SEC Examination: 2026 Focus Areas, Process, and Penalties

An SEC examination is a compliance review conducted by the Division of Examinations to test whether a registered investment adviser, broker-dealer, or other market participant is actually doing what federal securities law and its own disclosures require. The staff requests records, interviews employees, compares written policies against real operations, and closes with one of three outcomes: a no-findings letter, a deficiency letter demanding corrective action, or a referral to the Division of Enforcement. Firms that come through cleanly tend to prepare long before the notification call arrives.

Why Your Firm Was Selected

Not every exam starts the same way, and knowing which type you’re facing shapes how you should respond.

Routine exams run on a risk-based cycle. Firms with larger assets under management, complex strategies, or prior compliance issues appear on the schedule more often; smaller and lower-risk firms may go years between visits. Newly registered advisers get priority attention because the staff has found that new firms are statistically more likely to have incomplete compliance infrastructure. ¹

Cause exams are triggered by something specific: a whistleblower tip, an investor complaint, suspicious trading flagged by analytics, or a referral from another regulator. Examiners arrive with a hypothesis about what went wrong and focus narrowly on that concern. These reviews move faster and feel more adversarial than routine exams.

Sweep exams (sometimes called thematic exams) target one issue across many firms at once. The SEC picks a topic, such as cybersecurity, fee disclosure, or off-channel communications, and asks the same set of questions of dozens of firms. If you receive a sweep letter, you are one of many, and the results often feed into risk alerts or new rulemaking.

How the Examination Unfolds

Notification

Most exams are announced. The staff typically calls the chief compliance officer or another regulatory contact and follows up with a letter requesting specific documents. Records are expected within 24 hours in most circumstances, though staff usually provides more time and grants reasonable extensions. In some cases, examiners may show up at a firm’s offices without advance notice. ²

Fieldwork

During the on-site phase, the team requests employee interviews, reviews documents, and observes operations. Meetings can happen in person, by phone, or by videoconference. The staff does not record or transcribe them and instructs the firm not to either. ² Examiners are testing whether the compliance policies on paper match what employees actually do, and they run data analytics against trade logs to catch discrepancies between what people say and what the records show. Designating a knowledgeable point of contact to manage requests keeps the process moving.

Exit Conference

When on-site work wraps up, the staff holds an exit conference to flag issues identified so far and note any outstanding requests. The firm can respond, provide context, or explain data points the examiners may have misread. ² This conversation is preliminary. The examination remains open until the division issues its written conclusion.

What Examiners Will Ask For

Initial document requests typically cover organizational charts, compliance manuals, financial statements, current and terminated employee lists, and all marketing materials. Newly registered advisers should also expect requests for documentation supporting SEC registration eligibility, ownership and affiliate structures, litigation and arbitration history, and details on third-party service providers such as custodians and auditors. ¹

Client data requests are detailed. Examiners commonly ask for client lists in spreadsheet format that include account names, account numbers, current balances, inception dates, account types, custodian information, discretionary authority status, and investment strategy. Securities holdings should be produced with CUSIPs, the number of shares or notional amounts held per client, and any fair valuation flags. ³

Behind those requests are the recordkeeping rules the staff is verifying. Registered advisers must maintain journals, ledgers, order memoranda, and copies of written communications related to recommendations, advice, and transactions under Rule 204-2, kept for five years from the end of the fiscal year in which they were created and held at the principal office for the first two. ⁴ Broker-dealers face parallel obligations under Rules 17a-3 and 17a-4, with retention periods of three or six years depending on the record type. ⁵

Off-Channel Communications

No area of recordkeeping has produced more enforcement dollars in recent years than off-channel communications. Advisers and broker-dealers must capture and preserve business-related written communications, including electronic messages. When employees use personal email, WhatsApp, Signal, or texts to discuss firm business, those messages sit outside the firm’s archival systems, and the SEC treats that gap as a recordkeeping violation.

Since the enforcement sweep launched in late 2021, the SEC has fined over 100 firms a combined total exceeding $2.2 billion. In January 2025, twelve firms agreed to pay more than $63 million, with individual penalties ranging from $600,000 for a firm that self-reported to $12 million for a larger institution. ⁶ The self-reporting discount is real; the Commission has reduced or waived penalties for firms that came forward voluntarily and remediated.

The common findings: compliance policies that don’t address messaging apps employees use daily, failure to preserve messages for the required retention period, and surveillance programs that are either absent or too generic to catch off-channel activity. If nobody at the firm has audited how employees actually communicate against what the written policies allow, that mismatch is what examiners will find.

What Examiners Are Focused On in 2026

The Division of Examinations publishes annual priorities signaling where its attention will land. ⁷

Fiduciary duty and standards of conduct. Whether investment advice and disclosures line up with fiduciary obligations, how financial conflicts shape recommendations, whether advisers weigh cost, liquidity, volatility, and exit costs when recommending products, and whether firms are seeking best execution.

Private funds. Close attention to private credit funds and funds with extended lock-ups, valuation of illiquid assets, liquidity risk management, and fee and expense allocations including operating and portfolio company expenses. Advisers running both private funds and separately managed accounts should expect questions about whether allocations and transfers favor one group of investors over another.

Cybersecurity and Regulation S-P. Governance, data loss prevention, access controls, and incident response, including preparedness for ransomware and risks from artificial intelligence and polymorphic malware. The 2024 amendments to Regulation S-P require firms to build incident response programs that detect, respond to, and recover from unauthorized access to customer information. ⁸ The compliance date for smaller entities is June 3, 2026, and examiners will begin testing for compliance shortly after. ⁹

Newly registered firms. Whether new advisers and investment companies have identified conflicts of interest, provided full and fair disclosure, and adopted effective compliance policies. If you’ve recently registered, the question is not whether the staff will examine you but when.

How the Exam Ends

Three outcomes are possible, and they are not mutually exclusive when a firm has issues in multiple areas. ¹⁰

The best result is a letter stating the examination concluded with no findings. Federal law requires the staff to send this notification no later than 180 days after completing the on-site portion or receiving all requested records, whichever comes later. ¹¹

More often, the exam produces a deficiency letter listing specific shortfalls. The firm is expected to implement corrective actions and submit a written response within 30 days describing what it’s doing about each item. If the response is inadequate or the firm refuses to act, the staff may issue a second letter, schedule a call, or refer the matter to enforcement. The division checks whether corrective actions were actually implemented at the next examination, so paper promises without follow-through tend to backfire. ¹⁰

When examiners find evidence of serious misconduct, they refer the matter to the Division of Enforcement. Enforcement staff may issue a Wells notice signaling intent to recommend charges, then seek Commission authorization for administrative proceedings, injunctive action in federal court, or both. Willful violations can be referred to the Department of Justice for criminal prosecution. ¹²

What Penalties Look Like

Civil penalties follow a three-tier structure adjusted annually for inflation. For 2026, no inflation adjustment was made because the Bureau of Labor Statistics did not publish the required October 2025 data, so the 2025 maximums remain in effect. Per violation, the current caps are $11,823 for an individual and $118,225 for a firm at Tier 1 (general violations); $118,225 and $591,127 respectively at Tier 2 (fraud involved); and $236,451 and $1,182,251 respectively at Tier 3 (fraud with substantial losses or gains). ¹³ Because these are per-violation figures, a single enforcement action can produce penalties in the millions when the same conduct spans many transactions or client accounts. The Commission can also revoke a firm’s registration or bar individuals from the industry.

How to Prepare

The firms that come through examinations well share a few habits. None are complicated, but each requires work before the notification call.

Make sure your compliance manual describes what your firm actually does today, not what it did two years ago. Examiners compare written policies against real operations, and the gap between the two is the single most common source of deficiency findings. If employees use messaging apps your policy doesn’t address, update the policy and start monitoring before the SEC finds the disconnect.

Build a document production capability that can respond in days rather than weeks. Client data, securities holdings, and transaction records should be exportable to spreadsheet format at short notice. Firms that scramble to assemble basic data when the call comes signal to examiners that internal controls may be equally disorganized. ²

Run an annual internal review. Rule 206(4)-7 under the Investment Advisers Act requires registered advisers to review the adequacy of their compliance policies at least once a year. Treat the review as a dry run: confirm that recordkeeping systems are capturing everything they should, that the code of ethics is current, that the cybersecurity incident response plan has been tested, and that the people responsible for compliance can explain what the policies actually say. Issues you catch yourself are the ones that don’t appear in a deficiency letter.

1
U.S. Securities and Exchange Commission. Observations From Examinations of Newly-Registered Advisers
2
U.S. Securities and Exchange Commission. Information for Entities Subject to Examination or Inspection by the Securities and Exchange Commission
3
U.S. Securities and Exchange Commission. Investment Advisers – Assessing Risks, Scoping Examinations, and Requesting Documents
4
eCFR. 17 CFR 275.204-2 – Books and Records to Be Maintained by Investment Advisers
5
eCFR. 17 CFR 240.17a-4 – Records to Be Preserved by Certain Exchange Members, Brokers and Dealers
6
U.S. Securities and Exchange Commission. Twelve Firms to Pay More Than $63 Million Combined to Settle SEC Charges for Recordkeeping Failures
7
U.S. Securities and Exchange Commission. Fiscal Year 2026 Examination Priorities
8
U.S. Securities and Exchange Commission. Regulation S-P – Back to the Future
9
FINRA. SEC Regulation S-P Compliance Date Approaching for Some Entities
10
U.S. Securities and Exchange Commission. Compliance Examination Deficiency Letter Process
11
Office of the Law Revision Counsel. 15 USC 78d-5 – Deadline for Completing Enforcement Investigations and Compliance Examinations and Inspections
12
U.S. Securities and Exchange Commission. Enforcement Manual
13
U.S. Securities and Exchange Commission. Civil Penalties Inflation Adjustments