What Is a Deficiency Letter?

Deficiency letters range from minor documentation gaps to serious compliance program failures, and the letter usually itemizes each issue found during the exam individually rather than as a general summary — meaning a single letter might cover anywhere from one or two minor findings to a dozen or more issues spanning several areas of the firm’s operations. Common categories include inaccurate or outdated Form ADV disclosures, gaps in Written Supervisory Procedures that don’t reflect actual practice, inadequate personal trading oversight under the Code of Ethics, insufficient marketing compliance review, or recordkeeping shortfalls under the Books and Records Rule.

For each item, the letter typically requests a written response describing the corrective action the firm has already taken or plans to take, along with a timeline for implementation. Firms are generally expected to respond within 30 days, though this can vary by regulator and by the nature of the finding — more serious issues sometimes carry a shorter turnaround or a request for interim remediation steps before the full response is due.

Receiving a deficiency letter isn’t automatically a sign of a failed exam — many firms with otherwise solid compliance programs receive one covering a handful of items, since exams are designed to surface exactly this kind of gap. How the firm responds matters as much as the initial findings: a thorough response addresses not just the specific instance flagged, but the underlying process failure that allowed it, since regulators may follow up to confirm the fix actually took hold. Firms that treat deficiency letters as a compliance program stress test — using them to strengthen weak areas rather than simply closing out the specific item cited — tend to fare better in future exams, while unaddressed or superficially resolved deficiencies can resurface as more serious findings, or even enforcement referrals, if they recur.