What do acquirers check in RIA technology due diligence?

If you are buying or selling an RIA, technology due diligence decides how much of the seller's exam risk comes with the deal. The buyer inherits client data, vendor contracts and compliance records, and the SEC has said it will prioritize advisers that have grown through mergers and acquisitions.

Why does technology due diligence matter in RIA M&A?

Technology due diligence matters because the buyer inherits the seller's client data, its vendors and, in many deal structures, its compliance history. Under amended Regulation S-P, every SEC-registered adviser must keep written safeguards policies, an incident response program and service provider oversight. Larger firms had to comply by December 3, 2025 and smaller firms by June 3, 2026, according to the SEC's small entity compliance guide. A target that cannot show that program is a gap the acquirer closes after closing, on its own exam record.

Examiners are watching consolidation too. The SEC Division of Examinations' Fiscal Year 2027 priorities say the Division "will also prioritize advisers that have grown through mergers, acquisitions or other means" and will focus on compliance practices when advisers have undergone certain changes. The same document names access controls, account management, data loss prevention, third-party service providers and Regulation S-P incident response among its information security focus areas. We covered those priorities in more detail in what the SEC's exam priorities signal for RIAs.

Which Reg S-P records does an acquirer ask for first?

Most start with the records Rule 204-2(a)(25) already requires an adviser to keep, because they should exist and they show whether the program is real. The rule lists:

• The written safeguards and incident response policies required by 17 CFR 248.30(a)(1).
• Written documentation of any detected unauthorized access to or use of customer information, and of the response and recovery.
• Written documentation of each investigation and determination about whether customer notification was required, including a copy of any notice sent.
• The written service provider oversight policies required by 248.30(a)(5)(i), and documentation of the related contracts or agreements.
• The written disposal policies required by 248.30(b)(2).

Under Rule 204-2(e)(1), those records are kept for at least five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser. A seller with an incident inside that window should expect questions about how it was investigated and whether the customer notice requirement in 248.30(a)(4), which sets a deadline of no later than 30 days after becoming aware of unauthorized access to sensitive customer information, was handled. Our guide to Reg S-P recordkeeping under Rule 204-2 walks through each record.

How do acquirers review the seller's vendors?

Acquirers map every service provider that touches client data and check whether the oversight Regulation S-P requires is in place. Rule 248.30(a)(5) requires policies reasonably designed to oversee service providers, including making sure they notify the firm as soon as possible, and no later than 72 hours after becoming aware, of a breach resulting in unauthorized access to a customer information system they maintain.

In practice that means a vendor list with contracts, breach notice terms and the date of the last review. The usual list covers the CRM, portfolio management and reporting, financial planning software, document storage, email archiving, e-signature and the IT provider itself. Integrations that pull data from the custodian belong on it too, as we explain in custodian API integrations and vendor risk. After closing, two vendor stacks often run side by side for months, and each contract carries its own notice terms. Our article on service provider notice and vendor contracts covers what those terms should say.

Which technical controls get tested before closing?

Identity and access usually come first, because that is where examiners say they will look and where a seller's gaps transfer fastest. A typical technical review covers:

• Multifactor authentication on email, custodian portals, the CRM and remote access, with any exceptions documented.
• Account management: a current user list, shared or generic accounts, former employees who still have access, and who holds administrator rights.
• Device inventory: firm-owned and personal devices that reach client data, their encryption status, and whether they can be wiped remotely.
• Unsupported systems that need replacement budget, such as servers reaching end of support (see Windows Server 2016 end of support).
• Backups: what is backed up, where it is stored, and when a restore was last tested.
• Communications archives. Rule 204-2(a)(7) requires advisers to keep certain written communications, so buyers check which channels the archive actually captures (see off-channel communications).

Where the seller offers covered accounts, some acquirers also ask for its identity theft program under Regulation S-ID, which the FY2027 priorities also name.

What happens to the seller's records and systems after closing?

The seller's required records must still be preserved for the full retention period, even if the selling adviser stops operating. Rule 204-2(f) says an adviser must, before ceasing business, arrange for and be responsible for preserving its books and records for the rest of the required period, and notify the SEC in writing of the exact address where they will be kept.

That makes the integration plan a compliance record as much as an IT project. Mailbox migrations, archive exports, CRM merges and file share moves each need a note of what moved, where it landed and what was kept read-only. Retired laptops, servers and copiers that held client data fall under the disposal requirement in 248.30(b), which calls for reasonable measures to protect against unauthorized access to or use of that information when it is disposed of. The rule's safeguards also reach customer information a firm receives about customers of another financial institution, which is how client data often arrives during a transition.

The combined firm's compliance program under Rule 206(4)-7 must be reasonably designed for the business as it now exists, and reviewed at least annually. The first annual review after closing is a natural point to confirm the technology integration actually finished.

What should a seller do this quarter if a deal is possible?

Build the diligence file before a buyer asks for it. A practical IT due diligence checklist for a seller:

• Gather the Rule 204-2(a)(25) records in one place and confirm each policy matches current practice.
• Inventory every vendor with access to client data, with its contract, breach notice terms and last review date.
• Export a multifactor authentication and user access report, and close stale accounts.
• List unsupported systems and the plan to replace them.
• Run a test restore and keep the result.
• Confirm which communication channels your archive captures.
• Write down where records would be kept if the firm stopped operating.

Acquirers can run the same list against a target and price the gaps into the integration plan. Much of this file overlaps with the evidence binder examiners ask for, so the work pays off whether or not a deal closes.

This article describes what the rules require; it is not legal advice, and deal counsel should confirm how they apply to a specific transaction.

s90 works with RIAs and family offices across Los Angeles and Orange County on both sides of a transaction: assembling the technology diligence file, documenting vendor oversight, and running the post-close migration with a record of what moved where. Our agreements include 72-hour breach notification and 24-hour evidence production, the terms a Reg S-P service provider review asks about. If a deal is on your calendar, we're happy to walk through your file with you.