Two CCOs. Two Settlements. One Clear Message.
In a span of four days in July 2025, the SEC announced settled enforcement actions against two individual chief compliance officers at registered investment advisers — not their firms, them personally. Both cases turned on the same conduct: altering or fabricating compliance records and then presenting those records to SEC examination staff as if they were contemporaneous. If you are a CCO or an operations principal at an RIA, you should read the underlying orders and then audit your own recordkeeping practices before you see an exam request letter.
What Happened in Each Case
The first action, In the Matter of American Portfolio Advisors, Inc., Rel. IA-6893 (July 11, 2025), involved the firm, its former CCO, and its former president. According to the SEC's order, the firm failed to adequately disclose conflicts of interest associated with compensation paid by an unaffiliated clearing broker to the firm's affiliated broker-dealer, and it overbilled clients. On top of those substantive violations, the order alleged that the former CCO and former president created backdated documents and provided them to SEC staff during a compliance examination. The firm, its CCO, and its president settled the matter.
The second action, In the Matter of Suzanne Ballek, Rel. IA-6896 / IC-35678 (July 15, 2025), did not involve a firm-level substantive violation of the same type — it focused almost entirely on the CCO's individual conduct. The SEC found that Ballek modified and backdated approximately 170 pre-clearance trading forms and fabricated additional forms to make it appear that the firm's compliance procedures had been properly followed. The SEC found that the CCO's conduct misled exam staff and obscured violations of the firm's pre-clearance policy, and that those actions violated Advisers Act Sections 204(a) and 206(4) and Rule 206(4)-7. Ballek agreed to a $40,000 civil penalty and a three-year bar from serving in a compliance or supervisory capacity.
A third case, settled the prior week, involved a different CCO who backdated annual compliance review documents after the SEC examination had already commenced, then represented them as contemporaneous records. That CCO voluntarily admitted in testimony to creating, signing, and backdating the records. Because of that cooperation, the outcome was a $10,000 civil penalty and no industry bar.
Why These Cases Are Different From Ordinary CCO Liability
CCOs do not typically face personal enforcement exposure simply because a compliance program has gaps or because a supervised person commits misconduct. Established enforcement policy, reflected in statements from multiple administrations, generally reserves individual CCO charges for three situations: (1) the CCO participates in the underlying misconduct; (2) the CCO completely and utterly fails to carry out compliance responsibilities; or (3) the CCO misleads regulators. Both of the July 2025 settlements, and the third case from that same week, squarely fall into category three — misleading examiners. That distinction matters because it means the risk is entirely within a CCO's control. You do not have to be perfect. You do have to be honest.
The Underlying Rule Framework
Rule 206(4)-7 under the Investment Advisers Act of 1940 — the Compliance Rule — requires every SEC-registered investment adviser to adopt and implement written compliance policies and procedures reasonably designed to prevent violations of the Advisers Act. Rule 204-2, the Books and Records Rule, requires advisers to make and keep true, accurate, and current records. Section 204(a) of the Advisers Act underlies the books and records obligations. The July 2025 actions demonstrate that the SEC will charge a CCO individually for books and records violations when the falsification is designed to mislead examination staff, even if the CCO was not the primary beneficiary of the underlying conduct.
What Examiners Are Looking For
The SEC's Division of Examinations routinely reviews pre-clearance trading records as part of code of ethics examinations. Rule 204A-1 under the Advisers Act requires registered advisers to adopt a code of ethics that, among other things, requires access persons to obtain pre-approval before acquiring beneficial ownership in initial public offerings and limited offerings. When examiners pull those records, they look at creation dates, metadata, signatures, and whether the form of the document is consistent with what the firm's own written policies require. In the Ballek matter, approximately 170 forms were at issue — a volume that suggests the falsification was systematic, not a single lapse.
The Cooperation Credit Is Real — and Instructive
Compare the two CCO-specific outcomes: $40,000 civil penalty plus a three-year supervisory bar in one case; $10,000 civil penalty and no bar in the other. The difference is largely attributable to the fact that the second CCO voluntarily admitted in sworn testimony to creating, signing, and backdating the records. That is a significant sentencing differential for what is substantively similar conduct. For CCOs who find themselves in a situation where records are inaccurate, the enforcement history consistently rewards early, voluntary disclosure and cooperation over concealment.
What to Do Now
These cases point to five concrete actions CCOs and operations principals should consider taking before the next examination cycle.
First, audit pre-clearance form integrity today. Pull a sample of your last 12 months of pre-clearance approvals and denials. Verify that the file metadata and form dates are consistent with your written procedures. Confirm that approvals were granted before the transaction, not after. If your firm uses a manual paper-based process, consider whether the audit trail is sufficient to withstand examiner scrutiny.
Second, map your written policies to your actual records. The American Portfolio Advisors order is a reminder that firms can face enforcement when internal policies require documentation that does not exist — or that was created after the fact. Review your compliance manual against the records you actually maintain. Where your policies describe a process, confirm that the records document that process was actually followed.
Third, establish a clear protocol for responding to document requests during an examination. Every person who might be asked to produce records during an SEC examination — including operations staff and assistants who maintain files — should understand that records must be produced as they exist. Consider having outside counsel or your CCO personally review any document production before it goes to examination staff.
Fourth, think carefully about how your annual compliance review is documented. As the third July 2025 case illustrates, if your firm's own written policies require a written compliance review report, that document must exist and must have been created contemporaneously with the review. The Compliance Rule under Rule 206(4)-7 does not itself mandate a written report of the annual review, but if your policies say you will produce one, examiners will ask to see it.
Fifth, consider separating the CCO function from anyone who has transactional authority over client accounts or trade execution. Both July 2025 matters involved scenarios where the CCO had visibility into, or responsibility for, the very records that were being reviewed. Structural independence does not eliminate liability, but it reduces the incentive to alter records in the first place.
The Broader Enforcement Context
Under Chair Paul Atkins, SEC enforcement overall has shifted toward cases involving direct investor harm and away from technical compliance foot faults. That does not mean recordkeeping and exam cooperation risks have declined — if anything, these two July 2025 cases show that misleading examiners remains a priority regardless of broader enforcement trends. Examiners have not changed their methodology; they still pull pre-clearance forms, annual review documentation, and books and records as a matter of routine. The risk is not that the SEC will target minor paperwork imperfections; the risk is that an imperfect paper trail creates a temptation to fix it — and that acting on that temptation is where individual CCO liability crystallizes.
Bottom Line
The July 2025 CCO enforcement actions are straightforward in their lesson: do not create, alter, or backdate compliance records in response to an SEC examination. If your records are incomplete or inaccurate, disclose that fact to examiners and correct the underlying program — the cooperation credit in the third case is real evidence that honesty is rewarded. Use this month to walk through your pre-clearance process, your annual review documentation, and your exam-response protocols. If you find gaps, document what you found and what you changed. A compliance program that acknowledges and corrects its own deficiencies is exactly what Rule 206(4)-7 is designed to produce.