Your managing partner’s executive assistant reads the deal calendar, the IC memos, and the board packs. They also have a brokerage account. Does your code of ethics cover them?
For many chief compliance officers (CCOs), the honest answer is “I’m not sure.” The SEC has noticed. In an April 2022 risk alert, the SEC’s Division of Examinations reported that some advisers failed to identify certain employees as access persons at all.
The stakes keep rising. SEC-registered advisers reached 16,544 firms at the end of 2025, managing $176.8 trillion, according to the Investment Adviser Association’s 2026 Industry Snapshot. More firms now hire remote and offshore assistants too. Each one raises the same question.
This guide answers it. It covers the access person definition under Rule 204A-1, the test for executive assistants, the reports an access person owes, how pre-clearance works, and a step-by-step onboarding plan for a new EA.
Quick answer: An executive assistant counts as an access person under Rule 204A-1 when they are a supervised person of a registered adviser and their duties give them access to nonpublic information about client trades, portfolio holdings or securities recommendations. An EA who supports a partner’s deal flow, IC meetings or portfolio work usually meets that test. Access persons must file initial and annual holdings reports, file quarterly transaction reports, and get pre-approval before buying into IPOs or limited offerings.
This guide gives general information for compliance professionals. Confirm how the rules apply to your firm with securities counsel.
What Is an Access Person Under Rule 204A-1?
Rule 204A-1 under the Investment Advisers Act of 1940 requires every SEC-registered investment adviser to adopt and enforce a written code of ethics. The SEC adopted the rule in July 2004.
The rule defines an access person as any supervised person who:
- has access to nonpublic information about any client’s purchase or sale of securities
- has access to nonpublic information about the portfolio holdings of any reportable fund
- makes securities recommendations to clients, or has access to nonpublic recommendations
The rule adds a presumption. If investment advice is the firm’s primary business, all directors, officers and partners count as access persons automatically.
Here are the core relationships in plain terms:
- A registered investment adviser adopts a code of ethics.
- The code of ethics binds every supervised person.
- An access person reports holdings and transactions to the CCO.
- The CCO reviews every access person report.
- An access person obtains pre-approval before buying IPO or limited offering shares.
The SEC wanted more than paperwork. In the adopting release, it urged advisers to take care with their codes, which “should be more than a compliance manual.”
Is an Executive Assistant an Access Person?
Often, yes. The answer depends on what the EA can see. The job title plays no part in the test.
The SEC addressed support staff directly in the 2004 adopting release:
“Administrative, technical, and clerical personnel may also be access persons if their functions or duties give them access to nonpublic information.”
The same release added a warning that fits most small funds:
“Organizations in which employees have broad responsibilities, and where information barriers are few, may see a larger percentage of their staff subject to the reporting requirements.”
An EA at a private equity or venture fund rarely works behind an information barrier. They manage the partner’s inbox, calendar and documents. That usually means access to nonpublic information.
A simple test for CCOs
Ask four questions about the EA’s actual duties:
| Question | If yes |
|---|---|
| Does the EA read the partner’s email or shared drives? | Likely access to nonpublic deal and trade information |
| Does the EA prepare or distribute IC memos, board packs or LP reports? | Likely access to nonpublic holdings and recommendations |
| Does the EA schedule calls with bankers, targets or co-investors? | Likely knowledge of pending transactions |
| Does the EA work for a firm whose primary business is advice, and hold an officer title? | Presumed access person |
One “yes” usually tips the answer. Many CCOs classify every EA who supports an investment professional as an access person by default. That approach costs a little paperwork and removes a common exam finding.
Three examples
Example 1: EA to a buyout partner
The EA manages the partner’s inbox, books meetings with sell-side bankers and formats the IC memo for a take-private deal. This EA has access to nonpublic recommendations and pending transactions. They count as an access person.
Example 2: Office manager at a growth equity fund
The office manager orders supplies, handles payroll vendors and has no access to deal folders or partner email. Their duties likely fall outside the definition. Document the reasoning and review it if the role changes.
Example 3: Remote EA to a venture partner at a registered adviser
This executive assistant at a VC firm works from Cape Town with delegated Gmail access, CRM access and the IC calendar. Location changes nothing about the access. If the EA counts as a supervised person, they count as an access person.
Does the Code of Ethics Cover Contractors and Remote Assistants?
This question trips up many firms. Rule 204A-1 applies to supervised persons, and Section 202(a)(25) of the Advisers Act defines that term. It covers partners, officers, directors, and employees. It also covers other persons who provide investment advice on the adviser’s behalf and work under its supervision and control.
A contractor EA who gives no investment advice may fall outside that literal definition. Still, a contractor with full inbox access creates the same risk as an employee with the same access. Many CCOs close the gap in two ways:
- By contract: The engagement agreement requires the contractor to follow the code of ethics, report holdings, and pre-clear trades.
- By policy: The code names “contractors and temporary staff with access to nonpublic information” as covered persons.
Ask counsel which approach fits your firm. Either way, write the decision down.
Remote assistants add a practical wrinkle. An EA in the Philippines or South Africa may hold shares on the Philippine Stock Exchange or the Johannesburg Stock Exchange. Those shares still count as reportable securities. US compliance platforms often lack direct broker feeds for those accounts, so the EA submits statements manually. Build that step into the onboarding plan.
Direct-hire models help here. When a fund hires a remote EA directly and pays the EA itself, the fund can write code obligations straight into the EA’s agreement. Our guide on vetting, ND,As and data security covers the contract and access setup.
What Does an Access Person Have to Report?
Rule 204A-1 requires two types of reports. The CCO, or another person the code names, must receive and review them.
Holdings reports
| Report | Deadline | Data must be current as of |
|---|---|---|
| Initial holdings report | Within 10 days of becoming an access person | No more than 45 days before the person became an access person |
| Annual holdings report | At least once every 12 months, on a date the firm picks | No more than 45 days before submission |
Each holdings report must list:
- the title and type of each reportable security
- the ticker or CUSIP, number of shares and principal amount, as applicable
- every broker, dealer or bank holding securities for the access person’s benefit
- the date of submission
Quarterly transaction reports
Access persons must file a transaction report within 30 days after each calendar quarter ends. Each report lists, for every reportable transaction:
- the date, title, ticker or CUSIP, interest rate and maturity, shares and principal amount
- the nature of the transaction, such as a purchase or sale
- the price
- the broker, dealer or bank
- the date of submission
What the rule excludes
The rule allows three reporting exceptions:
- accounts the access person has no direct or indirect influence or control over
- transaction reports for automatic investment plans, such as dividend reinvestment plans
- transaction reports that would duplicate broker confirmations or statements the firm receives within 30 days of quarter end
Some securities also fall outside “reportable security”:
- direct obligations of the US government
- bankers’ acceptances, bank CDs, commercial paper and high-quality short-term debt, including repurchase agreements
- money market fund shares
- shares of open-end funds the adviser does not advise or control
- unit investment trusts invested only in those unaffiliated open-end funds
Beneficial ownership reaches the household
The rule ties “beneficial ownership” to the Section 16 standard under Exchange Act Rule 16a-1(a)(2). In practice, that usually pulls in accounts of immediate family members who share the access person’s household. An EA whose spouse trades actively needs to report those accounts too.
How Does Pre-Clearance Work for an Access Person?
Rule 204A-1 sets one firm pre-approval requirement. Access persons must get the adviser’s approval before they acquire beneficial ownership in:
- an IPO: a registered offering by an issuer that was not a reporting company before the registration
- a limited offering: an offering exempt under Section 4(a)(2) or 4(a)(5) of the Securities Act, or under Rule 504 or Rule 506 of Regulation D
That second category matters for private markets staff. Private fund interests, angel rounds, and many startup investments fall under Regulation D. An EA at a VC fund who wants to join a friend’s seed round needs approval first.
Many firms go further. They require pre-clearance for every personal trade in a reportable security. A typical workflow looks like this:
- The EA submits a request in the firm’s compliance system, such as StarCompliance, ComplySc,i or MCO.
- The system checks the request against the restricted list and the firm’s own trading.
- The CCO or a delegate approves or denies the request.
- The approval stays valid for a short window, often one or two trading days.
- The trade then shows up in the next broker feed or quarterly report.
The restricted list
Private equity and credit funds often hold material nonpublic information (MNPI) about public companies. A take-private bid, a PIPE investment,nt or a debt deal can all create it. The 2022 risk alert encouraged advisers to keep restricted lists and to block personal trading in listed issuers.
An EA sees many of those names first. They book the call with the target’s CEO. They file the NDA. That makes the EA a natural early warning point. Train them to flag new public company names to compliance the day those names appear.
What Does the SEC Find When It Examines Codes of Ethics?
The SEC’s April 2022 risk alert on Section 204A and Rule 204A-1 remains the clearest map of exam findings. Staff reported that:
- some advisers failed to identify certain employees as access persons
- some codes failed to define access persons accurately
- access persons bought into IPOs and limited offerings without pre-approval
- some codes lacked the required pre-approval provision
- some advisers could not show that access persons submitted their reports
- some advisers could not show any review of the reports they received
- some CCOs reviewed their own reports, with no one else assigned
Every one of those findings can involve an executive assistant. An unclassified EA, an unreviewed report or a missed pre-approval all show up the same way in an exam.
The SEC’s fiscal 2026 examination priorities, released in November 2025, keep the focus on fiduciary duty and the effectiveness of compliance programs. They also prioritize never-examined and newly registered advisers. A newly registered private fund adviser with a fresh EA hire fits that profile exactly.
Compliance teams know the pressure. The 2025 Investment Management Compliance Testing Survey from ACA Group and the Investment Adviser Association drew responses from 577 adviser firms. Firms reported more testing across the board, with artificial intelligence ranked as the top compliance concern. Personal trading oversight still sits underneath all of it, because one missed report can anchor a deficiency letter.
How Do the Rules Differ for Private Equity and Venture Capital Advisers?
Registration status decides which rules apply.
| Adviser type | Rule 204A-1 code of ethics | Section 204A MNPI policies |
|---|---|---|
| SEC-registered investment adviser | Required | Required |
| Exempt reporting adviser (venture capital exemption, Section 203(l)) | Not required | Required |
| Exempt reporting adviser (private fund adviser exemption, under $150 million in US private fund assets, Rule 203(m)-1) | Not required | Required |
| State-registered adviser | Check state rules; many states have similar code requirements | Required |
Section 204A of the Advisers Act requires every adviser subject to Section 204, including exempt reporting advisers, to keep written policies that prevent the misuse of MNPI. So even a VC firm outside Rule 204A-1 needs rules for what its EA can trade.
Many exempt reporting advisers adopt a full code of ethics anyway. Institutional LPs ask for one during operational due diligence. A firm that plans to register later also saves work by building the program early.
Registered advisers face one more data rule. The amended Regulation S-P requires registered advisers to run an incident response program and notify affected individuals after certain data breaches. Larger advisers had to comply by December 3, 2025, and smaller advisers by June 3, 2026. An EA with LP data in their inbox sits inside that program too, so set up vetting, NDAs and data security before day one.
How Should a CCO Onboard a New EA Under the Code of Ethics?
Use this 10-step plan for every new executive assistant, in-house or remote.
- Classify the role. Map the EA’s actual system access and decide whether they count as an access person. Write down the reasoning.
- Cover contractors by contract. For a non-employee EA, add code of ethics obligations to the engagement agreement.
- Deliver the code. Send the code and collect a signed acknowledgment of receipt, as Rule 204A-1 requires.
- Collect the initial holdings report. Get it within 10 days of the start date, with data no more than 45 days old.
- Connect broker feeds. Link US accounts to the compliance system. Collect statements by hand for foreign accounts.
- Train on pre-clearance. Walk the EA through the request process, the IPO and limited offering rule, and the restricted list.
- Train on MNPI. Explain what MNPI looks like in the EA’s daily work: target names, deal code names, IC outcomes.
- Set access by role. Grant only the folders and systems the EA needs. Use delegated inbox access and two-factor authentication.
- Calendar the reports. Add the quarterly transaction deadline and the annual holdings date to the EA’s calendar.
- Keep the records. Rule 204-2 requires advisers to keep the code, acknowledgments, access person lists, reports, approvals,s and violation records, generally for five years.
Our executive assistant for financial advisors page shows how registered advisers set up compliant support roles in practice.
Which Mistakes Put an EA Outside the Code of Ethics?
Watch for these common gaps:
- The title trap: The firm classifies by title and skips “assistants.” The SEC looks at duties.
- The contractor gap: The firm covers employees and forgets the remote contractor with full inbox access.
- The household miss: The EA reports their own account and forgets a spouse’s account.
- The private deal blind spot: The EA invests in a friend’s startup round without pre-approval.
- The self-review loop: The CCO’s own EA files reports that nobody reviews independently.
- The foreign account delay: Manual statements from overseas brokers arrivelatee and nobody chases them.
- The stale classification: An EA moves from office support to deal support, and the access person list never changes.
Each mistake has a simple fix: classify by duties, cover contractors by contract, and review the access person list every quarter.
Frequently Asked Questions
What is an access person in a code of ethics?
Under Rule 204A-1, an access person is a supervised person of a registered adviser who has access to nonpublic information about client trades or reportable fund holdings, or who makes or sees nonpublic securities recommendations. The rule also presumes that directors, officers and partners of a firm whose primary business is advice count as access persons.
Is an executive assistant an access person?
An executive assistant counts as an access person when their duties give them access to nonpublic trade, holdings or recommendation information. The SEC’s 2004 adopting release says administrative and clerical staff may be access persons for that reason. Most EAs who support investment professionals meet the test, including an executive assistant at a VC firm.
What reports does an access person file?
An access person files an initial holdings report within 10 days of becoming an access person, an annual holdings report at least every 12 months, and a quarterly transaction report within 30 days after each calendar quarter ends.
Do access persons need to pre-clear every trade?
Rule 204A-1 requires pre-approval only for IPOs and limited offerings. Many firms require pre-clearance for all trades in reportable securities as a stricter internal policy.
Does the code of ethics rule apply to exempt reporting advisers?
No. Rule 204A-1 applies to SEC-registered advisers. Exempt reporting advisers must still keep written policies under Section 204A that prevent the misuse of material nonpublic information, and many adopt a full code of ethics for their LPs. Pair those policies with clear vetting, NDA and data security rules for every assistant.
Hire an EA Who Is Ready for Your Code of Ethics
An executive assistant sees the same information your partners see. Treat the role that way from day one. Classify the EA, collect the reports, train them on pre-clearance, and keep the records.
Exec Assistants recruits experienced remote executive assistants from the Philippines and South Africa, and you hire your EA directly. That lets you write your code of ethics, NDA, and data access rules straight into the agreement. See how we place a compliance-ready EA for private equity, or book a free consultation.