Invoking /compliance, or handing Claude a draft to check, is already the go-ahead — begin the review, don't ask whether to start.
Work through references/sec-compliance-checklist.md (in this skill's folder) systematically. Summary of the passes:
Passes 2 and 3 go to the claude-for-financial-advisors:compliance-scan subagent — Agent(claude-for-financial-advisors:compliance-scan). Hand it the content verbatim, the context you gathered (audience, channel, firm type, whether performance/testimonials/ratings/hypotheticals appear), and the absolute path to references/sec-compliance-checklist.md — the subagent's working directory is the session's, not this skill's, so a relative path won't resolve for it. It returns its own advertisement determination — reached independently, from the checklist and the content, not from anything you concluded in Pass 1 — plus the flagged passages quoted verbatim with rule, severity, and reasoning, which disclosure categories the content triggers, and which checks came back clean. Where its determination and your Pass 1 call disagree, yours governs the review — Pass 4's markup and the disclosure language are yours to write, so the call that drives them is yours to make — but never let the difference pass unremarked: note it in the analysis file, and treat the disagreement as one more reason to escalate to the CCO.
Pass 4 stays with you, all of it. The subagent finds and cites; it never rewords, never drafts disclosure language, and never redrafts. The suggested rewording column, the required-disclosure language, and the clean redraft that preserves the author's voice are the parts that need judgment about this firm and this author, and they are the reason this skill exists. Read the scan, then write the markup yourself — and check the flags rather than transcribing them: a severity you disagree with is yours to change.
Once the scan comes back, resolve what it can't reach itself — compliance-scan only has Read/Grep/Glob, so any check that needs a live connector is yours to dispatch, not its:
- A testimonial or endorsement is present.
ToolSearch by the CRM's own name; if its tools come back it is callable, which is the check that decides. ListConnectors (load via ToolSearch if needed) only explains a gap — read enabledInChat rather than connected there, and treat an empty result as unknown, never as "no CRM". If a CRM is usable, dispatch one claude-for-financial-advisors:compliance-lookup subagent per named author (lookup type identity) — all in a single message if there's more than one. Hand each the one system it is to query, named (the CRM whose tools came back), and the author as the content names them — asking for client vs. non-client status, relationships to other households, and anything bearing on compensation or conflicts. Fold what comes back into Pass 3's disclosure requirements below. If no CRM is connected, follow the Connector Placeholder Convention and ask the advisor who the reviewer is to the firm — never assume an author is unrelated just because nothing surfaced.
- The scan flagged a material claim of fact as unsubstantiated (Pass 2, item 2) and it's checkable. If a portfolio system (Addepar, Orion, etc.) is connected and plausibly holds the comparison data, dispatch one
claude-for-financial-advisors:compliance-lookup subagent per checkable claim (lookup type claim) — batched into one message when there's more than one. Hand each the one system it is to query, named (the portfolio system whose tools came back), and the claim verbatim with what data would settle it. Cite what comes back (contradicts, supports, or can't determine) in the verdict table rather than only flagging that the claim needs substantiation. Check against the actual population the claim is about — a claim about "clients in situations like hers" is checked against comparable households, not against the one client the piece is already about; citing that client's own number back at her own claim isn't verification. If no portfolio connector is connected, fall back to demanding substantiation as usual.
The passes, which are also what to work through by hand if the subagent is unavailable:
Pass 1 — Is it an "advertisement"?
Determine whether the content falls under Marketing Rule 206(4)-1, using the Scope Determination test in references/sec-compliance-checklist.md: a direct or indirect communication to more than one person offering advisory services is an advertisement; a communication to one or more persons is an advertisement if it includes hypothetical performance, unless it answers an unsolicited request or goes to a private fund investor one-on-one; and any compensated testimonial or endorsement (cash or non-cash) is one whatever the audience size. The checklist's Scope Determination section states three exclusions: extemporaneous live oral communications, information in regulatory filings, and most one-to-one communications carrying no hypothetical performance — a reply to a client's or a prospect's own question, say. Antifraud rules under Section 206 still apply to everything, advertisement or not.
Pass 4 — Build the markup
Produce three things, written into the two plain-markdown files below — nothing heavier by default:
A. Verdict table — each flagged passage:
| # | Passage | Rule / issue | Severity (Fail / Flag / Note) | Suggested rewording |
|---|
Two things send a passage to the CCO before anything goes out, and they are independent: a Fail rating, and a topic — performance, hypothetical performance, or a testimonial — whatever severity that passage was rated (Pass 3). Say which trigger applies against each such passage, in the table and in the chat summary, so the advisor sees every reason the piece is going up rather than one escalation for the piece as a whole. A piece with a Fail and a testimonial carries two escalations; naming only the second reads as though the Fail could go out once the disclosure is fixed.
B. Required disclosures — the specific disclosure language the piece needs (performance disclosures, testimonial disclosures, firm disclaimer), positioned where they must appear. Write the language itself, ready to paste — including when none of the standard categories is triggered and the only disclosure the redraft needs is general risk language. A sentence describing what disclosure is needed is not a disclosure; the advisor has to be able to copy this section, not act on it.
C. Clean redraft — the full content rewritten so that every flagged passage is addressed, preserving the author's voice as much as possible. Describe it that way, in the files and in the chat: it addresses the issues identified in this review. It is not content that has been found compliant — nobody with the authority to make that finding has read it yet — so never call the redraft, a rewording, or the reviewed piece "compliant" or "SEC-compliant".
