The RIA Client Onboarding Checklist: From Signed Agreement to Funded Account

A new client relationship at an RIA runs on three sets of rules at once: the ones that apply to your firm as an adviser, the ones that apply to your custodian as a broker-dealer, and the paperwork rules each custodian sets for its own forms. The checklists that rank for this topic tend to blur the three. This one keeps them apart, puts each step in the order the work happens, and names the rule behind every regulatory item so you can check it yourself.

It is written for advisory firms that hold client assets at a third-party custodian. It is not legal advice, and your compliance manual and your custodian’s current requirements win wherever they differ from anything here.

The checklist at a glance

This is the whole process on one screen. Each phase has its own section below with the detail and the sources.

Phase	Step	Owner	Rule or reason
Before the agreement	Deliver Form CRS to retail investors	Advisor	17 CFR 275.204-5 (SEC-registered advisers)
Before the agreement	Deliver Form ADV Part 2A brochure	Advisor	17 CFR 275.204-3
Before the agreement	Deliver Part 2B supplement for each supervised person	Advisor	17 CFR 275.204-3
Before the agreement	Deliver the initial privacy notice	Operations	17 CFR 248.4
Before the agreement	Get consent to deliver disclosures electronically	Operations	15 U.S.C. 7001(c)
Before the agreement	Sign the advisory agreement	Advisor and client	Firm policy
Discovery	Build the investment profile	Advisor	SEC Release IA-5248
Discovery	Collect the client’s existing documents	Client	Firm policy
Account opening	Name, date of birth, address, taxpayer ID	Client	31 CFR 1023.220 (custodian’s CIP)
Account opening	Beneficial owners for entity accounts	Client	31 CFR 1010.230
Account opening	Trusted contact person	Client	FINRA Rule 4512
Account opening	Beneficiary designations	Client	Checked against the estate plan
Account opening	Preflight review of every form	Operations	Firm policy
Moving assets	Transfer instruction (ACAT)	Operations	FINRA Rule 11870
Moving assets	Instructions for nontransferable assets	Client and advisor	FINRA Rule 11870(c)
Moving assets	Redeliver Form CRS on a rollover recommendation	Advisor	17 CFR 275.204-5
Systems	CRM household, document storage, billing	Operations	17 CFR 248.30 for safeguards
After funding	First review and a diary date to refresh the profile	Advisor	SEC Release IA-5248

Who is responsible for what

The single most useful thing to get straight is which obligations belong to your firm and which belong to your custodian. When your custodian is a broker-dealer, several rules that people describe as “onboarding requirements” are legally the custodian’s, even though your team and your client do the work of supplying the information.

Obligation	Whose rule it is	What it asks for
Customer Identification Program	Broker-dealer custodian (31 CFR 1023.220)	Name, date of birth, address and taxpayer ID before the account opens, then risk-based verification
Beneficial ownership of entity customers	Broker-dealer custodian (31 CFR 1010.230)	Each 25 percent owner and one individual with significant control
Know your customer	FINRA member firm (FINRA Rule 2090)	The essential facts about every customer and anyone acting for them
Trusted contact person	FINRA member firm (FINRA Rule 4512)	Reasonable efforts to get a trusted contact age 18 or older
Investment profile	Your firm as adviser (SEC Release IA-5248)	A reasonable inquiry into the client’s situation, sophistication, experience and goals
Form CRS and Form ADV Part 2	Your firm, if SEC-registered (17 CFR 275.204-5, 275.204-3)	Delivery before or at the time of the advisory contract
Privacy notice	SEC-registered advisers and broker-dealers, each for its own customers (17 CFR 248.4)	A notice no later than when the customer relationship is established

Under the CIP rule, a broker-dealer can rely on another financial institution to perform parts of its program, but only under specific conditions: the reliance has to be reasonable, the other institution has to be regulated by a federal functional regulator and subject to an anti-money laundering program rule, and it has to certify annually under a contract (31 CFR 1023.220(a)(6)). Your firm is not in that position today, which is the next point.

What changed for adviser anti-money laundering rules

FinCEN finalized an anti-money laundering rule for investment advisers in September 2024 with an effective date of January 1, 2026. On December 31, 2025 FinCEN announced a final rule delaying that date: “the effective date of the rule… is delayed until January 1, 2028” (Federal Register, January 2, 2026). Treasury has also said it intends “to revisit the scope of the IA AML Rule at a future date” (FinCEN).

A separate proposal, published jointly by FinCEN and the SEC in May 2024, would require investment advisers to run their own Customer Identification Program. It was never finalized. FinCEN’s August 2026 regulatory agenda says it “intends to reissue a joint NPRM with the Securities and Exchange Commission” that “would replace the previous IA CIP NPRM” (Unified Agenda, August 14, 2026).

So as of this writing, the identity verification on a new account at a broker-dealer custodian is the custodian’s legal obligation. Watch both rulemakings: if either takes effect, some of this checklist moves onto your firm.

One recent change for entity accounts

FinCEN issued exceptive relief on February 13, 2026 that “excepts covered financial institutions from the requirement to identify and verify the beneficial owners of a legal entity customer each time the customer opens a new account” (FinCEN, FIN-2026-R001). Identification is still required when the entity first opens an account with the institution, so a new business or trust-owned entity client will still need the certification the first time.

If you are dually registered

When a broker-dealer or one of its associated persons recommends a securities transaction or an account type to a retail customer, Regulation Best Interest applies. It has four component obligations: disclosure, care, conflict of interest, and compliance (17 CFR 240.15l-1). Its definition of a retail customer’s investment profile is broader than the adviser guidance, which matters for your intake form. More on that in the discovery section.

Phase 1: Before the agreement is signed

Everything in this phase has a deadline tied to one moment: entering into the advisory contract. Deliver early and log it.

Form CRS (SEC-registered advisers, retail investors)

If your firm is registered with the SEC, you must deliver Form CRS to each retail investor “before or at the time you enter into an investment advisory contract with that retail investor” (17 CFR 275.204-5). The same rule requires you to deliver it again to an existing retail client before or at the time you:

1. Open a new account that is different from the client’s existing account or accounts.
2. Recommend that the client roll over assets from a retirement account into a new or existing account or investment.
3. Recommend or provide a new investment advisory service or investment that does not necessarily involve opening a new account and would not be held in an existing account.

You must also post the current Form CRS prominently on your website if you have one, deliver it within 30 days when a retail investor asks, and communicate amendments to existing retail clients within 60 days after the amendments are required to be made.

The rule applies to advisers “registered under the Act”, which means SEC-registered advisers. State-registered advisers should follow their state’s disclosure rules.

Form ADV Part 2A and 2B

The brochure rule requires an SEC-registered adviser to deliver its brochure, Form ADV Part 2A, “before or at the time you enter into an investment advisory contract with that client”, and a brochure supplement, Part 2B, for each supervised person who provides advisory services to the client, “before or at the time that supervised person begins to provide advisory services to the client” (17 CFR 275.204-3).

A few details that trip firms up:

• If a team of more than five supervised persons serves the client, you only need supplements for the five with the most significant responsibility for the client’s day-to-day advice.
• A client who receives only impersonal investment advice for which you charge less than $500 a year does not need the brochure.
• Each year, within 120 days after your fiscal year ends, you deliver either a current brochure or a summary of material changes that offers the brochure, if there have been material changes.

The privacy notice

Regulation S-P, which covers SEC-registered advisers and broker-dealers, requires an initial privacy notice to a customer “not later than when you establish a customer relationship” (17 CFR 248.4). Put it in the same packet as Form CRS and the brochure, and log it the same way.

Consent to deliver disclosures electronically

If you plan to deliver required disclosures by email or portal, the E-SIGN Act sets conditions. Where a law requires information to be provided to a consumer in writing, electronic delivery satisfies that requirement only if the consumer “has affirmatively consented to such use and has not withdrawn such consent”, after receiving a clear and conspicuous statement of their right to paper copies, how to withdraw consent, and the hardware and software needed (15 U.S.C. 7001(c)). The consent has to be given or confirmed electronically in a way that reasonably demonstrates the client can access the information in the form you will use.

Checklist for this phase

• Form CRS delivered and logged (SEC-registered advisers, retail investors)
• Form ADV Part 2A delivered and logged
• Part 2B supplement for each supervised person who will advise the client
• Initial privacy notice delivered
• Electronic delivery consent captured with the required disclosures
• Advisory agreement and fee schedule signed

Phase 2: Discovery and the investment profile

What the SEC expects you to ask

The SEC’s 2019 interpretation of the adviser standard of conduct says that to develop a reasonable understanding of a retail client’s objectives, “an adviser should, at a minimum, make a reasonable inquiry into the client’s financial situation, level of financial sophistication, investment experience, and financial goals”, which it refers to as the client’s investment profile (SEC Release IA-5248). The same release says it “will generally be necessary” to update that profile to keep a reasonable understanding of the client’s objectives, and that how often depends on the facts and circumstances.

That interpretation applies to SEC-registered and state-registered advisers alike, because it interprets the fiduciary duty in section 206 of the Advisers Act.

If your firm is dually registered, add the items from Regulation Best Interest’s definition, which “includes, but is not limited to, the retail customer’s age, other investments, financial situation and needs, tax status, investment objectives, investment experience, investment time horizon, liquidity needs, risk tolerance, and any other information the retail customer may disclose” (17 CFR 240.15l-1).

One intake form can cover both:

Question area	Adviser guidance (IA-5248)	Reg BI profile
Financial situation and needs	Yes	Yes
Level of financial sophistication	Yes
Investment experience	Yes	Yes
Financial goals and objectives	Yes	Yes
Age		Yes
Other investments		Yes
Tax status		Yes
Time horizon		Yes
Liquidity needs		Yes
Risk tolerance		Yes

Collect documents, not retyped answers

Much of the account paperwork asks for facts the client already has on paper: a driver’s license, a recent statement for each account being moved, a tax return, trust documents or an operating agreement. Ask for the documents first. Copying from the source document means nobody is working from memory, and it gives your operations team one version of each fact to fill everything else from.

This is the step Finpace is built around: a client uploads a license, a statement or a tax return, Emma reads it into one profile for the household, and the forms and webforms after that only ask for what is still missing.

Phase 3: Account opening paperwork

Identity information the custodian must collect

Before a broker-dealer custodian opens an account, its Customer Identification Program requires at minimum each customer’s name, date of birth for an individual, address, and an identification number, which for a U.S. person is a taxpayer identification number (31 CFR 1023.220). The custodian then verifies identity using risk-based procedures “within a reasonable time before or after the customer’s account is opened”, and has to give the customer notice that it is requesting information to verify identity. It keeps the identifying information for five years after the account is closed.

If your team fills in the custodian’s application, copy the name, address and ID number exactly as they appear on the client’s ID document.

Entity accounts

For a legal entity customer, the custodian must identify and verify “each individual, if any, who… owns 25 percent or more of the equity interests” and “a single individual with significant responsibility to control, manage, or direct” the entity (31 CFR 1010.230). Since FinCEN’s February 2026 relief, that is required when the entity first opens an account with the institution rather than every time it opens another one.

Trusted contact person

For each non-institutional account, FINRA Rule 4512 has member firms keep the “name of and contact information for a trusted contact person age 18 or older who may be contacted about the customer’s account” (FINRA Rule 4512). The requirement took effect February 5, 2018 (FINRA Regulatory Notice 17-11). What it actually requires:

• The firm must make reasonable efforts to obtain it. If the client declines, the account can still open: the rule says the absence of a trusted contact “shall not prevent a member from opening or maintaining an account.”
• At account opening, the firm must disclose in writing that it may contact the trusted person and share account information to address possible financial exploitation, to confirm the client’s current contact information or health status, or to confirm the identity of a legal guardian, executor, trustee or holder of a power of attorney.
• When account records are periodically updated, the firm must make reasonable efforts to obtain or update the trusted contact.

Some clients worry that naming someone hands that person control. It does not. FINRA’s investor guidance says naming a trusted contact “does not make that person a power of attorney, legal guardian, trustee or executor”, and does not give them authority “to learn about your account balance, execute trades or engage in any other transactions in your account” (FINRA). A simple way to say it to a client: this is who we call if we cannot reach you or we are worried about you, and they cannot see your money or move it.

The trusted contact also connects to FINRA Rule 2165, which lets member firms place a temporary hold on disbursements from the account of a specified adult, a person age 65 or older or an adult the firm reasonably believes has an impairment that leaves them unable to protect their own interests, when the firm reasonably believes financial exploitation has occurred, is occurring, has been attempted or will be attempted.

Beneficiary designations

Beneficiary forms can quietly undo an estate plan. FINRA’s investor guidance on inherited IRAs puts it plainly: “When you designate an IRA beneficiary, that person inherits your assets when you die, regardless of your will or trust” (FINRA). At onboarding:

• Ask whether the client has a will or trust, and check that each beneficiary form says what the estate plan intends.
• Make sure primary and contingent percentages each add up to 100.
• Use full legal names that match the beneficiaries’ documents.

For retirement accounts, note the client’s age against the required minimum distribution rules. The IRS says account owners “generally must withdraw annually starting with the year they reach age 73”, and can delay the first distribution until April 1 of the following year (IRS).

Account documents by account type

Custodians set their own forms, so the exact list varies. This matrix is the set of questions to ask your custodian for each account type, not a list of any one custodian’s forms.

Account type	Identity and CIP information	Beneficiary designation	Extra documents to ask about
Individual	Yes	If transfer on death is offered
Joint	Yes, for each owner	If offered	Form of ownership (for example, joint tenants or tenants in common)
Traditional or Roth IRA	Yes	Yes
Rollover IRA	Yes	Yes	Distribution paperwork from the plan; Form CRS redelivery if you recommended the rollover
Inherited IRA	Yes	Yes, for the new owner	The custodian’s claim forms, which may need a medallion signature guarantee
Trust	Yes, for trustees		Trust certification or trust agreement pages the custodian requires
LLC, corporation, partnership	Yes, for the authorized individuals		Formation and authority documents; beneficial ownership certification at the first account

On medallion signature guarantees: the SEC’s investor site explains that when securities are held in physical certificate form, “you will need to get your signature guaranteed on all documents before a transfer agent will accept the transaction instructions” (Investor.gov), and FINRA notes that inherited IRA claim forms often require one (FINRA). Ask your custodian which of its forms need one.

Electronic signatures

The E-SIGN Act says a signature, contract or other record in a transaction affecting interstate commerce “may not be denied legal effect, validity, or enforceability solely because it is in electronic form” (15 U.S.C. 7001(a)). That does not settle which of your custodian’s forms it will accept with an electronic signature, or through which tool, so check its current requirements before you send a packet out for signature.

Checklist for this phase

• Name, date of birth, address and taxpayer ID for every account holder, exactly as on their ID
• Beneficial ownership certification for any entity’s first account
• Trusted contact requested, and the client’s answer recorded either way
• Beneficiary designations checked against the estate plan, percentages total 100
• Account-type documents collected (trust, entity, rollover, inherited)
• Medallion signature guarantee arranged where a form requires one
• Standing instructions and fee debit authorization completed

Phase 4: Moving the assets

How an ACAT transfer works, and how long it takes

Transfers of a customer’s account between FINRA member firms, commonly called ACAT transfers, are governed by FINRA Rule 11870. Once the new firm submits the client’s transfer instruction, the firm holding the account has one business day to either validate it or take exception to it. After validation, it must complete the transfer within three business days.

Those are the rule’s clocks, not a promise about your client’s experience. Some assets follow different rules:

• Delayed delivery. Insurance policies (annuities), stripped coupons, and when-issued or when-distributed securities are exempt from the three-day completion requirement.
• Nontransferable assets. The rule lists assets that cannot move as they are, including a product that is proprietary to the old firm, a third-party product such as a mutual fund that the new firm has no arrangement to carry, and limited partnership interests in retail accounts. The old firm must give the client a list of these and ask, in writing, what the client wants done with them.

Before you submit, ask the client for a recent statement for every account being moved, and read it for anything proprietary to the old firm or anything your custodian cannot hold. Those are the positions that will need a decision from the client.

Rollovers from employer plans

For a rollover from an employer retirement plan, ask the plan administrator for its distribution forms and processing times early, since the plan sets its own. If you recommended the rollover, remember that recommending a rollover from a retirement account is one of the events that requires you to deliver Form CRS again (17 CFR 275.204-5).

Checklist for this phase

• Recent statement for every account being transferred
• Transfer instruction submitted, with account title and number matching the statement
• Proprietary and other nontransferable positions identified with the client in advance
• Client’s instructions for nontransferable assets sent
• Annuity transfers tracked separately
• Form CRS redelivered if you recommended a rollover

Why paperwork comes back NIGO, and how to check before you submit

NIGO, not in good order, is industry shorthand for paperwork a custodian, fund or other firm will not process as submitted. We could not find a definition of it from FINRA or the SEC, or a published NIGO rate from a regulator or other neutral source. The rates that circulate come from vendors, so the number worth knowing is your own: count every submission and every rejection, by custodian and by reason.

What you can control is what leaves your office. These checks target the ways a packet can fail on its face:

Check	What to look for
One version of every fact	Name, SSN, date of birth and address match across the application, the transfer form and the ID
Account title	The title on the transfer form matches the statement from the old firm exactly
Signatures and initials	Every signature and initial line is complete, by the right person, dated
Current forms	You are using the custodian’s current version of each form
Beneficiaries	Primary and contingent percentages each total 100, full legal names
Supporting documents	Trust pages, entity documents, death certificates and statements are attached where the form asks for them
Signature guarantees	Any form that needs a medallion signature guarantee has one
Blank required fields	Nothing required is left empty

Of these, the first is the one you can prevent rather than catch. When the same client’s details are typed separately into a CRM, a custodian application and a transfer form, each copy is a chance for a difference. Filling every form from one record removes that chance. Finpace does this by keeping one profile per household and filling each fillable PDF your firm uploads from it, after Emma learns where each field goes.

Systems setup

• CRM. Create the household with every member and entity linked, and record the delivery log for Form CRS, the brochure and the privacy notice so you can show what went out and when.
• Documents. Regulation S-P requires “written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information” (17 CFR 248.30). Decide where onboarding documents are stored and how they are exchanged with clients, and make sure that matches your written policies.
• Incident response. The 2024 amendments to Regulation S-P, adopted May 16, 2024, added an incident response program and customer notification requirements. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026; for advisers, a larger entity is one with $1.5 billion or more in assets under management (SEC small entity compliance guide). Notice to affected individuals is due “as soon as practicable, but not later than 30 days, after becoming aware” of unauthorized access to or use of customer information, subject to exceptions in the rule (17 CFR 248.30).
• Billing and data. Set up fee billing and the custodian data feed before the first billing cycle, and confirm the fee debit authorization is on file.

What to tell the client about timing

Clients mostly want to know when their money will be invested. Give them the order of events and the parts that are genuinely fixed:

1. Paperwork and signatures. Depends on how fast documents come back. Collecting documents before you prepare forms keeps this step short.
2. Account opening. Depends on your custodian’s review, including its identity verification.
3. Transfer. Once submitted, the old firm has one business day to validate or take exception, then three business days to complete, under FINRA Rule 11870. Annuities and anything the new firm cannot hold take longer.
4. Funding and investing. Once assets arrive, you invest according to the plan you agreed.

A short email that sets this up front saves the “is my account open yet” follow-ups:

Thank you for signing on. Here is what happens next. First, we will send you a short list of documents to upload and a packet to sign electronically. As soon as those are back, we open your account with our custodian. Then we request the transfer from your current firm. The rules give your current firm a set number of business days to respond and move the assets, and we will tell you if anything, such as an annuity or a fund we cannot hold, needs a decision from you. We will confirm when everything has arrived.

The first 90 days after funding

• Confirm to the client that every transfer arrived and nothing is still pending.
• Hold the first review meeting and confirm the investment profile still reflects their situation.
• Put a recurring date in your CRM to revisit the profile, beneficiaries and trusted contact. The SEC’s guidance says updating the profile will generally be necessary, and FINRA Rule 4512 expects the trusted contact to be updated with periodic account-record updates.
• Ask the client what was harder than it should have been, and fix that step for the next client.

Download the checklist

Every step above, with an owner, the rule or reason and the source. Adjust it to your custodian’s forms and your compliance manual.

Sources

All sources were checked on September 18, 2026.

• SEC, 17 CFR 275.204-5 (Form CRS delivery)
• SEC, 17 CFR 275.204-3 (brochure delivery)
• SEC, 17 CFR 248.4 (initial privacy notice) and 17 CFR 248.30 (safeguards and incident response)
• SEC, Regulation S-P small entity compliance guide
• SEC, Release IA-5248, Commission Interpretation Regarding Standard of Conduct for Investment Advisers
• SEC, 17 CFR 240.15l-1 (Regulation Best Interest)
• FinCEN, 31 CFR 1023.220 (broker-dealer CIP) and 31 CFR 1010.230 (beneficial ownership)
• FinCEN, exceptive relief on beneficial ownership, February 13, 2026
• FinCEN, delay of the investment adviser AML rule to January 1, 2028 and Treasury announcement on revisiting its scope
• Treasury, Unified Agenda, August 14, 2026 (adviser CIP proposal to be reissued)
• FINRA, Rule 4512 (trusted contact), Regulatory Notice 17-11, Rule 2090 (know your customer), Rule 2165 (financial exploitation), Rule 11870 (account transfers)
• FINRA investor guidance, trusted contacts and inherited IRAs
• Investor.gov, medallion signature guarantees
• IRS, required minimum distribution FAQs
• 15 U.S.C. 7001 (E-SIGN Act)

---

See your own forms fill from one record. Bring a real onboarding packet to a 15-minute call and watch Emma read the documents and fill it.