SEC’s 2027 Exam Priorities: What Your Compliance Program Needs to Strengthen

October 26, 2026

What Happened?

On October 23, the SEC’s Division of Examinations (the “Division”) published its 2027 Examination Priorities. The SEC’s fiscal year runs from October 1^st to September 30^th, and these annual priorities highlight practices and products viewed by the Division as presenting heightened risks to investors and the markets overall. This annual list of priorities lets firms know what the Division is likely to scrutinize during examinations in the new fiscal year and where firms should focus on improving their risk-based compliance programs.

---

This year, several new priorities were chosen as focus areas alongside top priorities from last year, such as Regulation S-P. Focus areas named as priorities for investment advisers included:

Conflicts of Interest – One of the few risk alerts from 2026 concerned economic conflicts of interest (see our prior coverage). It is no surprise that the Division will focus on fiduciary duty, a facet of which is economic conflicts of interest. The Division will assess whether an adviser’s financial conflicts may affect the impartiality of advice in certain areas, such as fee rebates, fee and expense calculations, cash management, quid pro quo arrangements, deposits, and withdrawals.

Investment Advice – Another familiar focus area is suitable investment advice. The Division will evaluate the factors used to provide investment advice, such as liquidity, risk profile and potential rewards, volatility, projected performance across diverse market and economic conditions, time horizons, and costs (including exit costs), and assess whether such advice is consistent with client profiles, investment objectives, risk tolerance, and other mandates.

Complex Products – Here, the Division moved away from “complex products” and instead is prioritizing products that are “difficult to trade, have unusual features, or are illiquid.” This focus area includes alternative investment products, such as loans provided by private funds or business development companies (BDCs), investments in private companies through special purpose vehicles, and complex and higher-risk investments such as exchange-traded funds (ETFs) based on less liquid assets, option-based funds, inverse ETFs, single stock ETFs, and zero-days-to-expiration options.

Private Funds – The Division will scrutinize investment-related disclosures of risks for consistency with fiduciary standards, and whether compliance policies, procedures, and controls are designed to address both fund-level and investment-level risks. Examples include disclosures related to certain investments and allocations, use of debt and fund-level lines of credit, use of affiliated service providers, and the accuracy of fee and expense calculations at both the fund and investment levels.

---

Focus areas chosen for all market participants included:

• Cybersecurity – Operational resiliency, cybersecurity, and protection of customer information are evergreen priorities.
  • Firm Protection – The Division will continue to review firms’ policies and procedures regarding governance practices, data loss prevention, access controls, account management, and the response and recovery protocols for cyber-related incidents, including ransomware attacks.
  • Third-party Risks – The Division will assess risks associated with registrants’ increased use of third-party service providers and shared technologies, including the effectiveness of risk management in these areas.

• Emerging technologies – Artificial intelligence is now called “Super Intelligence” or “SI” in the Examination Priorities.
  • Firm Use of SI – The Division said it will focus on firm monitoring of SI and other advanced technologies that may affect market operations, compliance, fraud prevention, and investor protection.
  • SI-related Threats – The Division will also focus on SI-related threats and compliance with the relevant rules relating to assessment and preparation for potential threats from SI-related cyberattacks, such as SI-generated phishing messaging and synthetic or deepfake voice and video used for social engineering.

• Regulation S-P – Last but not least, Regulation S-P was again named as a priority. The Division will continue to focus on whether firms have developed reasonably designed policies and procedures addressing the safeguards to protect customer information required by Regulation S-P. However, you can now expect examiners to focus on implementation of those policies and procedures, especially around incident response, customer notification, and oversight of service providers.

---

What does this mean for me?

Advisers should use the start of the fiscal year to take stock and consider the following steps:

• Inventory and govern your use of AI and SI. Know which tools your firm and your vendors are using, what data they can access, and how outputs are supervised. Make sure your policies, disclosures, and marketing claims about AI or SI are accurate and reflect what you actually do.
• Prepare staff for SI-enabled threats. Update training and verification procedures to address SI-generated phishing, deepfake voice and video, and other social engineering tactics, especially for wire requests and changes to client account information.
• Move from Regulation S-P policies to proven implementation. With the amended Regulation S-P compliance dates now passed, examiners will expect evidence that your incident response program, customer notification procedures, and service provider oversight are operating as designed. Consider a tabletop exercise and a review of vendor contracts and due diligence files before an examiner asks for them.

---

How Fairview can help

Fairview provides comprehensive, ongoing compliance administration for registered investment advisers, including annual reviews, policy and procedure updates, forensic testing, and complete SEC examination support from document request through deficiency response.

AI and SI Support: As firms adopt AI and SI tools, Fairview helps advisers build practical governance around them. We help firms inventory AI use across business and vendor relationships, assess related risks and conflicts, draft or update AI policies and disclosures, and design supervision and testing that examiners will expect to see.

Cyber Solutions: Our Cyber Solutions practice specializes in creating and testing meaningful cybersecurity and vendor due diligence programs for financial services firms. We help advisers meet the requirements of the amended Regulation S-P, including developing and testing incident response programs, customer notification procedures, and service provider oversight, as well as conducting tabletop exercises and preparing staff for emerging SI-driven threats like deepfakes and advanced phishing.

Contact us today if you have questions about the examination process or the 2027 Examination Priorities, or if you’re interested in support for your firm.