Run each line against the rule that makes it mandatory, then keep the paper showing the work happened. A firm can hire out the analysis and still owns the duty, because the obligation runs to the client under the Advisers Act. In my experience the diligence usually happened and the file cannot demonstrate it, which at examination produces the same finding as never having done it.
RIA crypto due diligence: the short version
- No rule tells an adviser how to vet a provider. The SEC’s proposed outsourcing rule was withdrawn on 17 June 2025, so the obligation runs through section 206, 275.206(4)-7, and 275.204-2.
- The measure is a reasonable investigation, enough that advice does not rest on materially inaccurate or incomplete information (SEC Release IA-5248).
- The custody rule writes one step for you: a reasonable basis, after due inquiry, that the qualified custodian sends quarterly statements (275.206(4)-2(a)(3)).
- A model or a backtest counts as hypothetical performance under 275.206(4)-1, which attaches conditions before anyone may show it.
- Records run five years, the first two in an appropriate office, so where the file sits belongs to the obligation.
Name the rule beside each line
The middle column is what separates this from a vendor questionnaire. Knowing which provision compels a line tells you what the answer has to look like to a reader outside the firm.
| Area | What compels it | What the file has to hold |
|---|---|---|
| Custody | 275.206(4)-2 | whether it hands the firm access, the qualified custodian, the date checked |
| Authority | section 206, across the agreed scope | the agreement, discretion and withdrawal rights as separate grants |
| Fees | 15 U.S.C. § 80b-6(1) and (2) | every layer, including anything the provider pays the firm |
| Conflicts | the same two paragraphs | the conflict, the disclosure text, proof the client received it |
| Reporting and valuation | 275.206(4)-7(a) | who produces each number, from what source, how it reconciles |
| Tax data | 275.204-2(a)(16), where it feeds a return figure | the export format, the earliest date covered, what it omits |
| Manager diligence | 275.206(4)-1 | whether the record is live or modeled, and the basis for each claim |
| Client fit | duty of care | the stated objectives, and the reasoning tying them to the arrangement |
One sentence the Commission wrote in 2019 stands behind the table:
“A reasonable belief that investment advice is in the best interest of a client also requires that an adviser conduct a reasonable investigation into the investment sufficient not to base its advice on materially inaccurate or incomplete information.”
SEC Release No. IA-5248, Commission Interpretation Regarding Standard of Conduct for Investment Advisers, 12 July 2019
Read the verb. Investigation is an act the firm performs, so buying a third-party report satisfies nothing on its own. The same release requires a reasonable understanding of the client’s objectives, which is why client fit sits in the table rather than in an onboarding folder. Hire out any of this and the reasoning still has to end up in your file.
Two checks the rules already wrote
Most of the checklist is yours to design. Two lines are drafted for you, and both get skipped because they read as background rather than as instructions. The first sits inside the custody rule, which obliges an adviser to have “a reasonable basis, after due inquiry, for believing that the qualified custodian sends an account statement, at least quarterly, to each of your clients for which it maintains funds or securities” (275.206(4)-2(a)(3)). Due inquiry is a diligence obligation written into the rule text, and almost nobody records performing it. Confirming delivery on a sample of real accounts, in writing, with a date, closes it. Whether a crypto arrangement reaches the rule at all is the prior question, settled in qualified custody for digital assets.
The second sits in the marketing rule and catches almost every crypto manager pitch. Hypothetical performance “means performance results that were not actually achieved by any portfolio of the investment adviser,” and it expressly covers model portfolios and strategies backtested against periods when they were not in use. Showing it requires policies reasonably designed to make the material relevant to its audience, plus enough on criteria, assumptions, and limitations. That bites when a model portfolio leaves the diligence file for anything a client sees, and again where a sub-advisory track record predates the strategy running live.
What the file has to prove
Two things, and firms usually get the first without the second: that a reasonable basis was formed, and that it can be produced to somebody who was not in the room. The second is a location rule as much as a retention rule:
“shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.”
Alongside it, 275.206(4)-7 requires written policies reasonably designed to prevent violations, an annual review of their adequacy and of the effectiveness of their implementation, and a named person administering them. The rule does not prescribe what that review looks like on paper, which is why the record lands under 204-2 and why an undocumented review reads at examination as an absent one. The marketing rule closes the loop: an advertisement may not carry a material statement of fact the adviser lacks a reasonable basis for believing it can substantiate on demand by the Commission. Substantiation on demand is the working definition of an adequate file, and a house method for documenting the recommendation makes it repeatable.
What an examiner opens in 2026
Crypto vanished from the SEC’s stated priorities this cycle. The Division of Examinations released its fiscal 2026 priorities on 17 November 2025, and across twenty pages the words crypto and digital asset appear nowhere. The exam module changed; the duty did not. The two adviser headings that survived are this article’s subject, fiduciary standards of conduct and effectiveness of compliance programs, and on the second the staff say what they sample:
“Areas on which examinations may focus include: (1) whether the policies and procedures are implemented and enforced; and (2) whether disclosures address fee-related conflicts, with a focus on conflicts that arise from account and product compensations structures.”
SEC Division of Examinations, Examination Priorities: Fiscal Year 2026
Implemented and enforced. A policy adopted and unfollowed is worse evidence than no policy, since it sets the standard the firm then missed. The same document names valuation and custody among the core compliance areas reviewed, which is where a crypto book of business concentrates its weaknesses.
What I actually see with RIA crypto due diligence
The memo records a conclusion and skips the basis. “Reviewed and approved” appears with no author, no date, no version of the document reviewed, nothing attached. It proves a meeting took place. Asked a year later what was actually looked at, the firm reconstructs from memory in front of an examiner.
The work is genuine and the file is unfindable. Careful analysis lives in a departed analyst’s mailbox, a personal drive, or a chat thread. The retention rule sets a place as well as a period, so a firm can fail on location having done everything right on substance.
The manual grew a digital-asset section the annual review never tested. Adoption is easy to see because it is a document. Implementation is what gets sampled, and the gap is widest where a firm moved fastest.
The check I would run. Pick one crypto recommendation from the last twelve months. Hand a colleague the file and thirty minutes, with no access to anyone involved, and ask for six answers in writing: when the diligence was performed, which version of the document was reviewed, who reviewed it, what was concluded, what the client was told, and where the client’s acknowledgment sits. Every line needing a conversation is a line the file does not evidence. Capable firms find three of the six.
Where RIA crypto due diligence goes wrong
Diligence fails at the seam between doing the work and being able to show it.
The specific failures: a provider questionnaire accepted as investigation, when the rule asks what the firm did; discretion and withdrawal authority granted in one signature and recorded as one thing, so nobody notices the arrangement created custody; a fee stack disclosed at the top layer while a payment from the provider goes unmentioned; a backtested sleeve pasted into a client deck without the marketing rule entering the conversation; basis data accepted without asking the earliest date it covers, so the gap surfaces years later in the client’s tax records; a held-away position treated as outside the file when the agreement says otherwise; and the version that ends badly, a conclusion recorded without its reasoning, leaving the firm arguing a judgment was reasonable with nothing contemporaneous to show.
The decision rule for RIA crypto due diligence
- Write the question first, because a file assembled without one collects documents and answers nothing.
- Settle custody status before anything else. Decide whether the arrangement gives the firm or a supervised person access, and record the reasoning either way.
- Split authority into its parts. Record trading discretion and the power to move assets as separate grants, quoting the agreement.
- Price the whole arrangement. Capture every layer, including what the provider pays the firm, and map each to the conflict it creates.
- Classify every performance record on receipt as live or modeled, and apply the marketing rule before it reaches a client-facing page.
- Date, attribute, and version every conclusion, so the basis survives the reviewer leaving.
- File it where the rule says, then test that a colleague can retrieve it unaided.
- Bind the refresh to the annual review, so provider re-review runs on a schedule the firm already keeps.
Where RIA crypto due diligence fits
Diligence is one part of a larger obligation set. The compliance checklist covers the program this work reports into, and the custody hub covers the mechanics on the asset side. Start with the custody determination, because every other line changes depending on the answer.
These questions cross professional boundaries, and the join is where they fail. Here the boundaries run outside the firm as well as inside it: the client’s attorney drafted the entity or trust holding the position, the client’s CPA carries the basis history, the custodian holds the keys, and the adviser is the only one of the four with a regulatory obligation to have understood all of it. None of them see each other’s files, and none are compelled to. The diligence file is the one place those views could meet, which makes reconciling them somebody’s named job or nobody’s at all.
Sources
- 15 U.S.C. § 80b-6, Prohibited transactions by investment advisers (Cornell Legal Information Institute)
- SEC Release No. IA-5248, Commission Interpretation Regarding Standard of Conduct for Investment Advisers (GovInfo, 84 FR 33669, 12 July 2019)
- 17 CFR 275.206(4)-7, Compliance procedures and practices
- 17 CFR 275.204-2, Books and records to be maintained by investment advisers
- 17 CFR 275.206(4)-1, Investment adviser marketing
- SEC, Withdrawal of Proposed Regulatory Actions (GovInfo, 90 FR 25531, 17 June 2025)
- SEC Division of Examinations, Examination Priorities: Fiscal Year 2026
Related
- Crypto compliance checklist for RIAs
- Qualified custody for RIAs managing digital assets
- How should RIAs document crypto recommendations?
- What is crypto sub-advisory?
- Digital asset custody
- Crypto for advisers and RIAs
Last updated: 3 August 2026.
This article is general education, not legal, tax, or investment advice. It describes obligations under the Investment Advisers Act in general terms, and diligence can reduce certain risks without eliminating them. Talk to qualified securities counsel and your chief compliance officer about your own firm’s situation.
