look at a firm's website review process, I am not just asking whether the current site looks compliant. I want to know whether the firm can explain what it published, how it supports each claim and testimonial, how the content was reviewed, what changed over time, and whether the required records are available.

That is the standard to work toward. You do not need to make every website update a major compliance project, but you do need to treat public-facing content as part of the firm's supervised communications and recordkeeping environment. A current website tells only part of the story. A documented review process and a reliable archive help tell the rest.

Keeping your website review process organized takes more than checking pages for compliance. NextReg helps RIAs strengthen their review workflows, maintain reliable records, and keep website changes from slipping through the cracks. If you need practical support building a process that works, schedule a consultation with our team. Let’s discuss how to make your website reviews more consistent and your records examination-ready.