SEC 2026 Exam Priorities: What Financial Advisers Need to Know

The SEC published its fiscal-year 2026 examination priorities on November 17, 2025. They describe areas of examination attention, including fiduciary conduct, compliance programs, and customer-information safeguards. The announcement emphasizes that an examination can extend beyond the published list. SEC 2026 announcement.

Current planning update, November 3, 2026: the SEC published its FY 2027 priorities on October 23, 2026. The newer announcement emphasizes adviser fiduciary obligations, conflicts, complex and illiquid products, private funds and private credit, cybersecurity, and emerging technology. Use it alongside the 2026 themes examined below when planning the next review. SEC 2027 announcement.

The exercises below apply the published themes to recommendation records, billing, public claims, and incident response. They are suggested internal reviews; the cited rules and interpretations establish the underlying obligations.

Understand what the priorities document does

The 2026 report is a staff statement, not a rule that creates new legal obligations. Its adviser section addresses duties of care and loyalty, investment recommendations and conflicts, effective compliance programs, and never-examined or recently registered advisers. It highlights risks involving complex or illiquid products, higher costs, older investors, and changes in an adviser’s business.

The technology sections address cybersecurity, customer-information protection, automated advice, and accuracy of AI claims. They also examine whether operations match disclosures and whether automated recommendations fit investor profiles.

Create two columns: the applicable obligation and evidence that the firm follows it. Map the topics to the firm’s actual services, clients, and risks. This turns the priorities into a focused review rather than a collection of policies disconnected from daily work.

Test recommendations against the client’s situation

The SEC’s 2019 fiduciary interpretation describes duties of care and loyalty. Care includes advice in the client’s best interest, seeking best execution where the adviser selects executing brokers, and advice and monitoring within the relationship’s scope. The obligation is broader than choosing the product with the lowest stated fee. SEC fiduciary interpretation.

For a practical review, choose a completed recommendation involving meaningful cost or liquidity tradeoffs. Reconstruct the decision from the records available at the time:

What did the adviser know about the client’s need for cash and ability to bear loss?
What alternatives were considered, and why was the selected investment suitable for this assignment?
What would it cost to buy, hold, and exit the position?
How did the adviser or an affiliate benefit from the recommendation?
What was communicated to the client, and what monitoring was promised?

For example, a hypothetical client expects a home purchase in 18 months while a proposed investment restricts withdrawals for 5 years. A file containing only a general risk questionnaire does not explain how that mismatch was resolved. The useful evidence is the actual liquidity analysis and decision, not a retrospective statement that the client was sophisticated.

Reconcile fees from contract to deduction

Form ADV Part 2A Item 5 calls for disclosures about compensation, fee schedules, negotiability, billing, other expenses, and prepaid-fee refunds. Those disclosures provide a concrete starting point for a billing review. SEC Form ADV instructions.

Select accounts with different fee arrangements: a standard schedule, a negotiated rate, a new account, a terminated account, and an account with a large deposit or withdrawal. Recalculate the charge using the signed agreement’s balance definition and period. Compare that result with the actual deduction and client-facing explanation.

Here is a hypothetical exception to investigate. An agreement charges 0.80% annually, divided into four equal quarterly periods, on a fixed $500,000 billable balance. The resulting quarterly charge is $1,000. A deduction of $1,250 reflects 1.00% annually on those assumptions, a $250 difference. Daily averaging or prorating could change the correct calculation, so establish the contractual method before concluding that an error occurred.

For any confirmed problem, record the affected population, correction, client communication, and preventive change. A corrected spreadsheet without a change to the billing configuration can leave the same issue recurring.

Compare AI marketing with actual capabilities

On March 18, 2024, the SEC announced settled charges against Delphia and Global Predictions concerning false or misleading AI claims. The firms agreed to $400,000 in total civil penalties. The cases give compliance teams a concrete reason to compare advertised capabilities with the systems actually in use. SEC enforcement announcement.

A practical claims review can use a table like this:

Hypothetical public claim	Evidence to examine
AI selects investments	Which model makes which decisions, and where humans intervene
Every recommendation is personalized	Inputs used, exceptions, and treatment of missing information
The system continuously monitors accounts	Actual frequency, alerts, escalation, and service limitations
Client data improves the model	Actual data flows, permissions, vendor terms, and restrictions

Review sales decks, website copy, automated messages, and onboarding statements. Ask the operating team to demonstrate each advertised feature and identify where it is deployed. Record the inputs, outputs, human review, and known service limitations supporting the public description.

Put Regulation S-P deadlines and response duties in the right context

The SEC’s guide to the 2024 Regulation S-P amendments lists compliance dates of December 3, 2025 for larger entities and June 3, 2026 for smaller entities. Covered institutions include SEC-registered investment advisers. The amendments require a written incident-response program and service-provider oversight. The dates have passed as of this article’s review. SEC small-entity compliance guide.

For service-provider oversight, the guide addresses notice as soon as possible and no later than 72 hours after awareness of a qualifying breach. Customer notification is generally due as soon as practicable and within 30 days after awareness of qualifying unauthorized access or use, subject to the investigation exception and permitted delay provisions. Record when each applicable trigger occurred and have the response team assess the corresponding obligation.

For a tabletop exercise, suppose a vendor reports compromised account credentials late on a Friday. Identify who receives the report, preserves facts, assesses affected information, coordinates containment, evaluates notice obligations, and approves communications. Record each step’s time and resolve any gap in responsibility.

Review a business change through to implementation

A firm adding a new service should be able to show how the change reached its agreements, disclosures, billing, systems, and staff training. Consider a hypothetical acquisition that introduces a second custodian and a different fee schedule.

Trace one converted account from onboarding to its first bill. Did the signed schedule survive the migration? Did access permissions change when staff roles changed? Does the client portal show the same service scope as the agreement? Which person owns unresolved differences?

For each issue, record the supporting evidence, affected accounts or process, responsible owner, completion date, and verification of the fix. Use the same fields across departments so compliance can follow an exception from discovery through resolution.

Connect the review to operating records

Build the preparation file around real transactions and follow-up. Attach the relevant policy to a completed recommendation, a recalculated bill, or an incident exercise, and document any correction. Have compliance staff identify the applicable recordkeeping requirement and retention period for each category.

Have compliance staff or counsel confirm which rules apply to the firm’s registration, activities, and clients. Then prioritize concrete gaps: an inaccurate public statement, an unexplained charge, an unresolved access privilege, or an incident process without an accountable owner. For current planning, compare the FY 2027 report with the completed 2026 review and track what has changed.