The SEC’s 2026 Examination Priorities are not exactly beach reading, unless your ideal vacation includes a highlighter, a compliance manual, and a suspicious amount of coffee. But for investment advisers, broker-dealers, funds, and other market participants, this annual roadmap matters a lot. It signals where exam staff are likely to spend their time, what kinds of questions firms should expect, and where sloppy controls can turn into very expensive headaches.

The big picture for 2026 is clear: the SEC is still focused on investor protection, but the way it talks about risk feels a bit sharper and more practical. The familiar themes remain in place: fiduciary duty, disclosure quality, conflicts of interest, retail investor protection, and strong compliance programs. At the same time, the 2026 priorities give more texture to technology risk, operational resiliency, AI governance, and the way firms manage increasingly complex products. In other words, the SEC still cares about the basics, but the basics now come with algorithms, third-party vendors, ransomware, extended-hours trading, and products that can make even seasoned compliance officers sigh dramatically into their spreadsheets.

This article breaks down what the 2026 examination agenda really means, what changed from the prior year, and how firms can prepare without turning their compliance departments into permanent triage centers.

Why the 2026 priorities matter

The SEC’s Division of Examinations publishes these priorities to show registrants and investors which risks, practices, products, and services appear most likely to draw scrutiny. The report is not exhaustive, and it does not mean every exam will look the same. But it does offer a very useful clue: if a topic made the list, firms should assume it may come up in document requests, interviews, testing, or follow-up questions.

For firms, that means the priorities are less like a crystal ball and more like a weather alert. You do not know exactly where the storm will hit, but you do know it is smart to check the roof, test the backup generator, and stop pretending the leak will fix itself.

Investment advisers: the SEC still cares deeply about fiduciary duty

Investment advisers remain front and center in the 2026 priorities, especially where retail investors are involved. The SEC continues to emphasize the adviser’s duty of care and duty of loyalty, which means exam staff will be looking closely at whether recommendations, disclosures, and practices line up with what fiduciary duty actually requires in real life, not just in theory or in marketing copy polished to a showroom shine.

What the SEC appears most interested in

First, advisers should expect continued scrutiny of conflicts of interest and whether those conflicts influence supposedly impartial advice. The SEC is also focused on how advisers evaluate the total package behind an investment recommendation. Cost, liquidity, volatility, risks, possible benefits, time horizon, special features, and the cost of getting out all matter. Best execution remains very much alive as a priority, too, which means firms need to show not only that they have policies, but that those policies actually drive decisions.

Second, the 2026 priorities pay special attention to certain investment products and recommendations. The SEC points to alternative investments such as private credit and private funds with long lock-up periods, complex products such as option-based ETFs and ETF wrappers on less liquid strategies, and products with higher costs such as rich commissions or unusually high expenses. Translation: if a product is hard to understand, hard to value, hard to exit, or expensive to own, the SEC would like a word.

Third, the Division is signaling a strong interest in how advisers serve older investors and people saving for retirement. That focus is paired with scrutiny of advisers working across multiple client types and structures, especially advisers to private funds that also manage separately managed accounts or newly registered funds. The SEC is clearly sensitive to allocation favoritism, side letter issues, fee disclosures, liquidity management, and whether advisers are stepping into unfamiliar asset classes or structures without enough regulatory muscle memory.

Compliance programs are not background scenery

The 2026 priorities also reinforce that an adviser’s compliance program must be more than a decorative binder. The SEC is interested in whether policies and procedures are actually implemented and enforced, whether annual reviews are meaningful, and whether core areas such as marketing, valuation, trading, portfolio management, filings, disclosures, and custody are addressed in a way that matches the firm’s real operations.

That matters especially for advisers that have changed business models, merged, expanded into new services, or started advising new types of assets. Growth may be exciting, but from the SEC’s perspective, growth without upgraded controls is basically an engraved invitation to an awkward exam.

And yes, never-examined and recently registered advisers remain a priority. If your firm is new, assume the SEC may stop by to say hello. Not a warm hug hello. More of a “please upload these 47 documents by Friday” hello.

Investment companies: mutual funds and ETFs stay on the radar

The SEC continues to prioritize registered investment companies, including mutual funds and ETFs, largely because they matter so much to ordinary investors, especially retirement savers. That means the agency is still looking carefully at compliance programs, governance practices, disclosures, filings, and how fund operations work in practice.

Fees and expenses remain a classic focus area, including waivers and reimbursements. Portfolio management practices and related disclosures are also key, particularly where a fund’s actual strategy or holdings may drift away from the story told in filings, marketing materials, or its name. The amended fund “Names Rule” adds another layer here: if a fund name implies a specific investment focus, the SEC expects the strategy, holdings, and disclosures to support that implication.

The 2026 priorities also call out several developing areas of interest. Funds involved in mergers or similar transactions may draw attention because operational integrations tend to create the kind of compliance messes that begin with optimism and end with remediation memos. Funds using complex strategies or holding significant less liquid or illiquid investments are also likely to be examined closely, as are funds with novel strategies or leverage vulnerabilities. Newly registered and never-before-examined registered investment companies are also likely to receive extra attention.

Broker-dealers: capital, trading, retail sales practices, and disclosures

For broker-dealers, the 2026 priorities keep one foot in classic financial responsibility and the other in modern market structure and retail conduct. That combination is important because it shows the SEC is not treating this as an either-or exercise. A firm can have a flashy digital front end and still get examined on net capital, customer protection, liquidity, order routing, and plain old supervisory controls.

Financial responsibility and trading-related reviews

The SEC says it will continue focusing on compliance with the net capital rule, the customer protection rule, related controls, and timely financial notifications and filings. It also highlights operational resiliency, vendor oversight, change management, and stress-event liquidity planning. Cash sweep programs and prime brokerage activities are named specifically, with a focus on concentration, liquidity, and counterparty credit risk.

Trading-related practices are also a clear focus for 2026. The SEC points to equity and fixed income trading, extended-hours trading, municipal securities, variable rate demand obligations, priority of orders, mark-ups disclosure, best execution, pricing and valuation of illiquid instruments, and disclosures relating to order routing and execution. Alternative trading systems are still in the mix, especially confidentiality safeguards, disclosure alignment, and risk controls.

Retail sales practices and Regulation Best Interest

Where the 2026 priorities become especially practical is retail sales practice. The SEC continues to focus on Regulation Best Interest and wants to see how broker-dealers handle recommendations involving products, strategies, accounts, and rollovers. Examiners are likely to review conflict identification and mitigation, processes for considering reasonably available alternatives, and how firms satisfy the Care Obligation based on a customer’s profile and the characteristics of the product or account.

The list of products that may draw extra scrutiny is telling. It includes variable and registered index-linked annuities, ETFs with less liquid underlying assets, municipal securities such as 529 plans, private placements, structured products, alternative investments, and other offerings with complicated fee structures, exotic benchmarks, or limited liquidity. Recommendations to older investors, retirement savers, and college savers are likely to be examined with extra care.

Form CRS remains part of the picture as well. The SEC plans to look at how broker-dealers describe services, fees, conflicts, and disciplinary history in relationship summaries. In short, plain-English disclosure still has to be plain, English, and true. All three parts matter.

Cybersecurity, operational resiliency, and data protection are now table stakes

If there is one area where the 2026 priorities sound especially urgent, it is information security and operational resiliency. Cybersecurity remains a perennial SEC priority, but this year’s language makes clear that the agency is paying attention not only to breach prevention but also to governance, resilience, and recovery.

The SEC says it will examine practices designed to prevent interruptions to mission-critical services and protect investor information, records, and assets. It specifically mentions governance practices, data loss prevention, access controls, account management, and responses to cyber incidents, including ransomware. It also points to operational disruption risks arising from cyberattacks, dispersed operations, weather events, and geopolitical concerns.

That is already a serious list, and then 2026 adds another wrinkle: artificial intelligence and polymorphic malware. Yes, even the malware is now trying to be innovative. The SEC wants to know whether firms are training staff and deploying security controls to identify and mitigate emerging AI-related cyber risks, and whether they are operationalizing information from threat intelligence sources in a meaningful way.

Regulation S-ID and Regulation S-P

The SEC’s focus on Regulations S-ID and S-P is also significant. On the S-ID side, examiners will look for written identity theft prevention programs that are designed to detect, prevent, and mitigate identity theft involving covered accounts, including risks tied to account takeovers and fraudulent transfers. Employee training is part of that review.

On the S-P side, the agency is looking at incident response readiness, vendor oversight, governance, internal controls, and whether firms have implemented the administrative, technical, and physical safeguards required under the updated rule. This means firms should be prepared to show not only that they have a plan, but that they know who owns it, how it works, and what happens on a bad day when the bad day is no longer hypothetical.

AI and emerging financial technology: no more “trust us, it’s smart” compliance

The 2026 priorities make it clear that the SEC is not allergic to innovation, but it does expect firms to govern it properly. The Division remains focused on automated investment tools, AI technologies, trading algorithms or platforms, and alternative data. In reviews, exam staff will assess whether representations are fair and accurate, whether operational controls match disclosures, whether algorithmic outputs align with investor profiles or stated strategies, and whether automated recommendations comply with regulatory obligations.

This is a meaningful signal for firms that like to describe tools as AI-powered, machine-learning-enhanced, next-generation, or whatever phrase made the marketing team clap. The SEC appears less interested in the buzzwords than in whether the tool works as described, whether the controls are real, whether human supervision exists, and whether investors are getting advice that actually fits their needs.

That scrutiny extends beyond front-office tools. The priorities also point to AI and automation used in fraud detection, back-office operations, AML, and trading. So a firm cannot hide weak governance by saying the sensitive AI system lives in operations instead of client-facing functions. The SEC is reading the whole map.

Other market participants should not feel left out

The 2026 priorities also cover self-regulatory organizations, clearing agencies, municipal advisors, transfer agents, funding portals, security-based swap dealers, and security-based swap execution facilities. For these groups, the SEC highlights risk management, operational controls, recordkeeping, supervisory requirements, conflict disclosures, vendor oversight, and remediation of prior findings.

Two details stand out. First, municipal advisors remain subject to fiduciary-duty review and MSRB Rule G-42 scrutiny. Second, the SEC expects to begin conducting examinations of registered security-based swap execution facilities, signaling that newer market structures are moving from setup mode into exam mode. That is always an important regulatory milestone.

AML remains on the list as well. The SEC says it will review whether applicable firms tailor AML programs to business-specific risks, conduct independent testing, maintain adequate customer identification procedures, meet suspicious activity reporting obligations, and monitor OFAC sanctions compliance. If a firm’s AML program still reads like it was written for a different business in a different decade, 2026 may be a rough year.

What changed from 2025 to 2026?

The most talked-about shift is what is not in the 2026 report as standalone sections. Unlike 2025, the 2026 priorities do not include separate headline sections devoted specifically to private fund advisers or crypto-assets. That does not mean those issues have vanished. Private fund-related risks still show up in adviser-focused priorities, and technology-driven risks remain present through the sections on emerging financial technology, cybersecurity, conflicts, disclosure accuracy, and complex products.

Still, the change matters. It suggests the SEC’s 2026 examination agenda is framed less around splashy labels and more around durable regulatory themes: fiduciary duty, retail investor protection, disclosure accuracy, operational resilience, governance, and whether firms can support their claims with controls and records. In some ways, that makes the agenda more practical and possibly more dangerous for firms that were preparing for the wrong version of the test.

How firms should prepare now

Smart preparation for a 2026 SEC exam is not about producing prettier policies. It is about matching reality to documentation. Firms should start by identifying their highest-risk products, client segments, business changes, and technology uses. After that, they should review whether their disclosures match operations, whether annual compliance reviews are substantive, whether conflict mitigation actually works, and whether supervisory evidence exists.

Cyber and vendor governance should get immediate attention. So should AI inventories, algorithm oversight, and the controls around automated recommendations or operational tools. Advisers should revisit high-cost and complex products, allocation practices, side letters, valuation controls, and best execution. Broker-dealers should pressure-test Reg BI workflows, rollover documentation, alternative analysis, Form CRS content, and extended-hours or complex product supervision.

The simplest rule is this: if the SEC can ask, “Show me how this works,” your firm should be able to answer with more than a meeting invite and a confident shrug.

Practical experiences from the compliance trenches

In real-world exam preparation, the biggest surprises usually are not exotic. They are ordinary processes that looked fine from a distance but fell apart the moment someone asked for proof. A firm says it reviews conflicts annually, but the supporting memo is generic and three business models out of date. A broker-dealer says it evaluates reasonably available alternatives, but the file shows little more than a box checked by habit. An adviser says an AI-assisted tool is “supervised,” yet no one can clearly explain who validated the output, how exceptions are escalated, or when the model was last tested. These are the kinds of gaps that feel small until an examiner starts connecting them to investor impact.

Another common experience is the painful discovery that growth outran governance. A firm acquires another business, launches a new strategy, expands into private credit, adds more retirement accounts, or introduces a new digital workflow. Everyone is busy. Revenue looks good. The website gets updated. Then compliance tries to map the new reality and finds three different account opening paths, four versions of one disclosure, two overlapping vendor contracts, and a supervisory chain that exists mostly in folklore. The SEC’s 2026 priorities read like a warning against exactly that kind of drift.

Cyber readiness also tends to reveal whether a firm is disciplined or merely hopeful. Plenty of firms have incident response plans. Fewer have decision trees that match their actual systems, third-party relationships, and escalation practices. Fewer still have clear evidence of tabletop exercises, training completion, access reviews, or data-loss controls that work the way the written policy says they work. In exams, operational resiliency is rarely judged by the elegance of the PDF. It is judged by whether people know what to do at 2:17 a.m. when a vendor outage or suspicious transfer request lands at exactly the wrong time.

Retail recommendations create another recurring pattern. Firms often believe their process is solid because advisers or representatives are experienced and well-intentioned. But examiners are not testing good intentions. They are testing whether the file shows a product match, whether alternatives were considered, whether costs were weighed, whether conflicts were mitigated, and whether the recommendation made sense for that customer at that moment. A recommendation can sound reasonable in a meeting and still look flimsy in a record set.

One of the most useful lessons from recent exam cycles is that firms do better when compliance is embedded early instead of invited late. When product, operations, legal, technology, and compliance talk before launch, the documentation tends to match reality. Disclosures are tighter. Controls are easier to explain. Testing is less chaotic. Vendor oversight is more than ceremonial. By contrast, when compliance enters the story after the business decision is final, the result is usually patchwork. Patchwork may pass a style review. It does not always survive an SEC exam.

So the practical experience takeaway for 2026 is simple: firms should prepare like examiners will compare promises to practice line by line. Because that is exactly what happens. And when the records are current, the owners are clear, the controls are tested, and the disclosures match the business, an exam becomes far more manageable. Not fun, exactly. But manageable, which in compliance is sometimes the closest thing to luxury.

Conclusion

The SEC’s 2026 Examination Priorities do not reinvent the exam program, but they do sharpen it. The familiar pillars are still there: fiduciary duty, investor protection, disclosure accuracy, and strong compliance programs. What makes 2026 feel different is the way those pillars now connect more explicitly to operational resiliency, AI governance, vendor oversight, complex product risk, and practical implementation. Firms that treat the priorities as a checklist will probably miss the point. Firms that treat them as a test of whether their real-world operations match their stated obligations will be much better positioned.

The headline for 2026 is not “the SEC likes new themes.” It is “the SEC still cares about old obligations, and now it expects firms to manage them in a more complex market.” That is a tougher challenge, but it is also a clearer one. And clarity, unlike surprise deficiency letters, is always welcome.

The Securities and Exchange Commission’s fiscal year 2026 examination priorities offer financial firms something regulators do not always provide in abundance: a reasonably clear map of where the flashlights are likely to point. The map is not a guarantee, an exemption list, or a magical shield against difficult questions. It is, however, a practical guide to the risks that the SEC’s Division of Examinations believes deserve heightened attention.

For investment advisers, investment companies, broker-dealers, transfer agents, clearing agencies, funding portals, and other market participants, the central message is straightforward. Examiners want to see fiduciary obligations translated into real decisions, compliance policies translated into daily behavior, and new technology governed with something more substantial than enthusiasm and a glossy slide deck.

The 2026 agenda combines familiar prioritiesconflicts of interest, investor protection, custody, cybersecurity, fees, sales practices, and compliance program effectivenesswith growing scrutiny of artificial intelligence, operational resilience, privacy safeguards, complex products, private credit, and third-party technology providers. In other words, the basics still matter, but the basics now have algorithms, cloud vendors, and several additional passwords.

What the SEC’s 2026 Examination Priorities Mean

The Division of Examinations released its fiscal 2026 priorities in November 2025 for the federal fiscal year ending September 30, 2026. The Division examines SEC-registered investment advisers, investment companies, broker-dealers, clearing agencies, self-regulatory organizations, and other regulated entities.

The published priorities are not an exhaustive examination checklist. A firm may be reviewed for issues that do not appear prominently in the annual document. Examiners select and scope reviews using additional risk factors, including a registrant’s history, business model, products, client population, disciplinary information, operational changes, tips, complaints, and previous examination findings.

That distinction matters. A firm should not look at an omitted subject and conclude, “Excellent, nobody will ask about that.” Compliance is not a game of regulatory hide-and-seek, and the examiner usually knows where the curtains are.

The Big Picture: Fundamentals With More Digital Wiring

The SEC’s 2026 examination priorities can be organized around several broad themes:

• Investment advisers must demonstrate adherence to their duties of care and loyalty.
• Broker-dealers must support recommendations with a defensible Regulation Best Interest process.
• Funds must align their names, disclosures, portfolio practices, fees, and marketing claims.
• Complex, illiquid, leveraged, alternative, and expensive products require stronger analysis and supervision.
• Cybersecurity, privacy, operational resilience, and vendor oversight remain major examination concerns.
• Artificial intelligence must be inventoried, supervised, tested, accurately described, and used consistently with regulatory obligations.
• Policies must operate in practice rather than simply occupying an attractive binder.

The priorities therefore represent less of a dramatic regulatory reinvention and more of an effectiveness test. The SEC is asking whether firms can prove that their controls work under real conditions, including market volatility, cyber incidents, employee turnover, acquisitions, product expansion, and technology failures.

Investment Advisers: Fiduciary Duty Remains the Main Event

Advice Must Reflect the Client’s Best Interest

Investment adviser examinations will continue to focus on the fiduciary duties of care and loyalty, especially where retail investors are involved. Examiners may review whether an adviser considered the cost, objectives, liquidity, risks, potential benefits, volatility, expected behavior under different market conditions, investment horizon, and exit costs of a recommended strategy or product.

The inquiry is broader than whether an investment was technically permissible. An examiner may ask why a particular product was selected, what alternatives were considered, how the adviser evaluated conflicts, and whether the recommendation remained appropriate as the client’s circumstances changed.

Extra attention may be directed toward alternative investments, private credit, private funds with extended lockups, option-based exchange-traded funds, leveraged or inverse ETFs, strategies involving illiquid assets, and products with higher commissions or expenses than comparable alternatives.

Older Investors and Retirement Savers Receive Special Attention

The SEC has highlighted recommendations made to older investors and people saving for retirement. These investors may be particularly vulnerable to liquidity restrictions, complex return formulas, market volatility, high fees, and products that are difficult to exit.

Firms should be prepared to show how representatives evaluated income needs, time horizon, tax status, risk tolerance, emergency liquidity, concentration, and the investor’s ability to understand and withstand losses. A client signature is useful evidence, but it does not convert a weak recommendation into a strong one.

Conflicts Must Be Managed, Not Merely Mentioned

Examiners may scrutinize revenue sharing, compensation arrangements, account selection, product incentives, affiliated providers, allocation practices, markups, fee structures, and other economic benefits that could influence advice.

A June 2026 SEC risk alert reinforced this concern by discussing examination observations involving economic conflicts of interest. Among other matters, the alert addressed advisers’ written policies, fee and expense disclosures, recommendation incentives, and the accuracy of advisory fee calculations.

Clear disclosure remains essential, but disclosure alone may not be enough. Firms should first determine whether a conflict can be eliminated or reduced. Any remaining material conflict should be described specifically enough for a client to understand how it could affect the adviser’s conduct. A fog bank of legal vocabulary is not the same thing as informed consent.

Compliance Programs Must Match the Actual Business

The SEC will examine the effectiveness of adviser compliance programs in areas such as marketing, valuation, trading, portfolio management, regulatory filings, custody, and disclosures. Annual compliance reviews should address the firm’s current risks rather than repeat last year’s document with a new date and heroic confidence.

Examiners may compare written policies with emails, committee minutes, billing records, trading data, advertising approvals, client files, and employee behavior. They may also test whether identified problems were escalated, corrected, and monitored for recurrence.

Never-examined and recently registered advisers remain priorities. Firms that have entered new businesses, launched private funds, acquired another practice, merged systems, or started advising unfamiliar client or asset categories may also attract attention because growth can create new conflicts and operational gaps.

Investment Companies: Fees, Names, Liquidity, and Governance

Registered investment companies, including mutual funds and ETFs, remain central to the SEC’s investor-protection mission because of their importance to retirement and retail portfolios. Examinations may cover fund compliance programs, board oversight, disclosures, filings, fees, expense waivers, reimbursements, and portfolio management practices.

Examiners may compare a fund’s portfolio with its prospectus, shareholder reports, website, marketing materials, and stated investment strategy. Funds subject to the amended Investment Company Names Rule must also ensure that their names, investment policies, definitions, records, and disclosures satisfy applicable requirements.

Larger fund groups reached the principal amended Names Rule compliance date in June 2026, while smaller fund groups generally have a December 2026 date. Firms should distinguish those substantive requirements from certain Names Rule-related Form N-PORT reporting provisions, whose compliance dates were separately extended in 2026.

Additional areas of interest include fund mergers, complex or novel strategies, leverage vulnerabilities, closed-end funds with significant illiquid holdings, valuation controls, and conflicts arising during business combinations or portfolio transitions.

Broker-Dealers: Regulation Best Interest Under the Microscope

Broker-dealer examinations will continue to cover financial responsibility requirements, including net capital, customer protection, financial reporting, liquidity controls, and the reliability of records produced by outside vendors.

Retail sales practices remain especially important. Examiners may evaluate whether a broker-dealer’s recommendations comply with Regulation Best Interest, whether Form CRS is accurate, and whether conflicts are properly identified, disclosed, mitigated, or eliminated.

Complex and Tax-Advantaged Products Require Better Documentation

Products likely to receive attention include variable annuities, registered index-linked annuities, municipal securities, 529 college savings plans, private placements, structured products, alternative investments, ETFs holding illiquid assets, and products with complicated fees, unusual benchmarks, or difficult return calculations.

Examiners may ask whether representatives considered reasonably available alternatives and whether supervisors evaluated the customer’s age, financial situation, tax status, liquidity needs, objectives, experience, and risk tolerance. Recommendations involving retirement rollovers, brokerage-to-advisory conversions, margin accounts, options accounts, and self-directed IRAs may also be reviewed.

Dual registrants face an additional challenge because the same professional may operate under different standards, compensation systems, and account types. Firms need a clear process for determining why brokerage or advisory treatment is appropriate and how financial incentives were controlled.

Cybersecurity and Operational Resilience Remain Perennial Priorities

The SEC continues to regard cybersecurity as a recurring examination priority. Examiners may assess governance, access controls, account management, data-loss prevention, ransomware readiness, incident response, backup procedures, recovery capabilities, employee training, and protection of customer records and assets.

Operational resilience extends beyond preventing a breach. A firm must also consider how it would continue critical services during a cloud outage, weather emergency, vendor failure, telecommunications disruption, geopolitical event, or ransomware incident. A business continuity plan that assumes electricity, internet access, personnel, and every major vendor will remain available is less a plan and more a wish.

Vendor Oversight Is Now Part of the Firm’s Own Risk Story

Financial firms increasingly depend on portfolio systems, custodial integrations, cloud platforms, communications tools, data providers, cybersecurity vendors, and outsourced operational services. Examiners may review vendor due diligence, contract provisions, access permissions, incident-notification terms, ongoing monitoring, data disposal, and contingency arrangements.

Management should know which vendors store sensitive information, which services are mission-critical, who can access client accounts, and how the firm would operate if a provider became unavailable. “The vendor handles that” is not a complete control description.

Regulation S-ID and Regulation S-P

Identity-theft controls under Regulation S-ID remain relevant, particularly for detecting account takeovers, fraudulent transfers, unusual credential changes, and other red flags. Firms should maintain an appropriately designed written identity-theft prevention program and train employees to recognize suspicious activity.

The amended Regulation S-P requirements also receive substantial attention. Covered institutions must maintain safeguards and incident-response procedures addressing unauthorized access to or use of customer information, including notification processes where required. Larger entities generally reached their compliance date in December 2025, and smaller entities reached theirs in June 2026. By this point, examiners can reasonably expect implementation rather than a calendar reminder and a hopeful expression.

Artificial Intelligence: Innovation Does Not Cancel Supervision

The 2026 priorities expand the SEC’s focus on automated investment tools, trading algorithms, artificial intelligence, alternative data, fraud detection systems, back-office automation, anti-money-laundering technology, and other emerging financial technologies.

Examiners may ask whether public statements about AI capabilities are fair and accurate. A firm describing a service as “AI-powered,” “predictive,” or “intelligent” should be able to explain what the technology actually does. Marketing language should not outrun the product by three city blocks.

Firms may also need to demonstrate that:

• AI systems and automated tools have been inventoried.
• Responsible owners and approval processes have been assigned.
• Input data is appropriate, secure, and sufficiently reliable.
• Outputs are tested and subject to meaningful human supervision.
• Recommendations remain consistent with investor profiles and stated strategies.
• Model changes, errors, overrides, and exceptions are documented.
• AI-generated communications pass applicable advertising, recordkeeping, privacy, and supervisory controls.
• Cybersecurity training addresses AI-enabled phishing, impersonation, and polymorphic malware.

The practical lesson is that AI is neither forbidden nor magical compliance fairy dust. It is another business tool, and the firm remains responsible for what the tool produces, how it is described, and how it affects investors.

Other Market Participants Are Also in Scope

The 2026 priorities extend well beyond advisers and broker-dealers. Clearing agencies may be examined for financial resources, default management, credit risk, operational controls, margin practices, settlement risk, and remediation of previous findings.

Municipal advisers may face reviews of fiduciary obligations, conflicts, documentation, professional qualifications, supervision, recordkeeping, and compliance with applicable Municipal Securities Rulemaking Board standards.

Transfer agents may be examined for safeguarding assets, processing transfers, record retention, regulatory filings, emerging technology, and Regulation S-P compliance. Funding portals may face questions about investor funds, third-party arrangements, required records, privacy safeguards, and the design of their compliance procedures.

Security-based swap dealers and execution facilities remain subject to scrutiny involving transaction reporting, capital, margin, segregation, risk management, trading surveillance, operational risk, and correction of previously identified deficiencies. The SEC will also continue oversight of FINRA, securities exchanges, Regulation SCI entities, and applicable anti-money-laundering programs.

What the 2026 Priorities Do Not Emphasize

Unlike some previous examination agendas, the fiscal 2026 document does not include a separate section devoted to crypto assets. It also does not present private fund advisers as a stand-alone category.

Those omissions should be interpreted carefully. Crypto-related activity may still be examined through custody, disclosure, fiduciary duty, valuation, advertising, cybersecurity, recordkeeping, or other applicable requirements. Private fund issues appear throughout the priorities, particularly in discussions of private credit, extended lockups, valuation, allocations, side-by-side management, new fund launches, fees, liquidity, and differential treatment of investors.

A topic can leave the headline without leaving the examination room.

A Practical SEC Examination Readiness Plan

1. Map the priorities to the business.
   Identify which products, client groups, technologies, vendors, compensation systems, and operational changes create the firm’s greatest exposure.
2. Test evidence instead of admiring policies.
   Sample client files, recommendations, fees, advertisements, access logs, vendor reviews, trade allocations, incident records, and employee communications.
3. Review conflicts product by product.
   Document compensation, revenue sharing, affiliated relationships, fee differences, allocation incentives, rollover benefits, and reasonably available alternatives.
4. Inventory AI and automated tools.
   Include official systems, vendor features, pilot projects, employee-created tools, and generative AI used for client or marketing content.
5. Run incident and outage exercises.
   Test cyber response, customer notification, vendor escalation, backup access, communications, and recovery of mission-critical services.
6. Update the annual compliance review.
   Connect testing results to actual changes in the business, assign responsible owners, set deadlines, and verify remediation.
7. Conduct a mock examination.
   Practice producing documents promptly, answering questions accurately, tracking requests, escalating concerns, and explaining the rationale behind key decisions.

Experience-Based Lessons From SEC Examination Preparation

The following composite examples reflect recurring lessons seen in examination-readiness projects. They do not describe any single firm, but they illustrate how an apparently respectable compliance program can develop uncomfortable squeaks when someone begins opening the doors.

Consider a mid-sized investment adviser that has recently acquired two smaller practices. Its policy manual is polished, its chief compliance officer is experienced, and its annual review says the right things. During a mock examination, however, the team discovers that the acquired offices use different fee schedules, different client-risk questionnaires, and different methods for documenting rollover recommendations. One office also continues to use an old marketing presentation containing performance figures that the central compliance department has never approved.

The problem is not that the firm lacks policies. The problem is that operational integration has not caught up with corporate integration. A useful response would include centralized billing tests, revised supervisory procedures, consistent client documentation, updated advertising controls, employee retraining, and a written remediation record. Examiners generally find a documented problem with credible corrective action more reassuring than a firm that insists everything is perfect while the spreadsheets quietly disagree.

In another common scenario, a broker-dealer has strong written Regulation Best Interest procedures but weak evidence of how representatives considered alternatives. Files contain product brochures, customer signatures, and generic statements that a recommendation was “suitable and in the client’s best interest.” What they do not contain is an explanation of why a high-cost or illiquid product was preferable to simpler alternatives for a retiree who may need access to cash.

The practical fix is not to create a 47-page form that employees will complete by copying yesterday’s answer. Better documentation asks targeted questions about cost, liquidity, surrender restrictions, tax consequences, risk, time horizon, alternatives, and compensation. Supervisors should challenge inconsistent answers and record the basis for approval.

Technology reviews frequently produce a different surprise: the compliance department knows about the firm’s official AI platform, but not about the browser-based generative AI tools employees use to summarize research, draft client emails, or prepare marketing content. That creates possible confidentiality, accuracy, supervision, advertising, and recordkeeping problems. An effective AI inventory therefore begins with actual employee behavior rather than the software listed in the technology budget.

Cybersecurity exercises offer another valuable lesson. A firm may have an incident-response plan that assigns every important decision to a chief information officer who happens to be unavailable during the simulation. The backup contact cannot access the vendor list, legal counsel is unsure when customer notification analysis begins, and the communications team drafts a statement before anyone has confirmed what data was affected. A tabletop exercise exposes those gaps cheaply. A real breach exposes them loudly.

Finally, examination readiness is partly an organizational skill. Successful teams establish one intake channel for document requests, preserve original files, maintain a response log, assign knowledgeable reviewers, and answer only after confirming the facts. They avoid guessing, volunteering contradictory explanations, or sending an enormous data dump without context. Promptness matters, but accuracy matters more.

A practical 90-day readiness effort might begin with a risk assessment and document inventory, move into testing of fees, recommendations, advertising, cybersecurity, privacy, AI, and vendors, and conclude with remediation and a mock request process. The objective is not to manufacture a perfect record. It is to demonstrate a thoughtful program that identifies weaknesses, fixes them, and protects investors while the business continues to operate.

Conclusion

The Securities and Exchange Commission’s 2026 examination priorities reward firms that can connect obligations, controls, evidence, and investor outcomes. Fiduciary duty, Regulation Best Interest, fees, conflicts, privacy, cybersecurity, operational resilience, complex products, and AI are not isolated compliance islands. They intersect whenever a firm recommends a product, adopts a technology, hires a vendor, acquires a business, or communicates with a client.

The strongest preparation strategy is therefore not a frantic policy rewrite after an examination letter arrives. It is a continuous process of identifying risk, testing controls, correcting deficiencies, documenting decisions, and making sure the firm’s public story matches its operational reality. Examiners may bring the questions, but a well-run firm should already know most of the answers.

Note: This article provides general educational information and does not constitute legal, regulatory, investment, or compliance advice. Firms should evaluate their obligations with qualified counsel and compliance professionals based on their specific activities.

The Securities and Exchange Commission has released its fiscal year 2026 examination priorities, and the message is not exactly subtle: compliance programs should be practical, documented, tested, and ready for a very real conversation with examiners. In other words, this is not the year to keep policies in a dusty binder and hope the office coffee machine distracts everyone.

The SEC Division of Examinations uses its annual priorities to tell investment advisers, broker-dealers, investment companies, clearing agencies, self-regulatory organizations, and other market participants where examiners are likely to focus. The list is not exhaustive, but it is a valuable roadmap. For 2026, the priorities return to the fundamentals: fiduciary duty, standards of conduct, custody, cybersecurity, operational resilience, artificial intelligence, Regulation S-P, Regulation Best Interest, and the effectiveness of compliance programs.

The tone is also important. The 2026 priorities suggest a more transparent, risk-based, and “back-to-basics” examination program. That does not mean lighter expectations. It means firms should expect examiners to ask whether their disclosures match their actual practices, whether conflicts are handled before investors are harmed, and whether new technology is being supervised with something stronger than crossed fingers.

What Are the SEC 2026 Exam Priorities?

The SEC’s 2026 exam priorities are the Division of Examinations’ annual guide to the areas it considers most important for protecting investors, supporting fair and orderly markets, and monitoring emerging risks. These priorities help registered firms prepare for examinations by highlighting where the SEC is likely to spend time, ask questions, request records, and evaluate controls.

For fiscal year 2026, the SEC continues to examine traditional risk areas while sharpening its focus on newer pressure points, including artificial intelligence tools, automated investment advice, data security, customer information safeguards, and third-party vendor oversight. The result is a regulatory checklist that feels part compliance manual, part cyber-risk playbook, and part reminder that “we disclosed it somewhere” is not a magic spell.

Investment Advisers: Fiduciary Duty Is Still the Main Event

Investment advisers remain a major focus of the SEC examination program. The Division will continue reviewing whether advisers meet their fiduciary duties of care and loyalty, especially when serving retail investors, older investors, retirement savers, and clients who may not fully understand complex products.

Conflicts of Interest and Product Recommendations

Examiners are expected to review whether advisers identify, disclose, mitigate, or eliminate conflicts of interest. This includes financial incentives that may influence recommendations, account allocations, product selection, and rollover advice. A beautifully written disclosure will not save a firm if the actual practice looks like “clients first, except when revenue knocks.”

The SEC is paying close attention to recommendations involving alternative investments, private credit, private funds with long lock-up periods, leveraged and inverse ETFs, option-based ETFs, complex strategies, illiquid products, and higher-cost investments. Advisers should be able to explain why a product fits a client’s objectives, liquidity needs, risk tolerance, time horizon, and overall financial background.

Compliance Programs Must Work in Real Life

The Division will also evaluate adviser compliance programs, including policies and procedures covering marketing, valuation, trading, portfolio management, custody, disclosures, filings, and annual reviews. The key question is not whether a firm owns a compliance manual. The question is whether the program is implemented, enforced, updated, and tailored to the firm’s actual business.

Firms that have changed business models, moved into new asset classes, launched private funds, merged with other advisory practices, or added third-party technology should pay close attention. Change creates operational complexity, and operational complexity creates exam questions. That is how the compliance universe keeps itself entertained.

Never-Examined and Recently Registered Advisers

The SEC will continue prioritizing examinations of advisers that have never been examined, with special attention to recently registered advisers. This is a major practical point for newer firms. Early-stage advisers often grow quickly, add clients, hire staff, outsource functions, and adopt technology before their compliance programs fully mature.

For these firms, the 2026 priorities are a warning and an opportunity. A first SEC exam does not have to feel like a surprise pop quiz in a language nobody studied. Firms can prepare by testing fee billing, reviewing Form ADV disclosures, documenting conflicts, checking advertising materials, validating custody practices, and ensuring annual compliance reviews are more than a calendar reminder that got snoozed eleven times.

Investment Companies: Fees, Names, Strategies, and Governance

Registered investment companies, including mutual funds and ETFs, remain central to the SEC’s investor-protection mission because they are widely used by retail investors and retirement savers. In 2026, examinations will generally review fund compliance programs, disclosures, filings, governance practices, fees, expenses, waivers, reimbursements, and portfolio management practices.

One important area is consistency between a fund’s name, stated strategy, marketing materials, and actual portfolio. The amended fund “Names Rule” is especially relevant because fund names can influence investor expectations. If a fund name sounds like it promises a particular investment focus, the SEC will expect the portfolio and disclosures to support that impression. A fund cannot wear a superhero cape in the name and then show up in pajamas in the holdings.

The SEC will also monitor funds involved in mergers, funds with significant holdings of less liquid or illiquid investments, closed-end funds with valuation challenges, novel strategies, and funds with leverage vulnerabilities. These areas matter because small disclosure gaps can become large investor-protection problems when markets get bumpy.

Broker-Dealers: Financial Responsibility and Retail Sales Practices

Broker-dealers should expect continued scrutiny of financial responsibility rules, including the net capital rule, customer protection rule, liquidity controls, financial notifications, required filings, and the systems used to prepare financial reporting information. The SEC will also review operational resilience and third-party vendor services that support financial records and reporting.

Trading, Routing, and Best Execution

Broker-dealer trading practices remain a priority. Examiners may review extended-hours trading, municipal securities activity, order routing, best execution, pricing and valuation of illiquid instruments, disclosures related to order execution, Regulation SHO compliance, and alternative trading systems.

Alternative trading systems should pay close attention to written safeguards protecting subscriber confidential information, Form ATS-N disclosures, operational risk controls, and whether actual practices match public descriptions. In a market where execution quality can be measured in milliseconds, vague supervision is not exactly a winning strategy.

Regulation Best Interest and Retail Recommendations

Regulation Best Interest remains a key part of the SEC’s broker-dealer examination agenda. The Division will review recommendations involving account types, rollovers, limited product menus, reasonably available alternatives, and complex or tax-advantaged products.

Products likely to receive attention include variable annuities, registered index-linked annuities, ETFs that invest in illiquid assets such as private equity or private credit, municipal securities, 529 Plans, private placements, structured products, alternative investments, and products with complex fee structures or unusual return calculations.

Examiners may also focus on recommendations involving options accounts, margin accounts, self-directed IRAs, retirement savers, college savers, and older investors. Dual registrants should be especially careful when financial professionals receive compensation or other incentives that could influence whether a customer is directed to a brokerage account, advisory account, wrap fee account, rollover, or similar product.

Cybersecurity, Regulation S-P, and Operational Resilience

Cybersecurity is not new, but the SEC’s 2026 priorities make clear that it remains essential. The Division will review how firms protect investor information, records, assets, and mission-critical services. Areas of focus include governance, data loss prevention, access controls, account management, incident response, ransomware preparedness, and recovery planning.

Regulation S-P is particularly important in 2026 because amendments adopted in 2024 require covered institutions to develop, implement, and maintain written incident response programs for unauthorized access to or use of customer information. The SEC will examine preparation for compliance dates and, after those dates, whether firms have policies and procedures addressing administrative, technical, and physical safeguards.

The practical lesson is simple: cybersecurity cannot live only in the IT department. Legal, compliance, operations, vendor management, investor relations, and senior leadership all need a role. When an incident happens, nobody wants to discover that the response plan is stored on the one system currently offline. That is not resilience; that is irony with a password reset.

Artificial Intelligence and Emerging Financial Technology

Artificial intelligence receives prominent attention in the 2026 SEC exam priorities. The Division will review registrants’ use of automated investment tools, AI technologies, trading algorithms, alternative data, and related platforms. Examiners are likely to ask whether representations about AI capabilities are fair and accurate, whether controls match disclosures, and whether algorithms produce advice or recommendations consistent with investor profiles and stated strategies.

This is especially important for firms using AI in fraud detection, back-office operations, anti-money laundering, trading, portfolio tools, customer communications, or compliance automation. The SEC is not saying firms cannot innovate. It is saying innovation still needs governance, supervision, testing, documentation, and accountability.

A firm that markets an “AI-powered” investment platform should be ready to explain what the system does, what data it uses, who supervises it, how errors are detected, how conflicts are managed, and whether investors understand the limits. “The algorithm made me do it” is unlikely to become a respected legal defense anytime soon.

Other Market Participants Under the 2026 Microscope

The priorities also address self-regulatory organizations, clearing agencies, municipal advisors, transfer agents, funding portals, security-based swap dealers, and security-based swap execution facilities.

For municipal advisors, examiners will review fiduciary duties, conflicts, documentation, and recommendations involving pricing and methods of sale. Transfer agents should expect attention to transfer processing, recordkeeping, safeguarding funds and securities, filing obligations, and Regulation S-P amendments. Funding portals will face scrutiny of investor fund arrangements with qualified third parties and required records.

Security-based swap dealers should expect reviews of Regulation SBSR reporting, capital, margin, segregation, risk management, and remediation of prior exam findings. Security-based swap execution facilities are also entering the examination picture, with expected reviews of rules, internal policies, trade monitoring, trade processing, participation standards, and operational risk programs.

What Is Different in the 2026 SEC Exam Priorities?

One of the biggest industry observations is what appears less prominent. The 2026 priorities do not include the same dedicated standalone emphasis on crypto assets that appeared in prior years, and some commentators have also noted the absence of a separate private fund adviser section. That does not mean crypto, private funds, or digital assets are invisible to regulators. It means those topics may be addressed through broader categories such as fiduciary duty, disclosures, custody, conflicts, cybersecurity, fraud prevention, AI, and operational risk.

The practical takeaway is not “crypto is off the hook” or “private funds can relax.” A better reading is that the SEC is organizing its 2026 exam focus around core obligations and investor-protection principles. If a product is complex, volatile, illiquid, expensive, poorly disclosed, or sold through conflicted recommendations, it may still attract attention regardless of what label appears on the box.

How Firms Should Prepare for a 2026 SEC Examination

Preparation should begin with a gap analysis against the 2026 priorities. Firms should compare written policies with actual practices, update disclosures, test controls, review client recommendations, evaluate fee calculations, examine custody practices, assess vendor oversight, and document decisions involving conflicts of interest.

Investment advisers should review fiduciary obligations, private credit exposure, complex products, side-by-side management, fee billing, marketing materials, valuation methods, and annual compliance reviews. Broker-dealers should review Regulation Best Interest processes, rollover documentation, branch supervision, Form CRS accuracy, order routing, best execution, and financial responsibility controls.

All registrants should revisit cybersecurity, Regulation S-P readiness, identity theft prevention programs, AI governance, incident response, vendor risk, AML controls, OFAC sanctions monitoring, and operational resilience. A firm does not need a perfect program, but it does need a reasonable, documented, risk-based program that people actually follow.

Practical Experiences and Lessons from SEC Exam Preparation

In practical compliance work, the firms that handle examinations best are rarely the ones with the thickest policy manuals. They are the ones that can tell a clear story. They know what they do, why they do it, where the risks sit, who owns each control, and how the firm tests whether those controls work. When examiners ask for records, these firms do not begin a dramatic treasure hunt through abandoned shared drives, inbox archaeology, and that one spreadsheet named “final_FINAL_reallyfinal.xlsx.”

A common experience in SEC exam preparation is discovering that many issues are not caused by bad intent. They are caused by growth. A small adviser adds new clients, then new products, then a second custodian, then a marketing vendor, then an outsourced technology provider. Each change makes business sense at the time, but the compliance program may not keep pace. By the time the firm prepares for an exam, the written policies describe last year’s business while the actual business has already moved into a new neighborhood and changed the locks.

Another lesson is that conflicts of interest need plain-English handling. Firms sometimes believe that a conflict is solved once it is disclosed. Disclosure matters, but examiners may still ask whether the firm mitigated the conflict, whether clients understood it, and whether the firm’s practices put the investor’s interest first. For example, if a dual registrant recommends a rollover into an advisory account, the file should show why that recommendation was appropriate, what alternatives were considered, what costs changed, and what services the client received in exchange.

Cybersecurity preparation creates similar real-world surprises. Many firms have incident response plans, but fewer have tested them under realistic conditions. A tabletop exercise often reveals simple but serious gaps: outdated contact lists, unclear escalation steps, vendor contracts with weak notification language, employees unsure how to report suspicious access, or backup procedures that nobody has validated recently. The good news is that these problems are fixable before an exam or breach. The bad news is that they are much less charming when discovered during one.

AI governance is becoming another practical pressure point. Firms may adopt AI tools for meeting notes, client communications, surveillance, research, trading support, or fraud detection without fully mapping where data goes, how outputs are reviewed, or whether disclosures accurately describe the tool. A strong preparation process includes inventorying AI use cases, assigning owners, reviewing vendor terms, testing outputs, restricting sensitive data, training employees, and documenting supervision. The goal is not to fear technology. The goal is to avoid letting a shiny tool quietly become an unsupervised business process.

The best preparation experience usually ends with a shorter, sharper list of priorities. Fix the highest-risk gaps first. Make disclosures accurate. Make records easy to retrieve. Train employees on what they actually do. Test the controls that protect clients. Document the judgment calls. When a firm treats the SEC 2026 exam priorities as a working roadmap instead of a regulatory weather report, the exam process becomes less mysterious and much more manageable.

Conclusion

The Securities and Exchange Commission’s 2026 exam priorities show a clear focus on investor protection, practical compliance, and risk-based oversight. Fiduciary duty, Regulation Best Interest, cybersecurity, Regulation S-P, AI, operational resilience, AML, conflicts of interest, complex products, and newly registered firms all sit near the center of the examination landscape.

The strongest firms will not wait for an exam letter to begin preparing. They will use the priorities as a checklist, compare policies against practice, strengthen documentation, test controls, and make sure investor-facing promises match reality. The SEC’s message for 2026 is straightforward: know your risks, supervise your business, protect customer information, and do not let innovation outrun compliance. Fair enough. Compliance may not be glamorous, but neither is explaining preventable gaps to an examiner on a Tuesday morning.

Note: This article is for general informational purposes only and should not be treated as legal, compliance, investment, or regulatory advice. Firms should consult qualified counsel or compliance professionals regarding their specific obligations.