What Happened
On December 16, 2025, the SEC's Division of Examinations issued a Risk Alert titled 'Additional Observations Regarding Advisers' Compliance with the Advisers Act Marketing Rule.' This was, notably, the only risk alert the Division issued in all of 2025 — a signal of how seriously the staff is treating Marketing Rule compliance. The alert is the third Marketing Rule-specific risk alert since the amended rule took effect, following earlier alerts in June 2023 and April 2024. Each successive alert has become more granular. This one narrows the lens almost entirely on two provisions: the testimonials and endorsements conditions in Rule 206(4)-1(b), and the third-party ratings conditions in Rule 206(4)-1(c).
The alert does not create new law. What it does is tell you, in plain terms, exactly what examiners are looking for and where advisers are still falling short — years after compliance with the Marketing Rule became mandatory on November 4, 2022. If your firm uses client reviews, refer-a-friend programs, social media influencers, lead-generation networks, or displays any award or ranking in your marketing, this alert is directed at you.
Why This Alert Matters for Small Advisers
Small SEC-registered and state-registered advisers often assume that Marketing Rule scrutiny is reserved for large firms with sophisticated digital marketing operations. That assumption is wrong. The staff's review covered advertisements on websites, social media, referral networks, lead-generation arrangements, and third-party platforms. Many of the most common deficiencies — missing disclosures on a website, a refer-a-friend program that triggers compensation without a written agreement, or a 'Best-Of' award displayed without identifying the rating provider — are precisely the marketing activities that smaller advisers rely on to grow. The alert is a direct warning that these practices will be tested in examinations going forward.
Deficiency Area 1: Testimonials and Endorsements — Disclosure Failures
The single most common finding in the December 2025 Risk Alert was failure to provide the required disclosures clearly and prominently at the time a testimonial or endorsement was disseminated. Under Rule 206(4)-1(b), advertisements using testimonials or endorsements must clearly and prominently disclose whether the person giving the statement is a client, whether compensation was provided, and any material conflicts of interest resulting from that compensation or the adviser's relationship with the promoter.
Examiners found multiple ways this disclosure requirement was violated in practice. Disclosures were omitted entirely from adviser websites where testimonials appeared, including on websites operating under alternative business names (so-called 'd/b/a' sites) of supervised persons. The staff also flagged advisers who tried to satisfy the disclosure requirement by burying the required language behind a hyperlink or using diminutive print — a presentation approach that the staff explicitly rejected, noting that required disclosures must be embedded within the relevant content, not hidden. Generic statements that do not specifically address promoter status, compensation terms, or conflicts were found to be insufficient. One particularly notable finding: some advisers provided gift cards to clients to write reviews on third-party websites without having a reasonable basis to believe the required disclosures would appear on those sites.
Deficiency Area 2: Oversight, Written Agreements, and Ineligible Persons
Rule 206(4)-1(b) also imposes oversight and compliance obligations on advisers who use testimonials or endorsements. Advisers must have a reasonable basis for believing that each testimonial or endorsement complies with the rule's requirements. They must enter into a written agreement with any promoter who receives more than $1,000 in cash or non-cash compensation during the preceding 12-month period. The de minimis exception does not apply once payments cross that threshold.
Examiners found that many advisers could not demonstrate a reasonable basis for compliance at all — they lacked the documentation to show it. Others were simply not aware that certain arrangements, such as referral programs or influencer partnerships, constituted endorsements subject to the rule in the first place. Written agreements were missing or incomplete. Some advisers had improperly relied on the de minimis compensation exception even after total payments exceeded the $1,000 annual threshold.
The alert also called out a hard prohibition: advisers may not compensate any person they know — or reasonably should know — is an 'ineligible person' under the Marketing Rule. Ineligible persons include individuals subject to SEC sanctions or state disqualifying disciplinary events. Examiners found instances where advisers compensated such individuals anyway, either because they never checked or because their compliance programs had no workflow for vetting promoter eligibility. Separately, examiners found cases where affiliated promoters were used without clearly disclosing the affiliation at the time the endorsement was disseminated.
Deficiency Area 3: Third-Party Ratings — Due Diligence and Disclosure
Many small advisers display industry awards, rankings, or ratings in their marketing materials — 'Top 10 Adviser' lists, magazine recognitions, or platform-based ratings. Rule 206(4)-1(c) sets specific conditions for using these in advertisements. Before displaying a third-party rating, an adviser must have a reasonable basis for believing the underlying survey or questionnaire was structured fairly and was not designed to produce a predetermined result. The adviser must also clearly and prominently disclose the date of the rating, the time period it covers, the identity of the rating provider, and any compensation paid in connection with the rating (including fees paid for the right to use a provider's logo or reprints).
Examiners found that many advisers could not satisfy the due diligence requirement because they had never actually reviewed the underlying questionnaires or methodology documents for the ratings they displayed. Others lacked policies addressing ratings diligence at all. On the disclosure side, advisers consistently failed to identify the rating date and covered time period, the rating provider's identity, or any compensation arrangements tied to the rating. The staff also found advisers whose compliance manuals addressed third-party ratings on paper but whose actual marketing practices did not follow those procedures — a gap the examinations staff specifically called out as insufficient. Having a written policy is not enough; it must be implemented.
What the CCO Should Do Now
1. Audit Every Active Advertisement
Pull every current advertisement — your website (including any d/b/a sites operated by supervised persons), social media profiles and posts, pitch decks, email templates, and any third-party platform profiles — and confirm that required disclosures are present and displayed clearly and prominently inline, not behind hyperlinks or in fine print. Consider using a checklist mapped to Rule 206(4)-1(b) and Rule 206(4)-1(c) to document each review.
2. Inventory All Promoter Relationships
Map every arrangement through which a third party has or could receive compensation — directly or indirectly, cash or non-cash — for recommending your firm or generating referrals. This includes refer-a-friend programs, social media influencers, lead-generation firms, and affiliated individuals. For each relationship where compensation has exceeded or could exceed $1,000 over any 12-month period, confirm that a compliant written agreement is in place covering the scope of activities and compensation terms. For arrangements where compensation is below the threshold, consider maintaining documentation confirming the de minimis basis.
3. Run Eligibility Checks on Every Compensated Promoter
The Marketing Rule prohibits compensating any promoter your firm knows or reasonably should know is an ineligible person. Consider building a documented eligibility-check workflow — including searches of SEC and state disciplinary databases — that runs before any compensated promoter relationship begins and is refreshed periodically. Document the results and retain them.
4. Build a Third-Party Rating Due Diligence File
Before displaying any award, ranking, or rating in your marketing materials, obtain and review the methodology documentation from the rating provider. Confirm the survey or questionnaire meets the Rule 206(4)-1(c) standard for fair and balanced design. Document your review. Create a disclosure template that includes the rating date, the time period assessed, the identity of the rating provider, and any compensation paid — and attach it to every use of the rating in advertising.
5. Close the Gap Between Your Policies and Your Practice
The examinations staff made clear that written policies and procedures are a necessary but not sufficient condition. Your compliance policies addressing testimonials, endorsements, and third-party ratings must be operationalized — meaning staff know them, follow them, and marketing activity is actually reviewed against them before dissemination. Consider adding a pre-publication compliance review step for all new marketing materials that touch these areas, and consider documenting that review in your books and records.
6. Update Your Books and Records
Rule 204-2 requires advisers to retain copies of advertisements and supporting documentation. For Marketing Rule purposes, that includes written agreements with promoters, documentation of eligibility checks, records that substantiate the reasonable basis for each testimonial and endorsement, and the due diligence files for every third-party rating used. Consider reviewing whether your current record-retention practices capture all of these categories.
The Bottom Line
The December 2025 Risk Alert is the SEC's clearest signal yet that Marketing Rule compliance — specifically around testimonials, endorsements, and third-party ratings — will be tested in examinations across firms of all sizes. The deficiencies the staff described are not interpretive edge cases. They are basic compliance failures: missing disclosures, absent written agreements, no promoter vetting, and no due diligence files. For a small RIA or state-registered adviser, the exposure is real. Use this alert as your examination preparation checklist and close these gaps before an examiner does it for you.