Rule 38a-1 service providers are the four kinds of firm through which a registered fund does its business: its investment advisers, its principal underwriter, its administrator and its transfer agent. The rule requires the fund's written compliance policies to provide for overseeing the compliance of each, the board, including a majority of independent directors, to approve each one's policies and procedures, the fund to review them at least once a year, and the chief compliance officer to report to the board in writing at least annually on how they operated. For the administrator, the firm that calculates the NAV and keeps the books, that means the fund answers for work it does not do. Botminds' Fund Administration Oversight exists for that gap: its agents grade each administrator every quarter on its own deliverables, read its SOC 1 report against the errors the fund actually saw, and draft what the CCO and the board need, so that a person signs each step and the evidence sits behind it.
This guide follows the chain link by link, using the rule's text and the SEC's 2003 adopting release. Where the solution appears, the firms and people are fictional sample data.
The administrator is in almost every registered fund's chain
4
kinds of service provider Rule 38a-1 names: adviser, principal underwriter, administrator, transfer agent
12,944
registered funds that reported an administrator on Form N-CEN for 2025
579
of them reported two or three administrators, each one a link to oversee
5yrs
that board materials and the CCO's written reports must be kept under the rule
What is Rule 38a-1, and is the administrator one of its service providers?
Rule 38a-1 is the compliance-program rule for registered investment companies and business development companies under the Investment Company Act, adopted by the SEC in December 2003 and in force since February 2004. Yes, the administrator is named in it, in each of four separate duties: the fund's policies, the board's approval, the fund's own review, at least once a year, of whether those procedures are adequate, and the CCO's report. The administrator cannot be left out of any of them (17 CFR 270.38a-1).
The adopting release defines the term by function, not by contract title. An administrator is "any person who provides significant administrative or business management services to an investment company", a definition the SEC took from its own rule 0-1 (68 FR 74714, note 26). A firm that calls itself a fund services provider, a fund accountant or a middle-office outsourcer is an administrator under the rule if what it does is significant administration: calculating the NAV, keeping the books, preparing the financial statements, running the fund's regulatory filings.
The release also explains why the SEC did not simply let funds lean on their providers. Some commenters wanted funds to rely on the service providers' own policies; the Commission refused, reasoning that funds conduct most of their activities through those providers and boards could not be allowed to step back from them. The result is a rule in which the fund borrows the administrator's hands but keeps the administrator's compliance as its own problem. Sub-advisers sit in the same chain as investment advisers, and the four Rule 38a-1 duties toward sub-advisers are worked through in a guide of their own; this page stays with the administrator.
The chain of accountability, from the administrator's desk to the board
The chain has five links, and only the first is outside the fund. The administrator runs its controls; someone at the fund looks at the evidence; the CCO forms a view; the board approves and hears the report. Every one of those handoffs is where oversight usually thins out, because the evidence arrives as a PDF and an SLA spreadsheet rather than as anything a director could test.
Fund Administration Oversight in the Rule 38a-1 chain: who does what, and who signs
A person decides
The administratorCalculates the NAV, keeps the books, sends NAV files, SLA reports, incident notices and its SOC 1 report.
Never: Is not the fund's compliance function, however much of the work it does
Agent
Intake, Evidence and Controls agentsTimestamp each deliverable against the contract, measure restrikes and breaks, read the SOC 1 and link its exceptions to the errors the fund saw.
Never: Never edit a source document or fill a missing value
A person decides
Oversight analystChecks what the agents measured and proposes the quarter's report card.
Never: Cannot approve their own proposal
A person decides
Fund COO and CCOCOO approves cards with a reason code and signature; COO and CCO co-sign the attestation of the fund's own complementary controls.
Never: No grade below B passes without a person
A person decides
BoardApproves the administrator's policies and procedures; receives the CCO's annual written report on how they operated.
Never: Approval rests on a finding, not on the provider's say-so
Read the chain from the bottom. The board's approval of the administrator's policies "must be based on a finding by the board that the policies and procedures are reasonably designed to prevent violation of the Federal Securities Laws" by the fund and by each named provider. A finding needs something to find on. In practice that is a summary prepared by the CCO, and the CCO's summary is only as good as what reached the CCO from the analysts who read the administrator's output.
Can the board rely on a SOC 1 report? The SEC's conditions for a third-party report
Partly, and on conditions the SEC wrote down in 2003. Where an unaffiliated administrator or transfer agent serves many funds, the release accepts that "it may be impractical for the fund or its compliance officer to directly review all of the service provider's policies and procedures", and lets the fund use a third-party report on them instead (68 FR 74714, section II.A.2). The report has three jobs: to describe the provider's program as it relates to the services the fund receives, to discuss the compliance risks material to the fund, and to assess the adequacy of the provider's controls.
Two footnotes carry the conditions that are most often forgotten. The report counts for the annual review and the CCO's annual report only "if such reviews and reports use such third-party reports provided to the fund no less than annually", and even then "the fund must also gather and take into account other relevant information, such as its experience with the service provider." The next footnote names the kind of report the SEC had in mind in 2003: Statement on Auditing Standards No. 70, "Reports on Processing of Transactions by Service Organizations", an auditor's report on a service organization's controls of the same family as the SOC 1 reports administrators send today.
The fund must also gather and take into account other relevant information, such as its experience with the service provider.
SEC, Rule 38a-1 adopting release, note 35 (2003)
That sentence is the whole case for administrator oversight in one line. A SOC 1 report is written, in the AICPA's words, to meet the needs of user entities and their auditors "in evaluating the effect of the controls at the service organization on the user entities' financial statements" (AICPA, SOC 1). It is about the administrator's controls over a period. The fund's experience is about something else: the NAVs that were restruck, the files that came late, the breaks that stayed open. The SEC asked for both, and the second is the part the fund has to produce itself. How to review a SOC 1 report covers the first; the rest of this page is about the second.
The relief also has an edge. It is written for a provider "that is not an affiliated person of the fund" serving "a large number of funds". An administrator inside the same group as the adviser is outside the case the release describes, so the fund's CCO should expect to review its policies directly rather than through a report.
What does the CCO report to the board about the administrator?
At least once a year, in writing, the CCO must report on how the policies and procedures of the fund and of each named provider, the administrator included, operated, on material changes since the last report, on changes recommended by the annual review, and on each material compliance matter since the last report (Rule 38a-1(a)(4)(iii)). The rule's definition of a material compliance matter reaches the administrator by name: a securities-law violation by it, a breach of its own policies, or a flaw in how those policies are designed or carried out, wherever the board would reasonably need to know.
That last limb is where a SOC 1 exception and an oversight program meet. An exception in the administrator's report is, on its face, a control that did not operate as described for part of the period. Whether it is a weakness the board needs to hear about depends on what it did to the fund's numbers, which only the fund's own records can say.
The release is blunt about why the report runs straight to the board. "We have observed that compliance failures have occurred when a fund service provider has denied information to the fund's board, or has been less than forthright, because the service provider viewed full disclosure as detrimental to its own interests." It also expected that a fund's CCO "will often be employed by the fund's investment adviser or administrator", which is why the board alone can remove the CCO and why the CCO must meet the independent directors separately at least once a year. A CCO on an administrator's payroll who reports on that administrator is the case the reporting line was built for.
Rule 38a-1 procedures for the administrator: what the written policy should say
The rule asks for policies that oversee each provider's compliance, not for a particular method, so the fund's own procedures have to say what oversight means in practice. A policy that names the administrator and says "the CCO will monitor" gives the board nothing to approve and the CCO nothing to report. The checklist below is what a procedure needs to say for each administrator, drawn from the rule's duties and the release's conditions.
Rule 38a-1 procedures for one administrator: eight things the policy must decide
- Which services the administrator performs, fund by fund
The third-party report must describe the program "as it relates to the types of services provided to the fund". Without the list, nobody can check coverage.
- Which third-party report is relied on, and its period
Received no less than annually; the policy should say what happens when it is late or its period leaves a gap.
- What "experience with the service provider" is measured
Timeliness against the contract, NAV errors and restrikes, breaks over tolerance, incidents, query turnaround, staffing changes. Measured from the fund's records, not the provider's.
- Which controls the fund itself must run
The report assumes the fund performs certain complementary controls. Each needs an owner and evidence on the fund's side.
- What counts as a material compliance matter at the administrator
A threshold for NAV errors and a rule for SOC 1 exceptions tied to errors the fund saw, so escalation is not a matter of mood.
- How fast the administrator must tell the fund, and the fund tell the board
Serious compliance issues cannot wait for the annual report; the contract and the procedure should agree on the path and the clock.
- Who proposes, who approves, who signs
Separate the person who measures from the person who approves, and keep both names on the record.
- What is kept, and for how long
Board materials, the CCO's reports and the annual review records: five years, the first two in an easily accessible place.
Who does what: a RACI for administrator oversight under Rule 38a-1
A RACI makes the policy testable: for each task, one person does it, one answers for it, and the file shows both. The version below is one way to divide the work in a fund complex with an outside administrator. The duties come from the rule; the allocation is a suggestion a fund will adjust to its own organisation.
Administrator oversight under Rule 38a-1: one responsible, one accountable for each task
| Task | Responsible | Accountable | Consulted · informed |
|---|---|---|---|
| Collect and timestamp the administrator's deliverables | Oversight analyst (agents do the collecting) | Fund COO | Administrator · fund accounting |
| Measure NAV errors, restrikes and breaks | Oversight analyst | Fund COO | Fund accounting · valuation committee |
| Read the SOC 1 report and bridge letter | Oversight analyst | CCO | Fund auditor · administrator |
| Run and evidence the fund's complementary controls | Control owners in each team | Fund COO and CCO, co-signed | Internal audit |
| Grade the administrator each quarter | Oversight analyst proposes | Fund COO approves | Vendor oversight committee |
| Decide whether a matter is material | CCO | CCO | Fund counsel · board chair |
| Approve the administrator's policies and procedures | CCO prepares the summary | Board, majority independent | Fund counsel |
| Write the annual report on the administrator | CCO | CCO | Board receives it |
Two rows matter more than the rest. The quarterly grade is where experience becomes evidence, and the complementary controls are where the fund can fail its own administrator: a SOC 1 opinion assumes the fund did its part. Complementary user entity controls, with examples, sets out what that part usually is.
Rule 38a-1 is the administrator rule now: the outsourcing proposal was withdrawn
For registered funds, nothing has replaced Rule 38a-1 as the basis for overseeing an administrator. In November 2022 the SEC proposed a rule on outsourcing by investment advisers that would have set conditions before outsourcing certain functions. On June 17, 2025 it withdrew that proposal along with others, saying it would not finalise them and that any future action in those areas would start with a new proposal (90 FR 25531).
Oversight of the administrator therefore still rests on Rule 38a-1 for registered funds and business development companies, and on the adviser's fiduciary duty and its own compliance program for private funds, which Rule 38a-1 does not cover. Examiners keep looking. In its information-security section, the Division of Examinations' priorities for fiscal 2027 say it will "assess risks associated with registrants' increased use of third-party service providers and shared technologies, including the effectiveness of risk management in these areas" (SEC, Examination Priorities FY2027).
What the record has to show when an examiner asks
The rule's recordkeeping paragraph tells you what will be asked for: the policies in effect, the materials given to the board for its approval, the CCO's written reports, and the records documenting the annual review, kept for at least five years. An examiner who wants to know how the board found the administrator's procedures reasonably designed will start with those materials and work back to the evidence beneath them.
That is where most oversight files are weakest. The board papers show a scorecard; the scorecard was rebuilt from the administrator's own SLA report; nobody can show which deliverable arrived when, or which SOC 1 exception was considered against which restrike. Fund Administration Oversight keeps each step on an audit trail with who, what, when, why and the evidence, and exports it with a signed index of file hashes.
Fund Administration Oversight's audit trail: every step by people and agents, with its evidence
Where Fund Administration Oversight fits in the chain
The solution sits in the middle three links: the evidence, the analyst and the COO and CCO. Take the sample firm as it runs through it, Quillfield Capital, with 180 funds and six administrators. In the third quarter of 2026 its agents logged 1,488 deliverables from one administrator, Pellmont, against the contract's 6:30 p.m. cut-off and measured 96.2% on time where Pellmont's own SLA report said 99.1%. They found seven NAV restrikes, linked four of them to an exception on page 88 of Pellmont's SOC 1 report, and proposed a C. The analyst proposed the card; the COO approved it with a reason code and her signature.
The COO's morning: what the Rule 38a-1 chain still needs from people
What it does not do matters as much for Rule 38a-1. It does not approve the administrator's procedures, decide what is material or write the CCO's conclusions; it drafts the board's annual service-provider review from approved cards for the CCO to edit and sign. When a fund is moving its books to a new administrator, the same chain has to be live on the first NAV, which is the subject of the 90-day plan for outsourcing fund accounting.
Questions people ask
Is the Rule 38a-1 adopting release still the main guidance?
Yes. The rule text has not been rewritten since it was adopted in 2003 (68 FR 74714, effective February 5, 2004), and the release remains where the SEC explains the third-party report, the board's finding and the CCO's role. The 2022 outsourcing proposal that would have added adviser-level conditions was withdrawn on June 17, 2025.
Does Rule 38a-1 apply to private funds?
No. It applies to registered investment companies and business development companies. A private fund's administrator is overseen through the adviser's own compliance program and fiduciary duty, and the same evidence, deliverables, errors and the SOC 1 report, is what an examiner or an investor will ask to see.
Is a custodian a Rule 38a-1 service provider?
Not in the rule's defined list, which is limited to advisers, principal underwriters, administrators and transfer agents. The release says the narrower term does not reduce a fund's obligation to consider compliance when it hires others, naming pricing services, auditors and custodians.
How often must the fund receive the administrator's third-party report?
No less than annually, if the report is to stand in for direct review in the annual review and the CCO's annual report. The fund must also weigh other relevant information, such as its own experience with the administrator, so a current report alone does not complete the review.
Does the board have to approve every change to the administrator's procedures?
No. The rule requires approval of the policies and procedures and an annual written report from the CCO, which must cover material changes since the last report. Serious compliance issues at the administrator are a different matter and should reach the board promptly, not wait for the annual cycle.
What happens if the administrator is affiliated with the adviser?
The release's third-party report route is described for providers that are not affiliated persons of the fund and serve many funds. With an affiliated administrator, expect the CCO to review its policies and procedures directly, and expect the board to look harder at conflicts, since the CCO may be employed by the same group.