2025 Compliance Year in Review: 4 Main Headlines From 2025

2025 was one of the most interesting years for compliance programs in quite some time. A new administration and new approach to governing caused quite a bit of change, shifting landscapes, and second-guessing by chief compliance officers. 2026 looks to be marked by an SEC heading in a new direction.

Let’s look back at the changes in 2025. Be on the lookout for our SEC and compliance-related predictions in 2026.

---

Regulation S-P Goes the Distance

Let’s begin with the biggest rulemaking story from 2025: Amended Regulation S-P (“Amended Reg S-P”) reached its first compliance deadline on December 3, 2025, for large entities (such as RIAs with $1.5 billion or more in assets under management). Despite industry efforts to postpone these amendments, the SEC demonstrated that when a rule has bipartisan support, such as Amended Reg S-P’s unanimous 5-0 commissioner vote, compliance programs must prepare.

• Regulatory Preparedness for Amended Reg S-P – Under the rule, covered institutions must develop (1) a vendor management program to monitor vendors and ensure 72-hour notice of a breach, (2) an incident response policy to adequately detect incidents and respond, including by required 30-day notification to impacted customers, (3) and safeguarding and disposal procedures to properly maintain necessary records and document a firm’s response to and recovery from unauthorized access.
• Amended Reg S-P – Back to the Future – On May 14, 2025, Keith Cassidy, the Acting Director of the SEC’s Division of Examinations, gave a speech on the history and latest amendments to Regulation S-P. He shared details on the need for more protections for investor information and the expected approach for examination of advisers as the applicable compliance deadline passes.
• SEC Holds Amended Reg S-P Outreach Events – Although the government shutdown delayed the original schedule, the SEC held two of three webinars on the new rule, the first aimed at larger firms and the second focused on transfer agents. The first webinar made it clear that Private Fund Managers are expected to have incident response policies that cover any investor information they may receive, and that the Division of Examinations is prepared to conduct an initial Amended Reg S-P exam. These exams will focus on the adoption of written policies and procedures and the implementation of those procedures. The second webinar reinforced these last two points.
• Reg S-P Enforcement Action Under Atkins – The SEC published settled charges against a dual-registrant for compliance failures under the prior version of Regulation S-P. Failure to fully implement cybersecurity protections, incident response policies, and security awareness training at the firm led to malicious phishing, compromised client email accounts, and one incident of an unauthorized wire from a customer account. The firm was censured and charged $325,000 in civil penalties.

The End of the Gensler Era, and the Start of the Atkins SEC

In many ways, 2025 was a year of change for the SEC. A new administration and new chair took the reins and put the SEC on a new path that promises to be more transparent and more in keeping with the SEC’s regulatory roots.

• SEC Formally Withdraws 14 Gensler-Era Proposed Rules – On June 12, 2025, the SEC announced the formal withdrawal of 14 proposed rulemakings published between March 2022 and November 2023. This included withdrawal of the AI Rule, the ESG Rule, the proposed overhaul of the Custody Rule, and the Outsourced Service Provider Rule in a move that marked a clear break from the prior administration.
• Delay, Delay, and more Delay – The compliance deadline for amended Form PF was delayed not once, not twice, but three times in 2025. Rule 13f-2’s Form SHO, which would require firms to report on short-selling activity via the new form, was extended to 2028, in what Commissioner Caroline Crenshaw described as a pattern of “repeal by extension.” Compliance programs must be vigilant, but the trend of extending compliance deadlines caused a lot of starts, stops, and reversals for firms.
• 2026 Examination Priorities – On November 17, 2025, the SEC’s Division of Examinations publishedits 2026 Examination Priorities. The broad categories were largely the same, save for dropping crypto and private fund sub-sections, but the tone has shifted. The priorities reflect a movement away from prescriptive priorities and back to basic principles of compliance rooted in materiality and investor harm.

The SEC Embraces Crypto

Despite a deregulatory trend, 2025 was the year that the SEC completely embraced cryptocurrencies, echoing the White House objective of making America the “crypto capital of the planet.”

• Crypto Advocate Paul Atkins Becomes SEC Chair – While Atkins had served as an SEC commissioner from 2002-2008, he also joined Token Alliance, a cryptocurrency advocacy organization, in 2017 and served as its co-chairman.
• The SEC Created the Crypto Task Force – Commissioner Hester Pierce was chosen to head the SEC’s new Crypto Task Force, which aimed to create a regulatory framework for digital assets, engage with the industry and the public through townhall style roundtables, and increase transparency.
• SEC Approves In-Kind Creations and Redemptions of Crypto ETPs – The SEC removed one structural barrier for asset managers wanting to manage crypto when it approved orders to permit in-kind creations and redemptions by authorized participants for crypto asset exchange-traded product (ETP). This approval put Bitcoin and Ether ETPs on the same footing as other commodity-based ETPs by allowing for creations and redemptions in the underlying commodity.
• Custody No-Action Letter Relief for Crypto – The night before the government shutdown, the SEC published a no-action letter stating it would not recommend enforcement action against an RIA or RIC if a State Trust Company was used as the “bank” to hold crypto assets and related cash or cash equivalents under specific conditions.

The More Things Change, the More They Stay the Same

The first enforcement actions under Atkins and the only risk alert published during 2025 are evidence of a focus on compliance issues that impact investors. Effective compliance programs must meet recordkeeping requirements, follow disclosed billing practices, and publish advertising in compliance with the Marketing Rule. If anyone on your team thought the Atkins Era would be the end of SEC enforcement actions, think again.  These charges and civil penalties illustrate that the Division of Enforcements still has teeth, and CCO liability is alive and well under Atkins.

• SEC Charges CCO for Backdating Annual Reviews, Other Adviser Act Violations – On July 11, 2025, the SEC announced settled charges against the CCO and president of a registered investment adviser for multiple violations. The CCO falsified three years of annual reviews in response to an SEC exam request.
• SEC Charges Investment Adviser for Overcharging Management Fees to Private Funds – On August 15, 2025, the SEC announced settled charges against a firm for its management fee calculation practices for private funds. Undisclosed calculation practices resulted in over $500,000 in excess management fees. For these violations, the SEC ordered the adviser to pay over $1.2 million in civil penalties, disgorged management fees, and interest.
• Marketing Rule Violations Receive $75,000 Penalty – Records of advertising could not be produced during an SEC exam. Additionally, the firm could not substantiate the claim in advertising that it “refuse[d] all conflicts of interest.” All advisers have disclosed conflicts of interest in ADV 2A, making the statement unable to be substantiated as required. This stance has not changed under Atkins.
• Marketing Rule Risk Alert – The only risk alert published in 2025 shows a return to bread-and-butter issues: lack of implementation and inadequate disclosures. The alert focused on third-party promotion in the form of testimonials, endorsements, and third-party ratings and cited numerous examples of deficiencies around compliance rules and clear and prominent disclosures.

What does this mean for me?

The period of confusion between one administration and another has come to an end. Old proposals are gone, and new priorities are in full swing. If you have any questions about shoring up implementation of 2025 compliance issues or about preparing for compliance issues in 2026, such as Amended Reg S-P, our team of regulatory experts can help. Contact us today if you’re interested in learning more.