Nobody calls us excited about their upcoming NFA exam. The notice shows up, and suddenly a fund manager who’s been heads down running the business has four to six weeks to account for years of trading activity, AML work, marketing materials, and supervisory decisions.

What trips most firms up isn’t bad compliance. It’s disorganized compliance. Policies live in three different folders. The CCO who wrote the AML procedures left two years ago. Someone updated the disclosure document, but never circled back to the supervisory checklist. 

None of this means you’re doing anything wrong, but examiners can only evaluate what you put in front of them.

So before the prep turns into late nights and frantic messages to your ops team, it’s worth knowing what the NFA actually wants to see. The NFA exam checklist below is what we walk our clients through when that email lands.

Start With the Same Checklist NFA Uses

The fastest path to readiness isn’t a custom prep doc built from scratch. It’s the work NFA already asks every member to do each year. The Self-Examination Questionnaire is an open-book preview of what examiners request, and NFA’s 2026 webinar said as much out loud. Firms that take it seriously walk into an exam with most of the answers already organized.

Annual basics to confirm before anything else:

_____ The Member Questionnaire reflects how the firm operates today, not two strategy pivots ago.

_____ The Annual Registration Update went in on time.

_____ The Self-Examination Questionnaire was completed this year, with evidence of review retained.

_____ A signed attestation from an appropriate supervisory person sits in the file.

_____ An internal NFA exam readiness folder exists, organized around the same categories the self-exam covers.

Organize Books, Records, and Filings Before They’re Requested

Forms tell NFA what the firm says. Records tell NFA what the firm did. Recreating the match between them on a two-week deadline is where most deficiency letters quietly start.

Records and retention:

_____ Five years of records retained, two years readily accessible.

_____ Support for NAV, capital activity, fees, expenses, and performance retrievable in minutes.

_____ Reconciliation between books and reported figures, current and documented.

Reporting cadence:

_____ Account statements are distributed on time. Monthly for pools over $500,000 NAV, quarterly where permitted.

_____ Annual Reports distributed and filed on time, or valid extensions filed before the deadline.

_____ Form PQR filings submitted within 60 days of quarter-end, where required, with support retained.

_____ Margin calls, redemption halts, and defaults reviewed against Rule 2-50 notice obligations.

If confirming any of those takes a phone call, that’s the first thing to fix.

Reconcile Disclosure Documents With How the Fund Operates

The disclosure document describes how the fund is supposed to run. The job here is to confirm it still does. Start with the document itself, then go line by line against the current practice and look for daylight between the two.

Document status:

_____ NFA has accepted the current disclosure document.

_____ The document is no more than 12 months old if still being used to solicit.

_____ Material changes since the last review have triggered amendments.

Economics:

_____ Fees charged to investor accounts match the methodology in the document.

_____ Break-even analysis holds up against what the fund actually spends now.

Operations and structure:

_____ Strategy, liquidity terms, and service providers match practice.

_____ Ownership, conflicts, major CTAs, investee pools, and counterparty relationships are disclosed accurately.

Investor-facing materials:

_____ Pitch deck, website, and offering materials tell investors the same story the document does.

_____ Marketing collateral has been refreshed against the latest amended document, not an older version.

_____ For funds with digital asset commodity exposure, Rule 2-51 reflected in both the disclosure document and supervisory procedures.

Anything that doesn’t match is either an amendment that needs to be filed or a practice that needs to be corrected. Both are easier to handle now than under a document request.

Pressure-Test Supervision and Outsourced Oversight

Supervision is what an exam quietly tests for the longest. Three areas carry most of the weight, and they fail in different ways.

Supervisory Procedures Against the Current Business

When did anyone last open the supervisory file? Most firms can’t answer in months. That’s the problem.

Drift items to fix:

_____ No desks listed that have closed.

_____ No vendors listed that have been replaced.

_____ Approval chains reflect the current org chart, not three reorgs ago.

_____ No named titles or roles that no longer exist.

Ownership and escalation:

_____ Approval, review, and exception handling have clearly named owners.

_____ The escalation path for overridden controls is written down, not held in institutional memory.

Internal Controls That Hold Up Under Pressure

Controls fail quietly, whether it’s a reconciliation that nobody’s questioned in six quarters, an approval that’s become a rubber stamp, or a conflict policy that hasn’t been tested against an actual conflict. 

Five areas where exam findings concentrate:

_____ Valuation controls catch real problems in real time.

_____ Expense approval requires a meaningful review, not a rubber stamp.

_____ Cash movement controls have a separation of duties and documentation.

_____ Investor reporting reconciles to the books before it goes out.

_____ Conflict policies have been tested against actual conflicts.

4.7 relief, where applicable:

_____ Current support for investor qualification retained.

_____ Current support for trading-limit compliance retained.

Oversight of the Vendors and Offices Outside the Firm

The administrator runs the books. The tech vendor holds the data. The compliance provider answers the regulator. None of them work for you, and all of them sit inside the firm’s regulatory perimeter.

Match records to the current vendor list:

_____ Due diligence files for every current provider.

_____ Ongoing monitoring records are up to date.

_____ Termination procedures and offboarding documentation are in place.

_____ Annual onsite inspection reports for any branch offices.

Prove the Firm Can Withstand a Disruption

Supervision covers your normal days. This last piece of the checklist covers the bad ones, and it’s where exams find some of the easiest deficiencies to fix. Cybersecurity training, ISSP annual review, ethics training, and self-exam completion show up on NFA’s recent lists of commonly overdue items, which means they’re also the easiest to clean up before an examiner asks.

When Something Goes Wrong

Your BCDR plan should be written for your firm, not a template with the name swapped in.

Plan and contacts:

_____ BCDR plan reflects the systems, vendors, and locations you actually use.

_____ NFA emergency contacts are current and hold real decision authority.

_____ Disaster recovery plan tested in the last year, and the test fully documented.

_____ ISSP was reviewed within the last 12 months.

_____ Incident response and regulatory notice procedures match what NFA expects today.

When People Need to Know What to Do

Training and policy distribution are the items that quietly age out, because nobody’s tracking them until somebody asks.  

Training and policy records:

_____ Cybersecurity training delivered at hire and at least annually, with attendance records retained.

_____ Ethics training records are complete and dated.

_____ Privacy policy is distributed everywhere the rules require it.

A Cleaner Exam Starts Long Before the Notice Arrives

If there’s one thing decades of sitting across the table from NFA examiners have taught us, it’s that the firms that come through cleanest aren’t the ones who prepared hardest in the final two weeks. They’re the ones whose disclosures matched their fee schedules in March, whose supervisory procedures still described the actual desk in July, and whose PQR support was already in a folder by October. By the time the notice arrives, the work is mostly behind them. 

That’s the standard we hold ourselves to at Michael Coglianese, CPA, P.C., and it’s the standard we help our clients build toward, whether it’s audit and assurance, tax preparation, fund accounting, NFA regulatory compliance consulting, or mock audits that find what a real one would. We’ve been doing this long enough to know which findings keep showing up year after year, and long enough to know how to keep them out of your file.

If you want a sharper read on where your firm stands before the next exam letter lands, reach out. We’ll tell you what we see, and we’ll help you fix what needs fixing while it’s still routine work.