The SEC’s 2026 examination priorities emphasize fiduciary duties, effective compliance programs, customer information protection, operational resilience, and oversight of emerging technology. For investment advisers, funds, and other regulated firms, preparation means connecting those priorities to actual business practices and documenting whether controls work.
This guide explains the published priorities, changes from 2025, and practical steps for compliance and technology teams. It also identifies questions to watch as the SEC develops its next examination agenda.
Status as of September 30, 2026: The SEC’s examination priorities index lists FY2026 as its latest publication. The 2027 outlook below is forward-looking analysis, not a summary of published 2027 priorities.
What Is an SEC Exam, and Who Can Be Examined?
An SEC examination is a regulatory review of a firm’s compliance with applicable securities laws and rules. The Division of Examinations uses these reviews to identify risks, assess compliance, and inform regulatory oversight.
Its examination responsibilities encompass SEC-registered investment advisers, registered investment companies, broker-dealers, and other market participants. The relevant review areas depend on the entity’s registration, activities, and obligations.
For investment advisers, selection and scope are risk-based. Factors can include registration history, previous examination findings, complaints or referrals, conflicts of interest, leadership changes, and access to client assets. Recently registered and never-examined advisers remain an explicit 2026 priority.
The examination process generally involves initial contact and document requests, review of records and interviews, follow-up requests, and communication of results. Findings may require a response and corrective action; serious concerns may be referred for enforcement consideration.
Examiners can review policies, disclosures, transaction records, compliance testing, and evidence of actual practices. The scope and timing vary. Firms should avoid assuming that a particular period without an examination establishes a predictable schedule or limits future review.
Xantrion’s guide to preparing for an SEC cybersecurity examination provides additional context for RIAs organizing their technology and security readiness.
What Are the 2026 SEC Exam Priorities?
The official FY2026 Examination Priorities report identifies areas the Division expects to emphasize. It’s a staff statement that creates no new legal obligations, and the listed priorities do not exhaust every possible examination topic.
Read the report through two lenses: the priorities specific to your firm type and the shared risks relevant to your operations.
Investment Advisers: Fiduciary Duties and Compliance Programs
For investment advisers, the SEC continues to emphasize advice consistent with fiduciary obligations. Review areas include financial conflicts, investment costs and characteristics, liquidity, risk, and best execution.
The report specifically identifies alternative investments such as private credit, complex products, and higher-cost investments. Recommendations to older investors and retirement savers also receive attention.
Private-fund practices remain relevant. Examples include allocations between funds and separately managed accounts, interfund transfers, newly launched funds, valuation, fees, and differential treatment through side letters. Dual registration, third-party access to client accounts, and acquisitions can introduce additional conflicts and operational complexity.
Compliance-program reviews can encompass marketing, valuation, trading, portfolio management, disclosures, filings, custody, and annual reviews. A central question is whether policies are implemented and enforced.
For firms that have changed their business model, products, or client base, the program should address current operations. A policy manual built for an earlier version of the business may leave significant activities inadequately supervised.
Funds, Broker-Dealers, and Other Market Participants
The priorities also address entity-specific responsibilities beyond investment advisers.
| Firm type | Principal review areas |
|---|---|
| Registered investment companies | Compliance programs, governance, fees and expenses, strategy disclosures, valuation and liquidity-related risks, and Names Rule compliance after applicable compliance dates |
| Broker-dealers | Net capital and customer protection, financial reporting, cash sweeps, trading and execution, Regulation Best Interest, and Form CRS |
| Self-regulatory organizations | Regulatory programs, oversight responsibilities, and risk-based reviews of FINRA and the MSRB |
| Clearing agencies | Financial and operational risk, liquidity, default management, recovery, and remediation of previous deficiencies |
| Municipal advisers | Fiduciary duties, conflicts, relationship documentation, filings, and supervision |
| Transfer agents and funding portals | Relevant safeguarding, recordkeeping, investor-fund arrangements, and Regulation S-P requirements |
| Security-based swap entities | Applicable transaction reporting, capital and margin controls, trading processes, and operational risk |
These are summaries of the report, rather than complete obligation lists. Each firm should map the relevant sections to its own registrations and activities.
For example, a broker-dealer evaluating cash sweep programs faces different questions from an adviser assessing private-fund allocations. Shared technology vendors do not make their regulatory responsibilities interchangeable.
Cybersecurity, Operational Resilience, and Customer Information
Cybersecurity remains a recurring SEC exam priority. The report identifies governance, data loss prevention, access controls, account management, ransomware response, recovery, and operational resilience.
It also explicitly addresses training and controls for risks associated with AI and polymorphic malware, including how firms use threat intelligence operationally. Relevant preparation includes determining whether warnings lead to concrete changes in monitoring, protection, or employee guidance.
Regulation S-P and Regulation S-ID require separate applicability assessments. Regulation S-P addresses customer information protection, including incident-response safeguards. Regulation S-ID concerns identity-theft prevention programs for covered accounts at entities subject to its requirements.
The SEC’s Regulation S-P compliance guide identifies December 3, 2025, for larger entities and June 3, 2026, for smaller entities as the amendment compliance dates. Both dates have passed as of this article’s status date. Covered institutions should be evaluating implemented controls, rather than treating readiness solely as a future project.
Use Xantrion’s Regulation S-P amendment compliance checklist to organize the technology and operational work alongside your compliance team’s interpretation of the rule.
AI, Automated Advice, AML, and Other Shared Risks
The report addresses automated investment tools, algorithms, and AI technologies. Examiners may assess whether representations are accurate, operations match disclosures, and automated recommendations are consistent with investor profiles and applicable obligations.
AI supervision extends beyond investment recommendations. The report identifies uses in fraud detection, back-office operations, AML, and trading, as applicable. Firms should understand where AI operates and how its use is monitored.
AML priorities apply to entities with relevant obligations, including broker-dealers and certain registered investment companies. Review areas include risk-based programs, independent testing, customer identification, suspicious-activity reporting, and relevant intermediary oversight. Sanctions compliance is also identified.
Importantly, FinCEN postponed the effective date of its investment-adviser AML rule from January 1, 2026, to January 1, 2028. That delay should not be confused with relief from separately applicable obligations.
Regulation SCI remains relevant to entities subject to that rule, with attention to incident-response effectiveness and third-party vendor systems. It’s not a universal requirement for every investment adviser.
What Changed From the SEC’s 2025 Examination Priorities?
The 2026 report changes some headings and adds detail, while retaining many longstanding themes.
| Topic | 2025 treatment | 2026 treatment | Practical interpretation |
|---|---|---|---|
| Private funds | Dedicated subsection on examinations of private-fund advisers | Private-fund issues appear within broader adviser priorities | Continue evaluating allocations, valuation, fees, and conflicts |
| Crypto assets | Standalone shared-risk section | No standalone crypto section | The omission does not establish an exemption from review |
| AI | Covered advisory use, representations, supervision, and data risks | Continues those themes and explicitly addresses AI-related cybersecurity threats | Evaluate both the firm’s use of AI and threats involving AI |
| Customer information | Addressed S-P and S-ID controls and S-P preparation | Discusses preparation and examination of implementation after compliance dates | Verify that required safeguards operate in practice |
| Fiduciary duties and compliance | Core adviser examination themes | Continue as central themes | Maintain focus on advice, conflicts, disclosures, and testing |
These observations reflect the wording and organization of the 2025 report and the published 2026 report. The practical interpretations are editorial guidance.
AI and cybersecurity were already covered in 2025. Describing them as entirely new 2026 priorities would overstate the change.
Similarly, removing a standalone heading does not eliminate applicable law or prevent examiners from reviewing the underlying activity. Private-fund matters remain expressly discussed in 2026. Firms should avoid using changes in report structure as a reason to discontinue relevant controls.
The more useful question is whether a wording change highlights an exposure your existing program hasn’t addressed.
What Do the Priorities Mean for Your Firm?
The following recommendations translate the published priorities into operational decisions. They’re preparation guidance, rather than additional SEC requirements.
Start by determining which priorities apply, who owns the relevant controls, and what evidence demonstrates their operation.
Match Your Compliance Program to Your Business
Your firm’s products, clients, registrations, technology, and business changes determine its exposure. Use those characteristics to guide reviews.
Consider an adviser adding private credit. Compliance and investment teams should evaluate how liquidity, valuation, costs, and conflicts affect recommendations and disclosures. Supporting records should explain how the firm assesses those considerations.
For a firm acquiring another practice, review inherited accounts, fee arrangements, applications, vendor access, and supervisory processes. Integration can create a gap between the combined firm’s written policies and the practices employees follow.
For a team adopting AI, identify the tool, permitted uses, data access, review requirements, and owner. Compare client-facing claims about AI capabilities with what the technology actually does.
These scenarios call for coordinated decisions. Updating a policy without changing access, training, or supervision may leave the underlying problem unresolved.
Treat financial services regulatory compliance as an ongoing process tied to business changes. Ask whether the program still reflects the firm’s current activities and whether the annual review has evaluated significant developments.
Connect Compliance, IT, and Vendor Responsibilities
Compliance teams interpret obligations and oversee the program. IT and security teams operate many controls and generate supporting records. Management assigns authority and resources. Vendors perform agreed services.
Document how those responsibilities connect.
| Team | Primary contribution | Evidence it can help assemble |
|---|---|---|
| Compliance leadership and counsel | Applicability, policy interpretation, disclosures, and examination coordination | Compliance reviews, policy approvals, disclosure testing, and documented decisions |
| Management | Accountability, resources, and resolution of significant risks | Assigned owners, approved plans, and remediation decisions |
| IT and security | Access, monitoring, data protection, response, and recovery | Access reviews, security records, incident timelines, and restoration tests |
| Service providers | Contracted operations and technical support | Service reports, configuration evidence, testing results, and escalation records |
A responsibility matrix should identify who acts when an issue crosses teams. For example, security personnel may investigate unauthorized access while compliance and counsel assess notification obligations.
Vendor contracts should support that coordination. Confirm reporting expectations, access to relevant records, and escalation procedures. A service provider’s assurance report can inform oversight, but it does not replace evaluation of the services your firm actually uses.
Xantrion’s financial services IT support addresses technology and security needs alongside a firm’s compliance professionals and counsel. Regulatory interpretation and firm-level accountability remain with the appropriate business and advisory teams.
Demonstrate That Controls Work
A policy describes expected behavior. Testing and operational records show whether that behavior occurs.
Useful evidence may include completed access reviews, recovery-test results, vendor assessments, training records, approved AI uses, and documented compliance reviews. Evidence should identify the scope, date, reviewer, findings, and corrective actions where relevant.
Consider a hypothetical firm whose policy requires prompt removal of access when an employee leaves. A sample test finds that the employee’s primary account was disabled, but a connected application token remained active.
The corrective action should address the token and the process weakness. The firm revokes access, updates the offboarding procedure, assigns responsibility for connected applications, and tests the revised process. It records the original finding and verification of the fix.
That sequence demonstrates more than a completed checklist. It connects a policy to an operational test, a discovered gap, and a verified improvement.
The same approach applies to cybersecurity compliance. Explain what a control protects, how it operates, and what evidence supports its effectiveness.
How to Prepare for SEC Exams Based on the Current Priorities
Organize preparation around your applicable priorities and actual exposures. The following checklist is illustrative; ownership should reflect your firm’s structure.
| Relevant priority | Review or test | Suggested owner | Supporting evidence | Remediation status |
|---|---|---|---|---|
| Fiduciary duties and conflicts | Sample recommendations and conflict handling | Compliance and investment leadership | Recommendation records and disclosure reviews | Record owner and due date |
| Fees and expenses | Recalculate a sample and compare with agreements | Compliance and finance | Calculations, exceptions, and corrections | Track unresolved differences |
| Customer information safeguards | Test incident escalation and response procedures | Compliance, counsel, and security | Exercise results and approved procedures | Verify corrective actions |
| Access and vendor oversight | Review users, privileged accounts, and integrations | IT/security and business owners | Access decisions and vendor assessments | Record revocations and follow-up |
| Operational resilience | Restore a critical service and check dependencies | IT and operations | Recovery results and observed limitations | Retest significant gaps |
| AI and automated tools | Compare approved use and disclosures with practice | Compliance and technology owners | Inventory, approvals, and supervision records | Track unauthorized uses |
| Compliance-program effectiveness | Review implementation and prior findings | Compliance leadership | Annual-review records and remediation evidence | Confirm closure |
Identify and Rank Your Gaps
Map each applicable priority to an existing policy, control, owner, and evidence source. Where the link is missing, determine why.
Missing documentation and ineffective controls require different responses. A review may have occurred without adequate records, or the review process may never have operated. Correctly identifying the problem prevents a documentation exercise from concealing an operational weakness.
Prioritize gaps according to potential investor harm, applicable deadlines, sensitive information exposure, and previously identified deficiencies. An unresolved high-impact weakness deserves attention even if another topic is easier to document.
Assign an owner and completion date. Make significant delays visible to management.
Test Controls and Record Remediation
Select exercises that match your exposure. A ransomware tabletop can test escalation and coordination. A restoration test can reveal inaccessible backups or dependencies. An AI-use review can identify unapproved tools and inaccurate representations.
For investment practices, targeted sampling can test fee calculations, recommendations, conflicts, or disclosure consistency.
Preserve results, record corrective actions, and verify that changes work. An action marked complete should have a clear basis for closure.
Maintain a secure, indexed evidence repository so records can be retrieved consistently. Distinguish current policies from historical versions and preserve the relevant dates. Use targeted mock examinations where they help evaluate a specific readiness concern.
Looking Ahead to the SEC’s 2027 Examination Priorities
Forward-looking analysis as of September 30, 2026: The following watch areas are questions for planning, not confirmed 2027 examination priorities.
Will Review of Implemented Privacy Controls Deepen?
With the Regulation S-P amendment compliance dates now past, firms should be prepared to explain how their safeguards operate. A reasonable planning assumption is that implementation evidence will remain important, but the official 2027 report will determine its stated emphasis.
Watch SEC risk alerts, examination observations, and official guidance for developments affecting incident response, vendor oversight, and customer notification.
How Will AI Oversight Evolve?
AI may become more integrated into advice, communications, trading, and compliance operations. Firms should monitor whether future SEC publications provide more detailed expectations or observations about supervision and representations.
Maintaining an accurate inventory and documented oversight now makes it easier to adapt when the next priorities are published.
Will Complex Retail Investments Remain Prominent?
The 2026 report identifies complex, alternative, and higher-cost investments, alongside recommendations to older investors and retirement savers. Those areas warrant continued internal attention based on each firm’s activities.
Review the next priorities, relevant rule developments, and examination observations before describing any topic as an official 2027 focus.
Preparation does not need to wait for that publication. Firms can strengthen control ownership, testing, and evidence under current obligations while leaving room to update their assessment.
Xantrion’s managed IT service and managed cybersecurity service support the technology operations and security work that contribute to readiness. Contact our team to assess your access controls, recovery capabilities, vendor responsibilities, and supporting technical records alongside your compliance professionals.
