Rule 38a-1 compliance program: the four duties toward sub-advisers

A Rule 38a-1 compliance program is the set of written policies and procedures every registered investment company and business development company must adopt under 17 CFR 270.38a-1 to prevent violations of the federal securities laws, and its reach goes beyond the fund's own staff. The program must "provide for the oversight of compliance by each investment adviser, principal underwriter, administrator, and transfer agent," so a fund with sub-advisers must oversee each of them; the board must approve their policies; the fund must review them at least yearly; and a chief compliance officer must report on them in writing to the board. Most of a fund's investing is done by firms it does not employ, which is why this rule, not a rule about sub-advisers, carries the weight of sub-adviser oversight. Botminds' Investment Manager Oversight helps the CCO's team carry it: agents collect, read and re-test each sub-adviser's quarter and draft the CCO's section, and people decide and sign.

Every quotation below is from the rule, its 2003 adopting release or the SEC's examination staff, linked where it appears. Screens show the solution on sample data about fictional firms.

What is Rule 38a-1?

Rule 38a-1 is the fund compliance rule the SEC adopted in December 2003, effective February 5, 2004, alongside Rule 206(4)-7 for investment advisers. The adopting release summarises both: funds and advisers must "adopt and implement written policies and procedures reasonably designed to prevent violation of the federal securities laws, review those policies and procedures annually for their adequacy and the effectiveness of their implementation, and designate a chief compliance officer," and in a fund "the chief compliance officer will report directly to the fund board" (68 FR 74714).

The SEC wrote it after a season of market-timing and late-trading cases at fund advisers and intermediaries, and it shows. The rule is less about any one obligation than about who stands behind the whole: the fund, its board and a CCO the adviser cannot fire alone. Rule 206(4)-7 governs the adviser's own program, including a sub-adviser's (17 CFR 275.206(4)-7); Rule 38a-1 makes the fund check that each of those programs works for the fund.

The four duties toward each sub-adviser, and what examiners found against each

The rule names four things a fund must do about each investment adviser, and SEC exam staff have published findings against every one. The sub-adviser is an "investment adviser" of the fund under the Act, so each duty applies to it as fully as to the fund's principal adviser.

The findings share a pattern. Not one is about a rule nobody knew. Each is about a step that was easy to skip because nothing broke when it was skipped: a sub-adviser's policies that were never put to the board, a review that read the sub-adviser's manual but not what the sub-adviser actually did, a CCO report that described the fund's own procedures and said nothing about the adviser's. The 2021 alert, covering more than 50 fund complexes and more than 200 funds, also listed weak monitoring of each fund's own investment restrictions among the compliance-program gaps (risk alert, October 26, 2021), which is the duty sub-advisers' guideline reports exist to evidence.

Rule 38a-1 service providers: who counts, and who does not

In Rule 38a-1, "service providers" means exactly four kinds of firm: the fund's investment advisers, principal underwriters, administrators and transfer agents. The adopting release says so in a footnote: "we use the term 'service provider' to refer only to a fund's advisers, principal underwriters, administrators, and transfer agents," adding that this does not lessen "a fund's obligation to consider compliance as part of its decision to employ other entities, such as pricing services, auditors, and custodians" (68 FR 74714, note 28). The 2024 risk alert repeats the boundary and names fund valuation firms as outside it (note 6).

Sub-advisers sit inside the four. The adopting release even names them as the example of a provider whose policies a fund complex approves rather than writes: a complex could adopt policies covering its own funds, adviser and affiliates "while approving the policies and procedures of other service providers, such as subadvisers, over which it has oversight responsibility under the rule." If a fund folds a provider's procedures into its own, "separate approval by the board is not required"; if it approves the provider's own policies, it "is required to make findings only with respect to activities of the service provider that could affect the fund."

How the adopting release expects a CCO to oversee a sub-adviser

The release is unusually concrete about method. The CCO should take "steps to assure herself that each service provider has implemented effective compliance policies and procedures administered by competent personnel," be "familiar with each service provider's operations," and keep "an active working relationship with each service provider's compliance personnel" (68 FR 74714). It then lists the tools, which have become the shape of a sub-adviser oversight program.

Read in order, the list moves from trusting the sub-adviser to testing it. Access and reports are the sub-adviser speaking; certifications are the sub-adviser signing; audits and the fund's own analysis are the fund checking. A program that stops at certifications has used half the toolkit. What a quarterly compliance certificate proves, and how to re-test one takes the certification step apart.

Does the board have to approve changes to sub-adviser policies?

No, not under the rule itself. The board approves each adviser's policies under Rule 38a-1(a)(2), but the adopting release is explicit about later changes: "Rule 38a-1 does not require fund boards to approve amendments to policies and procedures of the fund or its service providers," because that "would, as commenters pointed out, inundate fund boards with review of minor changes." Instead, the CCO must "discuss material changes to the compliance policies and procedures in his or her annual report to the fund board" (68 FR 74714, note 33).

Many boards still choose to approve material changes, and a fund's own procedures may require it; the point is to know which obligation is the rule's and which is the fund's. What the rule requires is that the CCO's report covers "any material changes made to those policies and procedures since the date of the last report," for the fund and for each adviser (Rule 38a-1(a)(4)(iii)(A)). That makes noticing a sub-adviser's policy change an oversight duty in its own right: a change the CCO never learned of cannot be reported.

What is a material compliance matter?

A material compliance matter is any compliance matter the board "would reasonably need to know to oversee fund compliance," and it includes, "without limitation," a violation of the federal securities laws by the fund or its adviser, a violation of the fund's or adviser's own policies, or "a weakness in the design or implementation" of those policies (Rule 38a-1(e)(2)). The CCO's report must address "each Material Compliance Matter that occurred since the date of the last report."

"Serious compliance issues must, of course, always be brought to the board's attention promptly, and cannot be delayed until an annual report."

SEC, Rule 38a-1 adopting release, 68 FR 74714, note 84 (December 2003)

The same note adds a test that sub-adviser oversight runs into constantly: "individual compliance matters that, taken in isolation, may not be material may collectively suggest a material compliance matter, such as a material weakness in the compliance programs of the fund or its service providers." Three late certificates from one sub-adviser are three late documents; three late certificates and a breach found by the fund's own test are a pattern a board would want to hear about. Funds write their own materiality policy for this reason. In the solution's sample, a breach the sub-adviser did not report is material, an active breach is material, a passive breach cured within 30 days is reported as an other matter, and every threshold is a setting changed only by an approved proposal.

What counts as material, written down as settings in Investment Manager Oversight

Chief compliance officer annual report: what it must cover on sub-advisers

The CCO's annual report must, "at a minimum," address the operation of the policies and procedures of the fund and each investment adviser, material changes to them since the last report, material changes recommended by the annual review, and each material compliance matter since the last report; the CCO must also meet separately with the independent directors at least once a year (Rule 38a-1(a)(4)(iii)–(iv)). The board's review of it, the adopting release says, "should focus on ensuring that the compliance programs of the fund and its service providers are reasonably designed and functioning effectively."

Examiners keep finding the report short of that. Besides the 2021 finding that reports did not address the adviser's procedures, the 2024 alert found that "CCOs did not provide requisite written annual compliance reports to fund boards," including funds with no appointed CCO, and funds that "omitted material information from – or did not document – their annual compliance reports" (risk alert, November 4, 2024). Many fund groups report on sub-advisers every quarter as well; the rule's minimum is once a year, and quarterly sections make the annual report a summary rather than an excavation.

How long must Rule 38a-1 records be kept?

Five years, with the first two in an easily accessible place, for the three kinds of record the rule names. The adopting release adds that these reports "are meant to be made available to the Commission and the Commission staff and, thus, they are not subject to the attorney-client privilege, the work-product doctrine, or other similar protections" (68 FR 74714), which is worth remembering before writing a CCO report as if only the board will read it.

The newest exam evidence points at the gap between doing the work and keeping it. The September 14, 2026 risk alert, written about advisers' own annual reviews under Rule 206(4)-7, found firms that "did not maintain the documentation generated during the annual review," firms that replaced the review with training or "annual attestations," and policies "that delegated the execution of services and/or operations to others, but did not identify how the adviser should oversee these delegated responsibilities" (risk alert, September 14, 2026). A sub-adviser is the clearest case of a delegated responsibility there is.

Every action by people and agents in Investment Manager Oversight, on one audit trail

That is the part of a Rule 38a-1 compliance program Investment Manager Oversight is designed to carry for sub-advisers: the evidence of oversight, each quarter, in a form the CCO can sign and an examiner can follow. The judgments the rule leaves to people stay with them. The oversight analyst's quarter, week by week, shows who does what.

Questions people ask

Does Rule 38a-1 apply to ETFs and closed-end funds?

Yes. It applies to every "registered investment company and business development company," which covers mutual funds, ETFs, closed-end funds and BDCs. For unit investment trusts, the principal underwriter or depositor takes the board's role under paragraph (b).

Who must conduct the annual review under Rule 38a-1?

The fund, not the board. The adopting release says "The rule does not require a fund board to conduct the review; the board would, however, have the benefit of the review in the report submitted by the compliance officer." In practice the CCO's team runs it and reports the results.

Can a fund rely on a third-party report instead of reviewing a provider's policies?

In limited cases. For an unaffiliated provider such as a transfer agent or administrator serving many funds, the SEC accepts a third-party report that describes the provider's program, the risks material to the fund and the adequacy of its controls, provided the fund also weighs its own experience with the provider. Sub-advisers are rarely in that position, because each one runs a portfolio under the fund's own guidelines.

Who approves the fund CCO's appointment and pay?

The board, including a majority of independent directors, approves the CCO's designation and compensation, and only the board can remove the CCO. The adopting release explains why: a CCO who "fails to aggressively pursue non-compliance within the service provider, would risk her position."

Does the Rule 38a-1 adopting release mention style drift?

No. The release expects advisers' policies to cover whether portfolios stay consistent with clients' investment objectives, but the word "drift" does not appear in it. Style drift is a monitoring question funds handle in their own policies and guideline tests; how drift is measured from returns and from holdings is a guide of its own.