The Conventional Wisdom
Most compliance teams treat Form ADV filings as a simple task. You verify the firm has an active SEC registration number, confirm it appears in the Investment Adviser Public Disclosure database, and move on. If the SEC accepted the filing, the firm must be legitimate, right?
This mindset isn't limited to investment advisers. Across compliance functions, regulatory registration is often seen as a proxy for legitimacy. A firm files the right form, pays the fee, and gets a confirmation number. That's considered enough due diligence for onboarding, partnership reviews, and vendor assessments.
Why This Approach Is Incomplete
The SEC recently charged 38 firms with filing false information in their Forms ADV to create a misleading impression of legitimacy. These weren't sophisticated hackers. They simply submitted forms with falsehoods, and the system accepted them.
One firm, Pinnacle Crypto, even created a fake certificate of its SEC registration status. Despite typos and formatting errors, it convinced investors that regulatory oversight equaled regulatory approval.
This should alarm every compliance officer: these cases follow similar charges from late 2025. In one instance, SEC staff visited an address listed on a Form ADV and found the firm claimed to occupy the 52nd floor of a building. That floor was mechanical space with no tenants.
The issue isn't the SEC's filing system. It's the assumption that "filed a form" means "passed scrutiny." The SEC doesn't verify most Form ADV data at the time of filing. It accepts the submission, assigns a number, and investigates later if concerns arise.
Your verification process assumes the SEC has already done the work you're skipping.
The Evidence
The 38 fraudulent firms shared patterns that should have been detectable:
- All claimed to use "Indicator Global" as their private fund auditor.
- They reported gross asset values of either $78,960,522 or $48,960,522.
- They claimed either 89 or 33 investors.
These weren't random. They were copy-paste jobs with minimal changes. The SEC's Office of Investor Education and Assistance issued an alert warning that scammers use filings to create false legitimacy, especially targeting Exempt Reporting Advisers who claim to offer investment advice directly to individual investors.
Consider your own verification procedures. Would you have caught these patterns? Most compliance teams check:
- Does the CRD number exist?
- Does the filing show any disciplinary history?
- Does the AUM figure seem reasonable?
None of these checks would flag identical asset values across unrelated firms or a non-existent auditor name. You're not looking for consistency across the database because you assume someone else already did.
What to Do Instead
Stop treating Form ADV verification as a binary check. Build a verification protocol that assumes the filing could be fraudulent:
Cross-reference Claimed Relationships. If a firm lists an auditor, custodian, or prime broker, verify that relationship independently. Call the service provider. A two-minute phone call would reveal that "Indicator Global" doesn't exist or doesn't have these firms as clients.
Flag Statistical Outliers. If you're evaluating multiple adviser relationships, compare their reported metrics. Identical AUM figures, investor counts, or fee structures across supposedly independent firms warrant investigation. Use a simple spreadsheet to highlight these patterns.
Verify Physical Presence. For material relationships, confirm the firm exists at its listed address. This doesn't require site visits for every vendor. But if you're entrusting client assets or sensitive data to an adviser, verify they occupy real office space, not a virtual mailbox or a mechanical floor.
Question Direct-to-Retail ERAs. The SEC's investor alert specifically warns about Exempt Reporting Advisers offering direct investment advice to individuals. Most legitimate ERAs are venture capital funds or private equity firms with institutional investors. If an ERA is soliciting retail clients, that's a red flag requiring deeper diligence.
Automate Pattern Detection. If you regularly evaluate investment advisers, vendors, or partners who file with the SEC, build queries that flag common fraud indicators. The SEC will likely publish additional patterns as it reviews the Form ADV database for firms matching the profile of these 38 cases.
When the Conventional Wisdom Is Right
Form ADV verification still matters as a baseline control. Confirming that a firm has filed required disclosures, checking disciplinary history, and reviewing the nature of their business remains essential due diligence.
For low-risk relationships, a standard IAPD check may be sufficient. If you're evaluating a large, established registered investment adviser with public audited financials and a long operating history, the risk of a ghost filing is minimal.
The conventional wisdom breaks down with newer firms, those with limited public information, or relationships involving material risk. That's when verification needs to go beyond confirming the form exists.
The SEC's enforcement actions don't mean every Form ADV filing is suspect. They mean the filing itself isn't verification. It's the starting point for verification.
Your compliance program should reflect that distinction. Otherwise, you're outsourcing your due diligence to a system that never promised to do it for you.
