Why Firms Should Revisit Compliance Priorities Ahead of the New Fiscal Cycle

Most registered investment advisers, investment companies, and broker-dealers do not stop to evaluate whether their compliance programs match the SEC’s evolving focus areas in the middle of the year. The question tends to come up when annual reviews roll around, examination notices land, or senior leadership realizes that emerging technologies and shifting market dynamics have outpaced existing policies. For a lean firm, that convergence can expose gaps in oversight that may not have been apparent earlier in the cycle.

The SEC's Division of Examinations recently released its Fiscal Year 2027 Examination Priorities, outlining where examiners will focus their resources across market participants. Understanding these priorities helps firms get ahead of regulatory scrutiny. This article covers what the 2027 priorities emphasize across key market sectors, how the SEC is integrating advanced technology into its oversight, and where firms should focus their compliance efforts.

Key Takeaways

What to know before you scope your compliance program for 2027

1. The SEC is sharpening its focus on fiduciary standards, economic conflicts of interest, and complex or illiquid products across both investment advisers and retail broker-dealers.

2. The Division of Examinations is actively integrating Artificial Intelligence (“AI”) and generative tools into its own risk assessment and examination workflows, while closely scrutinizing how registrants deploy these technologies.

3. Cybersecurity, operational resilience, and compliance with newly amended rules—such as Regulation S-P and Regulation S-ID—remain critical areas of supervisory review.

4. Never-before-examined and recently registered entities continue to be a high-priority target for initial baseline examinations.

What the SEC is Targeting Across Key Sectors

1. Investment Advisers: Fiduciary Duty, Conflicts, and Complex Products

For investment advisers, the Division continues to prioritize adherence to fiduciary duties. Key areas of review include:

• Economic Conflicts of Interest: Scrutinizing fee rebates, fee and expense calculations, cash management, quid pro quo arrangements, and account withdrawals to ensure full and fair disclosure.
• Formulation of Investment Advice: Assessing whether recommendations align with client profiles, risk tolerances, time horizons, and cost structures. Examiners will look closely at complex, illiquid, or hard-to-trade alternative products (such as private fund loans, BDCs, option-based funds, inverse ETFs, and single-stock ETFs).
• Compliance Program Evolution: Evaluating whether firms have adapted their compliance frameworks to account for business model changes, mergers, acquisitions, or multi-office expansion.

2. Investment Companies (RICs and ETFs)

Given their significance to retail and retirement investors, registered investment companies remain a primary focus. Examinations will center on:

• Fund Fees and Expenses: Reviewing fee structures, waivers, and reimbursements.
• Portfolio Management & Disclosures: Ensuring portfolio practices align with stated strategies, marketing materials, and regulatory filings.
• Complex and Illiquid Holdings: Monitoring funds holding private credit, leverage vulnerabilities (such as BDCs or leveraged ETFs), and compliance with exemptive orders.

3. Broker-Dealers: Regulation Best Interest and Financial Responsibility

Examinations of broker-dealers will target several foundational risk areas:

• Regulation Best Interest (Reg BI): Reviewing recommendations regarding complex products, account types (e.g., brokerage vs. advisory), rollovers, and mitigation of dual-registrant conflicts.
• Financial Responsibility: Testing compliance with Net Capital and Customer Protection rules, including daily reserve computations and liquidity risk management.
• Anti-Money Laundering (AML): Evaluating tailored AML programs, foreign omnibus account risks, and ongoing customer due diligence.

The Technology Shift: "Artificial Intelligence" and Cybersecurity

A prominent theme in the 2027 priorities is the rapid evolution of technology.

• Registrant Use of AI: Firms are increasingly embedding generative AI and "Artificial intelligence" tools into research, drafting, coding, trading, and compliance monitoring. The SEC will examine whether firms maintain adequate oversight, disclosures, and risk controls around these tools.
• SEC Modernization & Exam Integration: The Division itself is deploying AI-supported tools to analyze extensive datasets, improve workflow efficiency, and detect patterns across complex filings—supplementing, but not replacing, examiner judgment.
• Cybersecurity and Safeguards: Cybersecurity remains a top-tier priority. Under amended Regulation S-P and Regulation S-ID, examiners will review administrative, technical, and physical safeguards, incident response programs, vendor risk management, and identity theft prevention protocols (especially regarding account takeovers and SI-driven cyber threats like deepfakes and advanced phishing).

Where Compliance Programs Should Focus Now

With the SEC increasing its analytical capabilities and focusing heavily on operational controls, firms should take a proactive approach:

• Review and Update Risk Disclosures: Ensure that disclosures regarding economic conflicts of interest, fee structures, and alternative product risks are transparent and strictly enforced.
• Audit Technology and AI Governance: If your firm utilizes automated tools, algorithms, or generative AI, verify that supervisory controls, testing protocols, and client representations are fully aligned.
• Validate Regulation S-P Readiness: Confirm that incident response programs, customer notification procedures, and third-party vendor oversight meet updated regulatory standards.

If you are evaluating how to structure your compliance program or prepare your firm for evolving regulatory expectations ahead of the upcoming cycle, Stable Rock’s Regulatory & Compliance team can help you assess your readiness.

Talk to our Regulatory & Compliance team → stablerock.com/contact