Annual Compliance Review Template (SEC Rule 206(4)-7)

Annual Compliance Review: [Adviser legal name], [Review period]

Report of the annual review that an SEC-registered investment adviser must perform of the adequacy of its compliance policies and procedures and the effectiveness of their implementation, under SEC Rule 206(4)-7(b) under the Investment Advisers Act of 1940 (17 CFR 275.206(4)-7, text as restored by 89 FR 91252, 2024-11-19). Records of the review are kept under Rule 204-2(a)(17)(ii). The report follows a risk-based method: inventory the risks, test the controls, rate the findings, assign remediation and report to senior management. The example firm, Kestrel Bay Capital, is fictional. Replace every [bracketed] value and every row marked Example. Obtain the rule for the normative text. This is a document format, not legal, compliance or investment advice.

Document control

Approvals

Revision history

Contents

• 1. Scope, period and method
• 2. Business and regulatory changes
• 3. Compliance risk inventory
• 4. Testing by area
• 5. Findings and ratings
• 6. Remediation plan
• 7. Policy and procedure amendments
• 8. Follow-up of prior findings
• 9. Conclusion and report to senior management
• 10. Evidence index
• Glossary and references
• Standard and licence note

1. Scope, period and method

This report covers the review of the compliance programme of [Kestrel Bay Capital LLC] (the "Firm") for the period [2025-10-01 to 2026-09-30]. The Firm manages [separately managed accounts, four private funds (Global Opportunities, Global Credit, Growth Partners II and Growth Partners III) and one registered closed-end fund it advises, Kestrel Bay Income Fund] (Example), with regulatory assets under management of [USD 2,480 million] (Example) as of [2025-12-31, the date used in the last annual Form ADV amendment]. The EU affiliate, Kestrel Bay Capital Europe, is a separately authorised firm with its own compliance function; this review covers it only where staff, systems or procedures are shared with the Firm. The review covers the compliance manual, the code of ethics, and every policy adopted under Rule 206(4)-7(a), and how they were applied during the period.

The review was performed by [the CCO with two compliance analysts and an external consultant for cybersecurity testing]. People who perform a control did not test their own work; where the CCO performs a control (for example, approving marketing material), the test was performed by [the external consultant].

The method has five steps:

1. Identify changes in the business and in regulation during the period (section 2).
2. Update the compliance risk inventory and rate each risk for likelihood and impact before controls (section 3).
3. Select tests for each area, with sample sizes scaled to the residual risk, and run them on period data (section 4).
4. Rate each finding, agree remediation with owners and amend policies where the design is inadequate (sections 5 to 7).
5. Follow up prior findings and report the conclusion to senior management (sections 8 and 9).

Sample sizes used in this review (Example):

These sample sizes are the Firm's own convention, not a regulatory requirement. Increase them where a test finds exceptions.

2. Business and regulatory changes

2.1 Business changes

2.2 Regulatory changes and status

Record any state, non-US or self-regulatory changes that also apply, such as rules for the EU affiliate under MiFID II as currently in force.

3. Compliance risk inventory

Scale (Example): likelihood and impact each 1 (low) to 3 (high); inherent score is likelihood multiplied by impact, from 1 to 9. Scores of 6 or 9 are high, 3 or 4 medium, 1 or 2 low. Control strength is strong, adequate or weak, and residual risk is the inherent rating lowered one level for a strong control environment, unchanged for adequate and raised one level (to a maximum of high) for weak.

Check the arithmetic: RSK-001 is 3 x 3 = 9; RSK-003 is 2 x 2 = 4; RSK-006 is 1 x 3 = 3. Each residual follows the rule above.

How to rate control strength. Rate the control environment for each risk on evidence, not on the existence of a policy. A control is strong when it is automated or preventive, has run for at least a full review cycle without exceptions, has a named owner and an independent check, and was retested this year. It is adequate when it is designed to address the risk but relies on manual steps, is new (as with the allocation committee for private credit), or produced minor exceptions that were corrected. It is weak when a test found it missing or not operating, when it depends on one person with no back-up, or when a business change (a new system, product or office) has not yet been reflected in it. Record the evidence for each rating in the risk inventory working file (EVD-001), so that next year's reviewer can see why the rating moved.

Two errors are common. The first is rating likelihood from the Firm's own history only: a risk that has not crystallised at the Firm may still be likely given the strategy, the number of transactions or the enforcement record in the industry. The second is lowering residual risk for controls that were not tested in the period. If a control was not tested, carry it at adequate at most and schedule a test.

4. Testing by area

Test results:

4.1 Test design notes by area

Portfolio management (A1). Compare each account's holdings and trades with its investment guidelines and client restrictions. Test whether breaches found by the pre-trade or post-trade system were escalated, corrected and, where a client lost money, made whole. Read a sample of client files to confirm that the stated objectives are current.

Trading and allocation (A2, A3). Recompute allocations for aggregated orders and for limited opportunities such as new issues and private deals, and compare them with the documented rule. Look at whether partial fills were shared pro rata, whether any account was favoured repeatedly, and whether the best execution committee reviewed broker quality, costs and any research paid for with client commissions.

Valuation and fees (A4). Trace a sample of hard-to-value positions to the valuation committee minutes and the supporting evidence, and look for stale prices that did not change for several periods. Recompute fees from the advisory agreement, the asset base and the billing period, and check that performance fees follow the agreement and the conditions of Rule 205-3 where they apply.

Marketing (A6). Sample advertisements across channels, including web pages, social media posts by staff and pitch books. Confirm pre-use approval, the presence of net performance for the required periods, support for every factual claim, and disclosures for testimonials, endorsements and third-party ratings. Keep the records Rule 204-2 requires for performance and for advertisements.

Code of ethics (A7). Test the timeliness and completeness of reports, the pre-clearance trail, coverage of broker feeds and the review of the CCO's own trading by someone else. Compare personal trades with client trades over a window around each trade.

Privacy and cybersecurity (A10). Confirm the incident response programme required by the amended Regulation S-P exists, was tested and covers service providers. Review access rights for leavers, multi-factor authentication coverage and the results of any penetration test.

Custody (A5). Confirm the basis on which the Firm has custody (fee deduction, general partner of the private funds) and that the audit approach for each fund was followed: the auditor is registered with and inspected by the PCAOB, audited statements reached every investor within the deadline, and the Global Credit Fund has an audit engagement for its first fiscal year. Trace a sample of standing letters of authorisation to the custodian's records.

Disclosures (A8). Compare the brochure with Form ADV Part 1A and the facts found in the other tests. Check that the 2026-03-27 brochure disclosed the launch of the private credit fund, that the brochure summary of the code of ethics matches the code, that every client in the sample received the brochure or summary of material changes within 120 days, and that new clients received it before or at signing. Where the Firm serves retail investors, repeat the check for Form CRS.

Books and records (A9). Select a sample of required records from Rule 204-2 (order memoranda, written communications, advertisements, performance support, code of ethics records) and confirm each can be produced promptly, in the stated format and from the stated system. Test that the order management system migration kept complete history.

Proxy voting (A11). Reconcile a sample of votes cast with the policy and with the proxy adviser's recommendations, review the conflict log and confirm that the Firm checked the proxy adviser's capacity and methodology during the year. Confirm that the registered fund's voting record was filed on Form N-PX.

Business continuity (A12). Review the result of the last continuity test, the succession plan for key persons (the departure of the head of trading in BCH-004 is a live example) and whether vendors that are critical to trading and valuation have tested their own plans.

Political contributions (A14). Compare the contribution log with a search of public campaign finance databases for covered associates, confirm that new hires disclosed past contributions with the correct look-back, and confirm that no government entity client was billed during a time-out period.

Readiness areas (A13, A15). For rules with future dates, the test is whether the Firm has a plan, an owner and a budget, not whether it already complies. Record the gap assessment and the date by which each gap will be closed.

For each test, keep the working paper with the population source, the sample selection method, the items tested and the evidence seen. A generic layout is in Control Testing Workpaper (compliance/control-testing-workpaper).

5. Findings and ratings

Rating scale (Example):

Summary by rating:

Arithmetic check: 2 + 3 + 1 = 6 findings, matching the six rows above.

6. Remediation plan

Due dates follow the rating scale in section 5 and run from the date of the final report (2026-10-30 in this example): High findings within 30 days (by 2026-11-29, so ACT-001 is due 2026-11-27 and ACT-004 2026-11-15), Medium within 90 days (by 2027-01-28) and Low within 180 days (by 2027-04-28). An owner who cannot meet the date asks the CCO for an extension in writing before it passes, with a reason and an interim control; the extension is reported to senior management with the next progress update.

7. Policy and procedure amendments

Each amendment goes through the same approval route as the original policy, is communicated to the staff it affects with a short summary of what changed, and is reflected in training. Where a policy change also changes what clients are told, for example the allocation policy for private credit, check whether the brochure needs an other-than-annual amendment. Update the evidence index with the approved version.

8. Follow-up of prior findings

9. Conclusion and report to senior management

Based on the tests in section 4 and the follow-up in section 8, the CCO concludes that the Firm's policies and procedures were [reasonably designed, except for the allocation process for private credit and the code of ethics surveillance after the system migration] (Example), and were [effectively implemented, except for the findings listed in section 5] during the review period. The two high-rated findings were reported to the Managing Partner on [YYYY-MM-DD] and remediation is tracked in section 6.

This conclusion rests on sample testing and is not a guarantee that no violation occurred. The review did not include [areas excluded and why]. The CCO will report progress on open actions to senior management [monthly] until closure, and the next annual review will retest areas A3, A6 and A7 with larger samples.

Key messages for senior management (Example):

1. Allocation of scarce private credit deals is the highest risk this year; the new committee approval step should be in place before the next fund closing.
2. System migrations need a compliance sign-off; the order management change created a gap in personal trading surveillance.
3. Regulatory workload is rising: Form PF changes by 2027-07-01 and the AML programme rule by 2028-01-01 need budget in the next plan.

10. Evidence index

Traceability: every risk in section 3 has at least one test in section 4 or an explained reason for no test; every exception has a finding; every finding has an action; every action has evidence of closure.

Glossary and references

References (check the current official versions):

• SEC Rule 206(4)-7, 17 CFR 275.206(4)-7 (compliance procedures and practices), eCFR; adopting release IA-2204 (2003).
• Technical amendments reflecting the vacatur of the Private Fund Adviser Rules, 89 FR 91252 (2024-11-19).
• SEC Rule 204-2, 17 CFR 275.204-2, paragraphs (a)(17) and (e)(1).
• SEC Rule 204A-1 (code of ethics), Rule 206(4)-1 (marketing), Rule 206(4)-2 (custody), Rule 206(4)-5 (political contributions), Rule 206(4)-6 (proxy voting).
• Investment Company Act Rule 38a-1 (fund compliance programmes).
• Regulation S-P amendments (2024), compliance dates 2025-12-03 and 2026-06-03.
• SEC, Investment Adviser Performance-Based Compensation Modernization, proposed rule, 91 FR 63676 (2026-10-06).
• FinCEN final rule delaying the investment adviser AML programme effective date to 2028-01-01, 91 FR 36 (2026-01-02); FinCEN AML/CFT programme reform proposal, 91 FR 18704 (2026-04-10), proposal only.
• SEC order adjusting the Rule 205-3 dollar amount tests, 91 FR 23520 (2026-05-01), effective 2026-06-29.
• Form PF compliance date extension, 91 FR 56593 (2026-09-03).
• SEC Division of Investment Management, Marketing Compliance FAQs (updated 2025-03-19 and 2026-01-15).
• Related templates: Code of Ethics (compliance/investment-adviser-code-of-ethics), Form ADV Part 2A Brochure (compliance/form-adv-part-2a-brochure), Proxy Voting Policy (compliance/proxy-voting-policy), Best Execution Policy (compliance/best-execution-policy), Marketing Review Checklist (compliance/marketing-review-checklist), Valuation Policy (compliance/valuation-policy).

Standard and licence note

Based on SEC Rules 206(4)-7 and 204-2 under the Investment Advisers Act of 1940 as published in the electronic Code of Federal Regulations and the Federal Register (US federal works, public domain). Rule numbers and Federal Register citations are given and requirements are described in original wording; no regulatory text is reproduced. Dates of later rules and proposals are stated as of 2026-10 and some were confirmed only through secondary sources, as marked. Kestrel Bay Capital and every example row are fictional. Check the current rule texts, SEC staff guidance and the Federal Register before use. This is a document format, not legal, compliance or investment advice. Template licence: MIT.