What do the SEC's 2026 exam priorities signal for RIAs in FY2027?

Has the SEC published its FY2027 exam priorities yet?

Not as of mid-October 2026. The SEC's fiscal year 2027 began October 1, 2026, and the Division of Examinations has not yet released its annual priorities document. Last year's list came out on November 17, 2025, about seven weeks into fiscal 2026, so a release in the coming weeks would fit the pattern.

That timing gap matters less than it seems. Exams that open this fall are already being scoped, and the best evidence of what examiners will ask an RIA in 2027 is the SEC exam priorities for 2026, plus what the staff has published since. This piece reads both, so a CCO can prepare now and adjust when the new list lands.

What did the SEC's 2026 exam priorities say about RIAs?

The SEC's 2026 exam priorities put fiduciary duty, compliance programs and never-examined advisers at the center for RIAs. The priorities document said examiners would test adherence to the duties of care and loyalty, with attention to retail investors, older investors, alternative and complex products, dual-registered firms, advisers using third parties to access client accounts, and advisers that merged or were acquired.

On compliance programs, the Division listed core areas it reviews at every adviser: marketing, valuation, trading, portfolio management, disclosure and filings, and custody. It also said it would review annual compliance reviews and whether policies are reasonably designed to address conflicts of interest. And it said it would again prioritize advisers that have never been examined, especially recently registered ones.

The Division also framed the year with a tone change. Chairman Paul Atkins said in the release that examinations "should not be a 'gotcha' exercise." That is a statement about approach. The underlying rules did not change, and neither did an adviser's obligation to show its work.

What did the 2026 priorities say about cybersecurity and Reg S-P?

Information security had its own section, and Regulation S-P was the headline new item. The document said examiners would look at cybersecurity governance, data loss prevention, access controls, account management, and incident response and recovery, including ransomware. It also named controls for risks tied to AI and polymorphic malware, and operational resiliency.

For Regulation S-P, the Division said that before a firm's compliance date, examiners would ask about progress toward an incident response program, and after that date they would review the firm's policies and procedures for administrative, technical and physical safeguards. Both compliance dates have now passed: December 3, 2025 for larger entities and June 3, 2026 for smaller entities, per the SEC's small entity compliance guide. Every covered RIA is now in the "after" category.

The same section covered Regulation S-ID, the identity theft red flags rule, with a focus on detecting account takeovers and fraudulent transfers and on staff training. Vendor oversight ran through both.

What SEC risk alerts came out in 2026?

The Division published two adviser risk alerts in 2026 that show where findings are clustering. On June 9, 2026, it published observations on economic conflicts of interest, covering cash sweep programs, share class selection, Form ADV disclosures and fee billing errors.

On September 14, 2026, it published observations on annual compliance reviews under Rule 206(4)-7. The staff saw reviews that skipped a year or ran longer than 12 months, procedures that called for testing without saying what to test, reviews run against outdated versions of policies, policies that delegated functions to others without explaining how the adviser would oversee them, review documentation that was never kept in the books and records, and recommendations from prior reviews that were never acted on.

Only one September observation touches security directly: review procedures that left identity theft testing out of scope. The rest still apply to cybersecurity. A Reg S-P program is part of the compliance program the annual review must cover, and most of the technology work behind it is delegated to an IT provider or internal team.

Which 2026 themes are likely to carry into FY2027?

Themes that rest on rules already in force are the most likely to carry into FY2027. That is our reading of the record. The SEC has made no forecast, and the Division states that its priorities are not the only areas it will address in examinations.

Three areas rest on obligations that did not expire with fiscal 2026:

• Regulation S-P. The amended rule is fully in effect, so the first full exam cycle after both compliance dates will test whether written programs match practice.
• The annual compliance review. The September risk alert tells advisers exactly what examiners found weak, and the 2026 priorities already describe annual reviews as a routine part of adviser exams.
• Oversight of delegated and outsourced functions. It appears in the FY2026 priorities for third parties with account access, in Reg S-P's service provider provision, and in the September risk alert.

AI is a fourth candidate. The 2026 priorities said examiners would review the accuracy of firms' AI claims and whether firms supervise their use of AI. We expect the topic to stay on the list in some form, though the SEC has not said so.

What should an RIA do before the FY2027 list lands?

Treat the next eight weeks as an evidence check. Examiners ask for documents, so each item below ends in something a CCO can hand over.

• Pull your last two annual review reports. Confirm the dates are no more than 12 months apart, that the review used the current version of each policy, and that the testing records sit in your books and records under Rule 204-2(a)(17)(ii).
• List every open recommendation from the last review. Record who owns it, its status, and the date it closed. Unclosed items from a prior review were a named finding in September.
• Map each Reg S-P requirement to a document: the written incident response program and its most recent annual review, the service provider oversight procedures, the records of any incident assessments, and the records required under Rule 204-2(a)(25).
• Write down how you oversee each delegated technology function: what the provider reports, how often, who reviews it, and where the review is recorded.
• Inventory the AI tools staff use, what client data they can reach, and how use is supervised. If marketing materials describe AI capabilities, confirm the description matches what the tool does.
• Check your Reg S-ID program covers account takeover scenarios and that staff training on red flags is documented.

When the FY2027 document is released, read the investment adviser and information security sections first, compare them to this list, and adjust. Most of the work above will still apply.

How does s90 help?

s90 runs IT for RIAs and other regulated firms in Los Angeles and Orange County, and we build the technology evidence a CCO needs into monthly reporting. Our agreements commit us to notify clients of a breach within 72 hours and to produce requested evidence within 24 hours, which maps directly to Reg S-P's service provider requirements. If you want a second set of eyes on your evidence before your next exam, we are happy to talk it through.