A quarterly compliance certificate, also called a quarterly compliance certification or attestation, is the signed statement a sub-adviser's chief compliance officer sends the fund after each quarter, confirming that the sleeve was managed in line with the sub-advisory agreement and its investment guidelines, that no breaches occurred or listing those that did, and reporting changes in policies, people and regulatory matters. The SEC's 2003 adopting release for Rule 38a-1 named the tool: a fund's contracts "might also require service providers to certify periodically that they are in compliance with applicable federal securities laws" (68 FR 74714). The hard part is not getting a certificate; it is knowing what it is worth. Botminds' Investment Manager Oversight chases every certificate on a clock with drafted reminders a person approves, asks rather than assumes when a document is missing, unreadable or ambiguous, and re-tests every "no breaches" against the fund's own holdings.
One certificate's path through Investment Manager Oversight: request, remind, read, re-test, decide
Agent
Chaser agentSends the quarter’s requests from the oversight mailbox on day one, from templates the CCO approved. In the sample, 23 went out on October 1, due October 14.
Never: sends a new or edited message without a person’s approval, or changes a due date
Agent
Chaser agentDrafts reminders on day +1 and day +3 after the due date and an escalation on day +5, each citing the agreement’s clause.
A person decides
Relationship managerApproves every escalation before it goes, and its tone.
Agent
Reader agentReads the certificate and the guideline reports in their original language and quotes each statement with its page.
Never: takes a figure from the translation; below 90% confidence a person reads first
Agent
Cross-check and Verifier agentsRe-run every coded guideline on the fund’s holdings for every business day, with the agreement’s definitions; a second model re-derives any difference from raw custodian positions.
Never: close an exception or contact the sub-adviser
A person decides
Oversight analystDecides what each difference means, asks the sub-adviser to explain, and proposes a closure with a reason code.
A person decides
Head of sub-adviser oversightChecks the same evidence and closes, or returns it with a reason. No one checks their own work.
What is a quarterly compliance certificate from a sub-adviser?
It is a short document in which the sub-adviser's CCO or another officer certifies a set of statements about the last quarter. The sub-advisory agreement normally requires it and fixes its due date; in the sample the certificate is due on the fourteenth day after quarter end under a clause of the agreement. It is typically paired with monthly guideline reports, which carry the numbers the certificate summarises.
The certificate exists because Rule 38a-1 makes the fund oversee compliance "by each investment adviser" and makes its CCO report to the board on how each adviser's policies operated (17 CFR 270.38a-1). It is the cheapest way to hear from every sub-adviser every quarter. The adopting release lists periodic certification as one oversight tool among several, alongside regular and special reports, third-party audits and the CCO's own statistical testing of each provider (the full toolkit, in the release's words). Used alone, it is the weakest of them.
What does a sub-adviser certify each quarter?
The best certificates ask specific questions with specific answers, and attach evidence where it exists. Vague certifications invite vague answers. The checklist below is what a fund can ask for; the agreement should make each item a duty, with a date.
What a quarterly compliance certification should ask a sub-adviser
- Guideline compliance, item by item
That the sleeve complied with each guideline in the schedule during the quarter, or a list of each breach with dates, cause, cure and any loss.
- The definitions used
Which classification, rating and pricing sources the sub-adviser’s compliance system applied, so the fund can see whether they are the agreement’s.
- Prospectus and regulatory limits
Compliance with the fund’s stated policies and the 1940 Act limits that apply to the sleeve.
- Code of ethics and personal trading
Violations by access persons and how they were handled.
- Changes to policies and procedures
Each material change, with the new text, so the fund’s CCO can report it.
- Key personnel and ownership
Departures, arrivals and changes of control, which can end the contract on assignment.
- Regulatory matters
Examinations, deficiency letters, inquiries and actions, and any Form ADV amendment.
- Trade errors and their correction
Each error affecting the sleeve, how it was corrected and whether the fund was made whole.
The second item is the one most certificates leave out, and the next section shows why it matters. A certificate that confirms compliance without saying what it measured compliance against cannot be checked; one that names its sources can be checked in minutes.
Can a "no breaches" certificate be trusted?
It can be trusted to report what the sub-adviser's own compliance system saw, with the sub-adviser's own definitions. Whether those match the agreement is a separate question, and the certificate does not answer it. The solution's sample shows the gap. Marrow Bay, a fictional sub-adviser, sent this:
"…the Portfolio was managed in compliance with the Investment Guidelines in Schedule B, and no breaches occurred."
Quarterly certification of a fictional sub-adviser, item 3 (sample data in Investment Manager Oversight)
The agreement capped the sleeve's emerging markets weight at 25% and defined an emerging market country as any country in the MSCI Emerging Markets Index. After a system migration on August 3, the sub-adviser's compliance software had switched to another index provider's country codes, under which, in the sample, South Korea did not count as an emerging market. On August 14 the two measures gave two answers for the same sleeve on the same day.
Same sleeve, same day, two answers: the certificate's measure against the agreement's
Nobody lied. The certificate was true by the definitions in the sub-adviser's system and false by the definitions in the contract, and the fund answers to the contract. That is why a certificate's "no breaches" should be treated as a claim to test, and why the agreement's definitions, not the certificate's, must drive the test. The same logic applied to the annual questionnaire builds the rest of the sub-adviser's file.
What happens if a sub-adviser's compliance certificate is late?
A late certificate should produce a reminder on a fixed clock, an escalation if the clock runs out, and an "outstanding" line in the CCO's report, never a silent assumption that nothing happened. A sub-adviser whose quarter went badly has the most reason to be slow, so the one wrong response is to carry last quarter's clean certificate forward.
A second reminder in Investment Manager Oversight, drafted from an approved template and waiting for a person
In the sample, two items were late: one certification four days late and one annual questionnaire. The first reminder goes the day after the due date and the second on day three; on day five the Chaser drafts an escalation, which the relationship manager must approve. A late document is classed as an outstanding item, which the CCO's report lists by name, so the board sees which sub-advisers had not reported by the time the book closed.
Agents that ask instead of assuming
An agent that handles certificates is only safe if its rule for a gap is to ask, not to fill. The cases where a well-built agent stops are the same cases where a tired analyst is tempted to guess: a file that cannot be opened, a figure that cannot be read with confidence, two readings that disagree, a document that has not arrived.
Four moments when Investment Manager Oversight's agents stop and ask
The file cannot be read
The agentAsks the sub-adviser for a clean copy, from an approved template
NeverGuessing from a scan, or marking the item received
Who decidesThe analyst approves the request
The reading is uncertain
The agentStops below its confidence threshold (90% by default) and puts the page in front of a person
NeverFilling the value with its best estimate
Who decidesThe analyst reads first
Two readings disagree
The agentSends the disagreement to a person with both readings and the page
NeverPicking the more convenient one, or the first
Who decidesThe analyst decides
The certificate is late
The agentDrafts the next reminder on the agreed clock and lists the item as outstanding
NeverCarrying last quarter’s answer forward, or moving the due date
Who decidesThe analyst sends; the relationship manager approves escalations
In the sample quarter, one sub-adviser's three guideline reports arrived password-protected; the Chaser drafted a request for clean copies rather than marking the reports received. One reading of a Japanese report scored 98% to 99% per value and went through; anything under 90% would have gone to a person first. The Verifier, a second model with its own prompts, re-derived the Marrow Bay breach from raw custodian positions before anyone wrote to the sub-adviser, so the request for explanation rested on two independent readings.
A Japanese guideline report read beside the English in Investment Manager Oversight, each value cited
How are compliance certificates re-tested?
A certificate is re-tested by running the agreement's guidelines on the fund's own record of the sleeve. In the sample, the Reader coded 412 guidelines from 23 agreements, each with its clause and page and each approved by a person; the Cross-check re-runs them every night on holdings from portfolio accounting, reconciled to the custodian, for every business day of the quarter. Two settings keep it honest: a tolerance of 0.05 percentage points before a gap counts as a difference, and a classification source set per agreement to the index provider that agreement names.
Re-testing turns the certificate from the evidence into one of two pieces of evidence. Where they agree, the analyst signs off in bulk; three sample quarters were "read and clean" and queued to be signed off together, with the head of oversight counter-signing. Where they disagree, the fund has something specific to ask: not "were there breaches?" but "your August report counted 21.9%; under Schedule B we count 27.1%; please explain."
Who reviews sub-adviser compliance certificates?
The oversight analyst reviews them, a second person checks the analyst's conclusions, and the fund's CCO reports the results to the board. The two-person rule matters most at closure: in the sample, the analyst proposed closing the Marrow Bay exception as "Breach confirmed: cured, no loss; disclosed to the board," and the head of sub-adviser oversight opened the same evidence, the certificate, the holdings for August 13, 14 and 17, the reply and the trade profit and loss, before closing it.
The board is the last reader. Rule 38a-1 requires the CCO's written report at least yearly to address each material compliance matter since the last report (Rule 38a-1(a)(4)(iii)(B)), and the 2019 SEC risk alert found funds whose annual reviews "did not address the adequacy of the funds' policies and procedures and the effectiveness of their implementation" (OCIE, November 7, 2019). A file of certificates with no test behind them describes the policies; it says nothing about their effectiveness.
Is an attestation the same as a compliance review?
No, and the SEC's examiners said so in September 2026. Writing about advisers' annual reviews under Rule 206(4)-7, the staff listed as a deficiency advisers that, "Instead of performing any annual review, stated that providing personnel with compliance training or obtaining annual attestations of personnel's adherence to the advisers' compliance policies and procedures satisfied the annual review requirement" (risk alert, September 14, 2026). The alert concerns advisers' own programs, not funds' oversight of sub-advisers, but the principle transfers directly: an attestation is an input to a review, not the review.
The SEC's fiscal 2027 examination priorities add a newer question for anyone automating this work. The Division notes that registrants are using "generative SI tools" (its term for super intelligence) for, among other things, "compliance monitoring and surveillance," and says it is examining whether firms still meet their existing obligations, which it describes as technology neutral (SEC Division of Examinations, FY2027 priorities, October 2026). An agent that asks, cites its page and leaves the decision to a named person is easier to defend under that question than one that fills gaps.
That is how Investment Manager Oversight treats a certificate: chased on a clock a person controls, read in its own language with every statement cited, re-tested on the fund's holdings, and closed by two people. The oversight analyst's quarter shows where it falls in the calendar.
Questions people ask
Is a quarterly compliance attestation different from a certification?
In sub-adviser oversight the words are used interchangeably for the signed quarterly statement. Some funds use "attestation" for a lighter form signed by an officer and "certification" for one signed by the CCO with schedules attached; the agreement should say which is required and who signs.
Who should sign a sub-adviser's compliance certificate?
Usually the sub-adviser's chief compliance officer, who is accountable for its compliance program under Rule 206(4)-7. In the solution's sample, the certificates are signed by each sub-adviser's CCO and the fund's requests are addressed to that person, with the relationship manager copied.
What if the certificate reports a breach?
Then the fund verifies it and its cure rather than its absence. In the sample, Calder Moss reported a breach of its 15% limit on bonds rated CCC and below after two downgrades; the fund's own test confirmed a 15.38% peak, the breach was passive and cured within 14 days, and it went to the CCO's report as an other matter under the fund's policy.
Should a missing certificate stop the board report?
No. The report should go on time and list the missing certificate as outstanding, with the dates of requests and reminders. The SEC's adopting release is clear that serious compliance issues go to the board promptly, not held for a later report.
How long should certificates be kept?
As part of the records documenting the fund's annual review, Rule 38a-1(d) keeps them at least five years after the end of the fiscal year of the review, the first two easily accessible. The solution's sample keeps six years, with the fund's records in their home region.