RIA and wealth management technology stack 2026: what a $500M–$10B AUM firm should actually procure after the Envestnet take-private and the Marketing Rule enforcement wave.

The RIA technology stack in 2026 is defined by three structural facts. Bain Capital closed its $4.5 billion take-private of Envestnet on November 25, 2024, converting the largest wealth-tech provider from a public company with quarterly disclosure to a private company with sponsor-defined roadmap cadence. Altruist launched Altruist Clearing as a self-clearing brokerage and announced Altruist Advisors as a corporate RIA, giving mid-market firms a genuinely new third custody option alongside Schwab and Fidelity. And the SEC's May 2024 Regulation S-P amendments became compliance-live in two waves — December 3, 2025 for Larger Entities and June 3, 2026 for Smaller Entities — placing written incident response and service-provider oversight on a hard calendar. A firm sitting between $500 million and $10 billion in AUM should decompose the stack into six layers — custody, portfolio accounting and performance reporting, CRM, rebalancing, financial planning, compliance and archiving — and score each independently against those 2026 realities. What breaks: firms that treat "one throat to choke" as a procurement principle end up with the wrong platform in three of six layers.

Envestnet under Bain is a roadmap-risk question every firm on Tamarac or MoneyGuide has to answer in 2026.

Bain Capital's acquisition of Envestnet closed at $63.15 per share on November 25, 2024, with Reverence Capital and Norwest also participating and BlackRock, Fidelity Investments, Franklin Templeton, and State Street Global Advisors taking minority positions. The company delisted from the New York Stock Exchange in line with the transaction. The immediate effect for an RIA on Envestnet | Tamarac or Envestnet | MoneyGuide is not product change — the platforms continue — but disclosure change. Public-company reporting cadence gave RIAs a passive read on roadmap direction, capital allocation, and management stability. Private-sponsor ownership does not. A 2026 RFP that includes Envestnet should require sponsor-side disclosure of the product roadmap horizon under current ownership, contractual data-portability rights that survive further change-of-control, and a defined migration-cost model for a firm that decides in year three to leave. This is not an argument against Envestnet — Tamarac remains a legitimate enterprise all-in-one for mid-to-large RIAs, and MoneyGuide is a large-installed-base financial planning platform. It is an argument for making the underwriting explicit.

Custody has three defensible mid-market paths in 2026, and the third is new.

Schwab Advisor Services custodies for roughly 7,500 RIAs and carries the largest RIA AUM position in the market. It ships iRebal as a free rebalancing engine to custodian firms and its Schwab Advisor Center platform is the workflow surface most sub-custody integrations point at. Fidelity Institutional's Wealthscape supports about 3,300 advisory firms, ships Fidelity Managed Account Xchange (FMAX) as its managed-account architecture, and pairs strong proprietary tools with a broad open-integration surface. The third path is Altruist. The company reports 4,900+ advisors, launched Altruist Clearing as its own self-clearing brokerage, and announced Altruist Advisors as a corporate RIA. For a firm sitting below $500 million in AUM and building on modern integrations, Altruist is a defensible primary custody choice. For a firm sitting between $500 million and $5 billion already on Schwab or Fidelity, the switching cost is a 12- to 24-month operational program with client-communication risk that has to be sized honestly. BNY Mellon Pershing, Raymond James, and Goldman Sachs remain relevant to specific firm profiles, particularly where broker-dealer affiliation or private-banking adjacency matters.

Portfolio accounting sorts by asset complexity, not by "best-of-breed."

The choice between Orion Advisor Solutions, Envestnet | Tamarac, SS&C Black Diamond, Addepar, and Advyzon is genuinely a fit question. Orion runs as an integrated all-in-one, owns Redtail CRM (acquired in 2022), has been building agentic tooling under the Denali label, and reported roughly $5.6 trillion in assets under administration and $124 billion in wealth management platform assets as of September 30, 2025. Tamarac is the enterprise all-in-one option now under Bain ownership. Black Diamond sits inside SS&C, integrates natively with RightCapital for planning, and reported that its Black Diamond TAMP had exceeded $2 billion in assets by mid-2026 after a growth year following launch. Addepar is the answer when the portfolio includes meaningful alternatives, multi-entity structures, or high- and ultra-high-net-worth complexity that generalist reporting engines flatten. Advyzon runs as all-in-one for small and mid RIAs with an embedded rebalancer (Quantum) and has been recognized in T3 / Inside Information's software survey for client satisfaction. The 2026 procurement pattern is to define asset-complexity tier first, then map to platform, rather than picking the platform and re-shaping the book to fit.

The CRM decision separates on per-seat economics and native custodian integration depth.

The RIA CRM field has consolidated to four defensible choices for a mid-market firm. Redtail — now inside Orion — remains the most-installed RIA CRM and integrates natively across the Orion stack. Wealthbox, positioned at roughly $59 to $99 per user per month depending on tier, ships native single sign-on to Schwab Advisor Services, Fidelity Wealthscape, and LPL ClientWorks and includes an AI notetaker in the platform rather than as a separate line item. Salesforce Financial Services Cloud, positioned at roughly $150 to $200 per user per month before AppExchange and Agentforce add-ons, is the option when a firm is going to build materially custom workflows or needs to unify wealth CRM with a broader enterprise data model. Practifi extends Salesforce specifically for wealth practice management and is the choice when Salesforce is the enterprise standard but the RIA needs a wealth-specific overlay. The 2026 disciplined selection question is not which CRM is best — it is which CRM the firm can operationalize with the per-seat cost, integration surface, and workflow customization budget it actually has.

Rebalancing is downstream of the custody choice, not upstream.

The rebalancing tool decision follows custody. Schwab custodian firms have iRebal available effectively free and it remains a strong raw rebalancing engine. Salesforce-heavy shops that also use Tamarac get the Envestnet | Tamarac Rebalancer inside a single vendor relationship. RedBlack is the choice for family-office and large-RIA books with OMS complexity or heavy alternative-asset allocations. Advyzon Quantum is embedded in the Advyzon all-in-one and is the default for firms already on that platform. Michael Kitces' comparison work on rebalancing tools remains the standard practitioner reference, and it documents an operational shift most recently: rebalancing software adoption has moved from roughly half of firms in 2020 to roughly 82 percent today. That shift means the RFP question is no longer "should we buy rebalancing software" but "which rebalancing engine matches the custody, portfolio-complexity, and CRM stack we already have," and the answer is almost never solved by whichever platform the current portfolio-accounting vendor bundles.

Reg S-P's June 3, 2026 compliance date changed what compliance archiving must actually cover.

The SEC adopted the Regulation S-P amendments in May 2024. The compliance calendar was tiered: Larger Entities — fund complexes with net assets of $1 billion or more in AUM and registered investment advisers with $1.5 billion or more in AUM, plus most broker-dealers with capital above $500,000 — had a December 3, 2025 date. All other covered institutions had a June 3, 2026 date. FINRA's November 2025 cybersecurity advisory reminded firms of the timeline. The substantive requirements are the written incident response program, notification to affected individuals when a breach has occurred or is reasonably likely to have occurred, enhanced oversight of service providers, and recordkeeping proving compliance. For a Smaller Entity RIA that had been managing cybersecurity as an informal practice rather than a documented program, the June 3 date has passed — and the compliance-archiving vendor conversation now has to cover written incident-response artifact production, not just message capture. Global Relay competes hardest on unified capture across email, IM, Microsoft Teams, Slack, Bloomberg, and voice on a single index; MyComplianceOffice, Smarsh, and Compliance Solutions Strategies each cover overlapping but distinct pieces of the compliance surface.

Marketing Rule enforcement makes testimonial and off-channel surveillance a live 2026 RFP line item.

The SEC Division of Examinations published a Marketing Rule Risk Alert in December 2025, and the staff's Marketing Compliance Frequently Asked Questions remain the working reference for Rule 206(4)-1. Together they set the enforcement posture for 2026: testimonials, endorsements, and third-party ratings continue to be an examination priority, and disclosures must be "clear and prominent." Reg BI and Form CRS exam findings, catalogued in FINRA's 2025 Annual Regulatory Oversight Report, remain in the examination priority set even as broader enforcement volume has been debated in industry coverage. The practical implication for a 2026 compliance-technology RFP is that any archiving or surveillance vendor should be scored on how it surfaces testimonial and endorsement disclosures for review — not only on whether it captures the underlying communications — and on how completely it covers off-channel surfaces where advisor testimonials tend to accumulate. A firm that archives email but not Teams, Slack, Bloomberg, or SMS is not evidencing the Marketing Rule surveillance a 2026 examiner will ask for.

What breaks: one-throat-to-choke, Altruist migration overhead, off-channel gaps.

"One throat to choke" over-collapse. A firm that buys Orion end-to-end (portfolio accounting, Redtail CRM, Denali tooling, planning integration) or Envestnet end-to-end optimizes for vendor-relationship simplicity but ships three of six layers at sub-optimal fit. The disciplined pattern is to score each layer independently and accept integration cost where best-of-layer justifies it. Altruist migration cost underestimation. Altruist's speed advantage is real for firms below $500 million already on modern integrations. For firms in the $500 million to $5 billion tier already on Schwab or Fidelity, the switching decision is a 12- to 24-month program with real client-communication and reconciliation risk. Off-channel communications gap. Advisors move business conversation to whatever channel the client uses. A compliance-archiving posture that covers email and not Teams, Slack, Bloomberg, or SMS produces a surveillance gap that is now a live examination finding, not a theoretical risk.

What this means for procurement in 2026.

The 2026 mid-market RIA procurement implication is executable. First, decompose the stack into the six layers before running any RFP and score each layer against the firm's actual asset mix, workflow, and roadmap tolerance. Second, if any layer of the current stack is Envestnet-owned, add explicit sponsor-side disclosure and change-of-control questions to the renewal cycle. Third, size Altruist as a defensible third custody path for firms below $500 million and as a 12–24 month migration program for firms above. Fourth, close the Reg S-P written incident-response gap for any firm that missed either the December 3, 2025 or June 3, 2026 date. Fifth, add off-channel communications capture — Teams, Slack, Bloomberg, SMS — to the compliance-archiving specification, and score vendors on testimonial and endorsement surveillance, not only capture completeness. The 2026 examination cycle is not the year to run a rolled-over compliance stack.

This is the seventh piece in the Financial Services Analyst Note series. The anchor is How mid-market financial services operators should source technology contracts in 2026. Every vendor named here is in The Cardinal Source's active supplier pool.

Sources

• Envestnet Newsroom, "Bain Capital Completes Acquisition of Envestnet" (November 25, 2024). newsroom.envestnet.com
• Envestnet, "Bain Capital Acquires Envestnet in Take-Private Transaction." envestnet.com
• SEC, Division of Investment Management, "Marketing Compliance Frequently Asked Questions" (Rule 206(4)-1). sec.gov
• FINRA, "Cybersecurity Advisory — SEC Regulation S-P Compliance Date Reminder" (November 14, 2025). finra.org
• FINRA, "Cybersecurity Advisory — SEC Amends Regulation S-P." finra.org
• SEC, "Regulation Best Interest and Form CRS." sec.gov
• FINRA, "Reg BI and Form CRS" (2025 Annual Regulatory Oversight Report). finra.org
• Schwab Advisor Services. advisorservices.schwab.com
• Fidelity Institutional. institutional.fidelity.com
• Altruist. altruist.com
• Orion Advisor Solutions. orion.com
• SS&C Black Diamond Wealth Solutions, In the News. sscblackdiamond.com
• Addepar, Wealth Management product page. addepar.com
• Advyzon, T3 2026 news page. advyzon.com
• Global Relay, Recordkeeping Compliance. globalrelay.com
• Kitces, "Comparing the Best Portfolio Rebalancing Software Tools." kitces.com

All linked sources were live at time of publish (July 2026). Verify before quoting in a procurement document.