Investment compliance monitoring requirements: SEC, UCITS, CSSF, AMF

Investment compliance monitoring requirements come from four places for a manager running US and European money: the SEC's compliance rules, which require policies and procedures reasonably designed to prevent violations and reviewed at least once a year; the UCITS Directive, which makes curing a breach caused by events beyond the fund's control a priority of its sales; Luxembourg's Circular CSSF 24/856, which requires every breach to be classified as active or passive, corrected, priced and, if active, notified; and France's AMF, which collects active breaches every quarter and inspects how managers configure and run their control tools. None of them prescribes software. All of them expect the manager to show, breach by breach, what was found, when, why it happened and what was done. Botminds' Investment Guideline Monitoring works the post-trade alert queue with agents and keeps that showing in one place: every close and breach carries its clause, its evidence and a named approver.

Rule texts are quoted from the regulators. The screens use the solution's sample data on a fictional manager and its fictional clients.

Read across a row and the pattern is plain. The US sets a standard of reasonableness and leaves the mechanics to the firm and its examiners. Europe sets mechanics: a classification, a clock, a correction method and a notification. A process built to the European mechanics will usually satisfy the US standard; the reverse is not true.

What does Rule 206(4)-7 require?

Rule 206(4)-7 requires a registered adviser to adopt and implement written policies and procedures designed to prevent violations of the Advisers Act by the firm and its supervised persons, to review them at least annually for adequacy and for the effectiveness of their implementation, and to designate a chief compliance officer (17 CFR 275.206(4)-7). It does not mention investment guidelines. The SEC's 2003 adopting release does: among the issues it expects advisers' procedures to address, at a minimum and where relevant, is portfolio management, including whether portfolios are consistent with clients' investment objectives, the adviser's disclosures and applicable regulatory restrictions (68 FR 74714, December 24, 2003).

The annual review is where the requirement bites. The same release says the review should consider any compliance matters that arose in the year, changes in the business and changes in the rules. In September 2026 the SEC's examination staff reported annual reviews that were not timely, procedures for the review that did not say how to test, reviews run against superseded versions of the policies, and corrective actions that were recommended and never taken (SEC Division of Examinations risk alert, 14 September 2026). A year of guideline breaches, sorted by cause, is the most direct evidence a review can use.

What is a material compliance matter for a fund board?

For a registered fund, a material compliance matter is any compliance matter the fund's board would reasonably need to know about to oversee fund compliance, including a violation of the policies and procedures of the fund or its adviser and a weakness in their design or implementation (17 CFR 270.38a-1(e)(2)). The fund's chief compliance officer must report each one to the board in writing at least annually. The SEC chose the definition deliberately: its proposal would have limited the report to matters that led to remedial action, and the final rule dropped that limit, the release explains, because a fund might otherwise "fail to impose remedial actions in order to avoid having to report a compliance failure to the board".

A breach of a fund's investment restriction is therefore a candidate for the report whether or not it cost the fund money, and a run of small breaches with one cause can amount to a weakness in implementation even when no single one is material. Rule 38a-1's wider reach, including the oversight of sub-advisers, is covered in the guide to Rule 38a-1 and sub-adviser oversight; for monitoring, the point is that the board report is only as good as the breach history behind it.

Fund compliance monitoring requirements under UCITS

The UCITS Directive sets the limits and the duty to cure, and leaves the monitoring machinery to national regulators. Its diversification rules, from the 5% issuer limit to the 40% aggregate, apply throughout the life of the fund; a breach the fund did not cause, by market moves or the exercise of subscription rights, must be put right through its sales first, with unit-holders' interests in mind (Article 57(2)). How the 5/10/40 rule is computed, and how it differs from the 1940 Act's diversification test, is worked in the guide to UCITS investment restrictions.

The Directive does not say how often to test, how to classify a breach, how to measure the loss or whom to tell. Those answers come from the home regulator, which is why a manager with funds in Luxembourg and France follows two sets of rules for the same limit, and why the AMF's inspectors, looking at French managers with Luxembourg funds, compared their compensation policies for the two.

Luxembourg: the most detailed investment guidelines monitoring requirements

Circular CSSF 24/856 turns monitoring into a sequence with a rule at every step. All investment rules count, including the restrictions in the fund's own constitutive documents and prospectus (point 50). They apply at every NAV and between NAVs (point 60). Controls must be proportionate, include pre-trade and post-trade checks, and be written into the fund's policies, frequency included (points 57 to 59). Every breach is classified as active or passive on discovery (point 54). An active breach is reported to the manager, administrator and depositary, corrected without delay and priced; a passive one is corrected within a reasonable period and monitored by the fund's directors.

One requirement is easy to miss because it applies before any breach occurs. The internal policy governing breaches, with its operational procedures, "must be in place as of the incorporation/launch of the UCI" and must "clearly and precisely define the impact determination methods" for active breaches, so that the method cannot be chosen after the fact to suit the compensation figure (point 72). The fund's auditor then reviews the year's errors and breaches under Chapter 8. Luxembourg's rules for NAV errors, which share the circular, are covered in the guide to NAV error materiality thresholds.

UCITS breach reporting and notification in France

French managers report active breaches to the AMF every quarter and describe their control system every year. Under Article 321-75-1 of the AMF General Regulation, a manager must send the AMF, "at the latest one calendar month after the end of each quarter of the calendar year", information on breaches of the investment rules of the UCITS it manages, including by delegation, other than breaches beyond its control. The annual FRA-RAC report adds the number of breaches in the year, the control system and any material anomalies, and an incident that could lead to a loss or gain for the manager of more than 5% of its regulatory capital must be reported immediately (AMF summary, §4.4.3).

The AMF also writes the monitoring duty into the manager's general obligations. Article 321-101(8) requires a UCITS manager to "establish written policies and procedures on due diligence and implement effective arrangements for ensuring that investment decisions on behalf of the UCITS are carried out in compliance with the objectives, investment strategy and risk limits of these UCITS". In its inspection the AMF checked those arrangements in detail, down to who may change a configured ratio and whether changes are reviewed, and it found anomalies in the reports themselves: at one manager the quarterly reports understated active breaches by seven in two quarters, and at another the annual report counted 15 where the four quarterly reports counted 19.

What examiners test, and the cases that show why

Examiners test whether the firm did what its documents said. The SEC's fiscal 2027 priorities say examinations of registered funds will focus on fees and on portfolio management practices, checking those practices against the funds' stated strategies, filings and marketing, and that adviser examinations will usually look at the annual compliance review (SEC, October 23, 2026). The same document notes that firms now apply what the SEC calls "super intelligence (SI)" to compliance monitoring, and makes clear that the duties being examined are unchanged by it.

Two enforcement cases show how a guideline becomes a compliance-rule violation. In December 2019 the SEC settled with Kornitzer Capital Management, whose collective investment trusts had a single issuer making up between 30% and 89% of their assets; the trusts' board had directed a reduction to no more than 10%, the adviser had said it would get there in 12 to 18 months, and the order found violations including Rule 206(4)-7, with a $2.7 million joint and several penalty (SEC, IA-5416). In March 2025 the SEC alleged that an adviser kept more than 25% of a fund in a single company for years after settling earlier charges over the same policy, causing about $1.6 million in losses (SEC press release 2025-55; allegations, amended complaint April 2025).

One process for four rulebooks: meet the strictest of each

A cross-border manager rarely runs four monitoring processes; it runs one, set at the strictest requirement on each point. The list below is that composite, taken from the rules and from the practices the AMF called good.

The clocks the agents work inside, approved by the compliance officer

Where Investment Guideline Monitoring fits the requirements

None of the four rulebooks asks for a particular system, and none forbids agents. What they ask for is evidence. Investment Guideline Monitoring produces it as a by-product of the morning: each alert is recomputed from the custodian position and the clause, each input checked against a second source, each close and classification approved by a named person with a reason code, and each breach carried through cure and notice in one register. The examiner export collects a day, a month or a year of it with every agent version and approval.

A year of monitoring, exported for the examiner

What the solution does not do is decide which rules apply to a fund, write the coded rules or block orders. Those belong to the people who read the prospectus and the agreements, to coding the prospectus restrictions, and to the pre-trade check. How the breach notices themselves are routed is set out in the guide to investment breach notification requirements.

Questions people ask

Is there an SEC rule that requires post-trade compliance monitoring?

Not by name. Rule 206(4)-7 requires policies and procedures reasonably designed to prevent violations and an annual review of their effectiveness, and the SEC's 2003 release expects advisers' procedures to cover whether portfolios are consistent with clients' objectives, disclosures and regulatory restrictions. A post-trade check is how most firms show that.

Do UCITS have to report investment breaches to the regulator?

It depends on the home regulator. In Luxembourg active breaches are notified to the CSSF on its form and passive ones are not; in France managers report active breaches to the AMF every quarter, within one calendar month of the quarter's end.

Does Circular CSSF 24/856 apply only to UCITS?

No. Its active and passive classification applies to all the Luxembourg undertakings for collective investment in its scope, UCITS and others, with some differences: funds other than UCITS that invest in less liquid assets may take longer to implement a correction decided without delay, and in justified cases keep a position after a passive breach.

How often must a compliance program be reviewed?

At least once a year under Rule 206(4)-7 for advisers and Rule 38a-1 for funds. The SEC's 2026 risk alert lists what goes wrong: reviews that are late, untested, run against outdated policies or never followed by the corrective actions they recommended.

Are client investment guidelines regulatory requirements?

They are contractual, but breaking them can become a regulatory matter. Luxembourg counts the restrictions in a fund's own prospectus as investment rules, and in the US an adviser that does not keep portfolios within the limits it has been set can be charged under the compliance rule, as in the Kornitzer order of 2019, where the trusts' board had set a 10% target.