What documents does a buyer need to acquire a financial advisory practice?
A buyer acquiring a financial advisory practice needs Form ADV, three to five years of financials, anonymized AUM by household before the LOI, fee schedules, client age and concentration, attrition, exam letters, the compliance manual, the cybersecurity program, and custodian reports.
Named households wait for confirmatory diligence. The buyer’s own request list controls; have counsel review the cut. No law firm publishes a 24-file list.
RIA buyer document index (definition). The numbered evidence file behind one advisory-practice sale.
It proves the ADV matches the books, AUM is anonymized until confirmatory diligence, and the cybersecurity program is in the room.
A generic company-sale checklist is not this index.
The index, sourced, not a vendor list
Advisor Legacy’s advisory-firm due diligence checklist (retrieved 2026-10-01) runs four workstreams: financial, operational, legal, and compliance. It does not publish a file count. DealFlow OS publishes a software checklist for a wealth-management acquisition; it is not counsel. Kitces (22 November 2023) tells the seller to anonymize nonpublic personal client information until later. The general company-sale version of this index is what should be in a sell-side data room index. A registered investment adviser (RIA) sale adds Form ADV, household AUM, exam letters, custodian reports and advisor non-solicits, and it blinds the households until confirmatory diligence. How to share those files is how to share client data with an RIA buyer during due diligence. How to strip names is how to anonymize client data when selling a wealth management firm.
| Put this | Why it is in the index | Where the norm is written |
|---|---|---|
| Form ADV Parts 1, 2A and 2B | The firm's public regulatory record. Buyers reconcile disclosures against the books. | DealFlow OS: pull current Form ADV Parts 1 and 2A/2B |
| Three to five years of financials, plus tax returns | Income statements, balance sheets and cash flow, and the tax returns that go with them. | Advisor Legacy: 3-5 years of statements and tax returns |
| AUM by household, anonymized before the LOI | The number the buyer underwrites. Names wait. | Kitces, November 2023: household AUM, identity redacted |
| Fee schedules and revenue mix | AUM fees versus planning versus commission. Recurring versus transactional. | Advisor Legacy: revenue by source, trailing 12 months |
| Client demographics: age, concentration, tenure | An aging book and a top-household concentration change the multiple. | DealFlow OS: client demographics and concentration |
| Attrition and retention | Whether the revenue stays after the founder steps back. | DealFlow OS: trailing 12-month retention |
| SEC or state exam file, deficiency letters | What the regulator already found. Undisclosed letters are a deal issue. | Advisor Legacy: regulatory exam reports |
| Compliance manual and written supervisory procedures | How the firm says it runs. Buyers test the file against the ADV. | Advisor Legacy: compliance manuals |
| Cybersecurity program | Buyers diligence the seller's own safeguards, not only the deal files. | SEC PR 2024-58: incident response program at the firm |
| Custodian reports (Schwab, Fidelity, Pershing) | The AUM schedule has to tie to the custodian's records. | DealFlow OS: verify reported AUM is accurate and fee-generating |
| Advisor agreements, non-solicits, employment, org chart | Who stays, who can walk with a book, who is key-person risk. | Advisor Legacy: org chart and employment agreements |
| Client consent and assignment provisions | How the book actually moves at close. Negative consent versus affirmative. | Kitces: chart the consent process before signing |
First-look, after LOI, keep out
First-look is what an NDA’d bidder sees with the ADV. After LOI is confirmatory sampling of identifiable files. Keep-out is what does not belong in the open tree. 17 CFR 248.15(a)(6) is the federal sale-or-merger exception; it belongs to the firm. Ask your compliance counsel. This page is not a template.
| Folder | First-look | After LOI | Keep out |
|---|---|---|---|
| Regulatory | Form ADV Parts 1, 2A, 2B | Exam file, deficiency letters, advertising file | A hoped-for no-comment letter that is not in hand |
| Financials | Three to five years of statements and tax returns | Monthly P&Ls, add-back support in Excel | A PDF of bank statements the QoE has to unwind |
| Households | Blind AUM, revenue, age band, concentration | A sampled named set for confirmatory testing | The anonymization key, and a raw CRM dump |
| People | Org chart, role list | Employment agreements, non-solicits | Employee SSNs in the open tree |
| Cyber and vendors | The cybersecurity program summary | Incident-response procedures, vendor list | A claim that the data-room vendor makes the firm compliant |
See What is Cashpian?, and pricing.
FAQ
Who decides the final document list?
The buyer's own diligence request list.
Advisor Legacy groups it into four workstreams: financial, operational, legal, and compliance.
Have counsel review the cut. This page is not a template.
When does Form ADV go in?
With the first-look packet, after the NDA.
Parts 1, 2A and 2B are the firm's public regulatory record.
Buyers reconcile them against the books and the exam file.
Why do buyers ask for the cybersecurity program?
They diligence the seller's own safeguards, not only the deal files.
Amended Regulation S-P requires an incident response program at the firm.
A room vendor with access to client information is a service provider the firm oversees. The firm stays responsible.
How does this index differ from a general company sale?
Household AUM, Form ADV, exam letters, custodian reports and advisor non-solicits sit here.
Named customers in a manufacturing sale are the analog of named households.
Blind the households until confirmatory diligence.
Sources
- Advisor Legacy, How Advisory Firms Prepare for Buyer Due Diligence, retrieved 2026-10-01. Four workstreams. Financials 3-5 years. Exam reports. Compliance manuals. Org chart and employment agreements.
- DealFlow OS, RIA Acquisition Due Diligence Checklist, retrieved 2026-10-01. Software checklist, not counsel. Form ADV, AUM schedules, demographics, retention.
- Kitces, 5 Important Legal Steps Of An RIA Sale, Merger Or Acquisition, 22 November 2023, retrieved 2026-10-01. Anonymize until later. Chart the client-consent process before signing.
- SEC, Press Release 2024-58, 16 May 2024, retrieved 2026-10-01. Incident response program at the covered institution. eCFR 17 CFR 248.15(a)(6).
If the files are already in a folder, grade which row they are on. Cashpian is a gated room for that packet. It is not a listing portal. It does not sell the company or run the deal.