On October 23, 2026, the SEC’s Division of Examinations published its examination priorities for fiscal year 2027, the year that began on October 1. Fiscal Year 2027 Examination Priorities, Division of Examinations (Oct. 23, 2026), available at sec.gov/files/2027-exam-priorities.pdf; SEC Announces Fiscal Year 2027 Examination Priorities, Press Release No. 2026-109 (Oct. 23, 2026). The document is the staff’s annual statement of where it intends to spend examination resources across more than 34,000 registrants (investment advisers, investment companies, broker-dealers, self-regulatory organizations, clearing agencies, municipal advisors, transfer agents, funding portals, and security-based swap dealers, among others). It is not a rule and creates no new obligations, but it is the most reliable preview a firm gets of the document request it will receive. Most of the list carries over from last year. The changes are at the margins, and they are worth reading closely: the Public Company Accounting Oversight Board joins the list of self-regulatory organizations the Division will inspect, Treasury clearing and tokenization appear for the first time, and anti-money laundering moves into the broker-dealer section. For most readers of this update the practical content is in three places: the adviser section, the broker-dealer section, and the cross-cutting section on cybersecurity and emerging technology, where the Division says for the first time that it will examine how firms are preparing for attacks that are themselves driven by AI.
Investment advisers: conflicts, product selection, and the compliance program
The adviser section opens where it always does, with the fiduciary duty, and then narrows quickly to economic conflicts of interest. The Division will review whether an adviser’s financial conflicts affect the impartiality of its advice in named areas: fee rebates, fee and expense calculations, cash management, quid pro quo arrangements, and deposits and withdrawals. That list comes from the Division’s June 9, 2026 risk alert on economic conflicts, which reported undisclosed and misleading conflict disclosures, advisory agreements that did not match actual practice, and compliance programs that did not address the conflicts at all. An adviser that has not read that alert against its own Form ADV should do so before its next examination, because the examiners will.
The second theme is how advice is formed. Examiners will look at the factors an adviser considers before recommending a product or strategy and whether the result fits the client’s profile, objectives, and risk tolerance, with attention to liquidity, risk and reward, volatility, projected performance across market conditions, time horizon, and cost, including exit cost. The Division names the products it considers difficult: loans made by private funds or business development companies, investments in private companies through special purpose vehicles, and complex or higher-risk vehicles such as exchange-traded funds built on less liquid assets, option-based funds, inverse funds, single-stock funds, and zero-days-to-expiration options. Advisers to private funds will be reviewed for whether their risk disclosures and controls address risk at both the fund level and the investment level, including allocations, fund-level credit lines, affiliated service providers, and fee and expense calculations. Two business practices are singled out: advisers that use third parties to reach into client accounts, where the Division says existing controls may not protect client assets and data, and advisers that rely on proxy advisory firms, where examiners will ask how the adviser evaluates the recommendations and whether that reliance meets its legal obligations.
On compliance programs, the Division will again read the annual review and test whether policies are implemented rather than merely written. It adds a list of circumstances in which it expects a program to have changed: a new business model, a new type of client, advice on a new asset class, a new service, growth through merger or acquisition, and operations spread across geographically dispersed branch offices. An adviser in any of those positions should expect to be asked what it changed in response and what new conflicts it identified. Advisers with activist engagement practices will be checked for timely and accurate filings on Schedules 13D and 13G and Forms 13F, 13H, 3, 4, 5, and N-PX. Advisers that have never been examined, and recently registered advisers in particular, remain a standing priority.
Broker-dealers: financial responsibility, trading, Regulation Best Interest, and anti-money laundering
For broker-dealers the list is longer this year because anti-money laundering, which last year sat in a cross-cutting section, now appears as a broker-dealer priority in its own right. The financial responsibility review will cover the net capital and customer protection rules and will include the recent amendments to the customer protection rule on daily customer reserve computations and U.S. Treasury clearing, together with liquidity and credit risk controls and prime brokerage concentration and counterparty exposure. On trading, the Division will examine how firms handle extended trading hours, whether liquidity providers are willing, ready, and able to provide liquidity on and off exchange, routing and best execution, and the pricing and valuation of illiquid instruments such as private credit and private equity. Municipal securities examinations will focus on priority of orders.
The Regulation Best Interest section is the most specific in the document. Examiners will look at recommendations of products and strategies, including account and rollover recommendations; conflict identification and mitigation; the process for reviewing reasonably available alternatives; the disclosure given to customers; and how the care obligation is met, including costs, the customer’s investment profile, and the characteristics of the product and account type. The products of particular interest are listed by name: variable and registered index-linked annuities; ETFs and other products that invest in illiquid assets such as private equity or private credit; low-priced and small-capitalization securities; zero-days-to-expiration options; single-stock and focused-market ETFs; private placements; structured products; alternative investments; and anything with complex fee structures or return calculations, exotic benchmarks, or limited liquidity. Three kinds of recommendation get separate attention: moving an investment into a substantially similar product, opening option, margin, or self-directed IRA accounts, and recommendations to older and vulnerable investors and those saving for retirement or college. Dual registrants will be reviewed for how they handle conflicts where compensation differs between the brokerage and advisory sides, including the recommendation to open a brokerage account rather than an advisory account, or a wrap fee account. Form CRS will be read for how the firm describes its relationships, fees, conflicts, and disciplinary history. Finally, the Division says it will review how broker-dealers supervise two kinds of payment that have drawn enforcement interest: compensation to unregistered persons who may be acting as finders, and transaction-based compensation paid to personal-service entities that are not registered as broker-dealers.
On anti-money laundering, the Division will ask whether the program is tailored to the firm’s business and updated as it grows, with specific attention to omnibus accounts maintained for foreign financial institutions, independent testing, customer due diligence, suspicious activity reporting, OFAC sanctions screening, and pump-and-dump schemes in foreign-based companies, which it will coordinate with the SEC’s Cross-Border Task Force. Supervision closes the section: whether supervisory systems and written procedures are reasonably designed for the business, including new business lines and products, and whether qualified individuals have been given the authority to carry them out.
Cybersecurity, artificial intelligence and the amended Regulation S-P
The cross-cutting section applies to advisers and broker-dealers alike, and it is where the document is most different from last year’s. One note on terminology before the substance: the document drops the term “artificial intelligence” in favor of “super intelligence,” abbreviated SI, the label the SEC has adopted for its own use of the technology. This update uses the widely adopted term, AI. Cybersecurity remains the lead item, with the familiar list of governance, data loss prevention, access controls, account management, and incident response and recovery, including ransomware, and with an added emphasis on third-party service providers and shared technologies. What is new is the framing of the threat. The Division writes that threat actors are using AI to automate and accelerate cyberattacks, making them more efficient and harder to detect, and that examinations will focus on how firms assess and prepare for AI-related attacks on their businesses and their customers, giving as examples AI-generated phishing messages and synthetic or deepfake voice and video used for social engineering. In the cybersecurity section of last year’s document, AI appeared in a single sentence about training and security controls. This year it is a stated examination focus, and a firm should expect to be asked what it has done about a convincing fake of a client’s voice requesting a wire.
The Regulation S-P paragraph deserves equal attention, because this is the first fiscal year in which every covered firm is past its compliance date under the May 2024 amendments. The amended rule required an incident response program, customer notification of breaches, and oversight of service providers; the compliance deadline was December 3, 2025 for larger firms and June 3, 2026 for everyone else. The Division says examiners will evaluate response program policies and procedures for unauthorized access to or use of customer information, including customer notification procedures and oversight of service providers, and will review how firms are addressing operational and technology risk as part of safeguarding customer information. A firm that treated the amendments as a policy update and has never tested its response program should assume that gap will be found. Regulation S-ID, the identity theft red flags rule, is paired with it: the focus is on detection of and response to red flags during customer account takeovers and fraudulent transfers, and on whether the identity theft prevention program has been updated for AI-enabled fraud and stolen credentials.
The emerging technology section also covers a firm’s own use of these tools. The Division notes that registrants are using them for research, drafting, client communications, investment analysis, portfolio management, and compliance monitoring, and it will prioritize policies and procedures for monitoring that use in fraud prevention, back-office operations, anti-money laundering, Regulation Best Interest compliance, and trading. For automated investment tools, trading algorithms, and firms that offer automated advisory services, the review will ask three questions: whether the firm’s representations about the technology are fair and accurate, whether operations and controls match what was disclosed to investors, and whether the algorithms produce advice consistent with the investor’s profile and stated strategy. The first of those is the one that has produced enforcement actions, and the Division has said it will continue to check claims about AI capabilities against what the firm actually uses.
What else changed, and what did not
The PCAOB appears as an examination target for the first time, alongside the exchanges, FINRA, and the MSRB; the Division gives no reason. Clearing agency examinations will prioritize compliance with the new rules on expanded Treasury clearing, and the Division lists tokenization of securities, extended trading hours, and quantum computing among the trends it will follow under Regulation SCI. Transfer agents and funding portals will be examined for compliance with the amended Regulation S-P. The document’s opening message also records two process changes the Division has made this year: the new Exam Handbook, which replaced the old examination brochure with a stage-by-stage account of what to expect, and new memoranda of understanding with the Commodity Futures Trading Commission and the National Futures Association, together with closer coordination with FINRA, which for a dual-registered or jointly regulated firm raises the prospect of coordinated or aligned examinations.
What advisers and broker-dealers should do now
An adviser should read the June 2026 economic conflicts risk alert against its Form ADV and advisory agreements, confirm that its annual review this year addresses any change in business model, client type, asset class, or structure, and, if it recommends any of the products the Division names as difficult to trade, document how those recommendations fit each client. A broker-dealer should check its Regulation Best Interest procedures against the product list above, confirm that its finder and personal-service-entity payments are supervised and documented, and, if it carries omnibus accounts for foreign institutions, make sure the AML program says so and addresses the risk. Both should test their Regulation S-P incident response program against a realistic scenario rather than reading it, train staff on deepfake voice and video requests, and reconcile every public statement about AI or automated tools with what the firm actually does. The Division has told firms where it will look; the firms that will have an easy fiscal year are the ones that look there first.
For more information. Evans Law, PC advises investment advisers and broker-dealers on examination preparation, compliance programs, and responses to examination findings. See our Investment Adviser Services and Broker-Dealer Services pages. To review your compliance program against the fiscal year 2027 priorities, contact Evans Law, PC.