The Rule Isn't the Control

The SEC wants to toss out the Investment Adviser Pay-to-Play rule, and that sounds like good news for any compliance officer buried under paperwork about partner donations. The proposal is public now. If you have input, you need to send it in by November 9.

But there is a trap here, and some people see this rescission and think the risk is gone too. They assume they can stop tracking those numbers; they want to drop the quarterly attestations. They believe all that effort will just disappear and be free for something else.

They're walking into a trap.

The SEC made it clear: even if the rule goes, the risk stays. I've been on both sides of the audit table, so I know how this turns out. You stop tracking contributions because "well, there's no rule anymore, and two years later, a partner writes a big check to a state official whose pension fund just handed them a contract. The regulator won't look at Rule 206(4)-5 being rescinded in 2026, and they will look at fiduciary duty and corruption.

When I audit a process, I don't start by asking if you're following the latest SEC memo. I ask: "What would you show me on a Tuesday?"

Tell me your program is "mature" and I'll stop trusting you right then; usually, that word is just code for having a folder full of policies (which nobody actually reads). If I show up on some random Tuesday afternoon, I don't care about the policy documents. I want to see logs, and give me evidence that the check actually happened.

A spreadsheet claiming "no contributions made" isn't evidence. It's an assertion. To keep an auditor happy, you have to show the mechanism (the actual process) that proves a thing didn't happen; did you cross-reference payroll with public donor databases? Did every covered employee sign a declaration?

If you stop doing the work because the specific rule is gone, you aren't reducing your workload; you're just removing your shield.

The common objection here is one of resource allocation. Why spend money and man-hours on a control for a rule that no longer exists? It feels like bureaucratic waste.

Keeping a boring log is cheap. Defending a failure of supervision charge is not, and logs let you prove a negative. Without them, you have the honor system. That usually lasts until the first subpoena hits your desk.

Then there are the insurers, and professional indemnity providers don't watch every SEC rule change in real time, but they do track where money is lost. If pay to play scandals rise because people stopped monitoring, premiums go up. It doesn't matter what the Federal Register says, and you might be compliant with the SEC and still find yourself uninsurable.

Why did Conduent settle a fight over 44 million exposed records? It wasn't one rule that failed. Evidence and oversight collapsed across a massive data set. The risk is different than political contributions, but the cause is the same. Someone believed a checkbox on a certification meant the control actually worked.

If you're the person tasked with implementing this "simplification," be very careful.

Don't mistake a gone regulation for a gone hazard. The SEC isn't claiming political contributions are safe now; they're just changing how they police things. They shifted from a clear line in the sand to a broad principle of conduct, and principles are a nightmare during an audit because they're subjective.

What happens if I show up in 2027 and ask for your contribution logs? If you tell me you stopped keeping them because the SEC said it was okay, you just handed me the biggest finding of the year.

Keep the logs. Keep the attestations. Just stop calling them "Pay-to-Play compliance" and start calling them "Fiduciary Risk Management."

Check your November 9 calendar for the comment deadline, but don't let it be the day you decide to stop auditing your partners.