Each year, the SEC's Division of Examinations publishes the areas it considers highest-risk for investors and market integrity. On 23 October 2026, the SEC published its FY2027 examination priorities. The list covers investment advisers, broker-dealers, investment companies, clearing agencies, and other registrants.

Read closely, it carries one consistent message: examiners will test whether what firms do matches what firms say, and they will be paying special attention to technology, conflicts of interest, and complex products. 

A caveat worth stating plainly: these priorities are staff views, not rules, and they create no new legal obligations. But still they show where examiners will spend their time, which is exactly where firms should spend theirs. 
As technology accelerates, products grow more opaque, and business models shift, the SEC is testing a simple proposition: Does what your firm actually do match what it claims to do? 

Here is how that thesis plays out across the SEC’s core focus areas for the year ahead—and how compliance teams should respond before the knock on the door comes.

1. Conflicts of interest: the headline act

For investment advisers, economic conflicts of interest sit squarely at the center of the FY2027 agenda. That shouldn’t come as a shock. Following a pointed June 2026 risk alert that called out undisclosed conflicts, half-baked disclosures, and asleep-at-the-wheel compliance programs, the Division is doubling down. 

Examiners are looking directly at the plumbing of firm revenue: fee rebates, fee and expense calculations, cash management sweeps, quid pro quo arrangements, and deposit and withdrawal practices.  
 
The question isn't merely whether you have a conflict policy on file. It is whether your compensation structures, especially those quietly baked into account and product recommendations, are compromising the impartiality of your advice, and whether clients are being told the whole truth in plain English. 

2. Super intelligence: welcomed, but not unsupervised

If one theme feels new, it is super intelligence (SI) or artificial intelligence (AI). The SEC observes that registrants are increasingly using AI in research, drafting, coding, client communications, portfolio management, and compliance monitoring and surveillance.  

To its credit, the Division isn’t trying to stand in the way of technological adoption. Instead, it is asking a far more uncomfortable question: Can you actually govern the tools you are deploying? 

Examiners plan to focus on four things: 

• Governance and supervision: How is AI overseen across trading, back-office operations, fraud prevention, AML, and Reg BI compliance? 

• Truth in advertising: Are firms "AI-washing"? Operations must match public disclosures, and algorithmic advice must genuinely align with client profiles. 

• The new threat landscape: How are firms defending against SI-enabled social engineering, including deepfake voice and video calls and hyper-targeted phishing? 

• Regulation S-ID: Have identity-theft prevention programs been modernized to account for stolen credentials and synthetic identities? 

The Division is working to bring SI tools into examinations and risk assessment. These tools are intended to support examiners, who remain responsible for their judgments. 

3. Hard-to-trade products get a harder look

As investors hunt for yield and downside protection, capital has flooded into complex, illiquid, and hard-to-trade corners of the market. The SEC has noticed, and its FY2027 hit list is exhaustive: 

• Private credit and loans from private funds or BDCs 

• Private company investments through special purpose vehicles 

• ETFs based on less liquid assets, option-based funds, and inverse and single-stock ETFs 

• Zero-days-to-expiration options 

• Variable and registered index-linked annuities, structured products, and private placements 

Due diligence should reflect the product’s risks and the investor’s circumstances. Firms should be able to explain the costs, liquidity and valuation risks, and why the recommendation meets the applicable fiduciary or Reg BI standard. 

4. Reg BI is still the retail benchmark

For broker-dealers, including dual registrants, the Regulation Best Interest (Reg BI), the SEC hasn’t changed the tune here, account and rollover recommendations, conflict mitigation, consideration of reasonably available alternatives, and Form CRS accuracy remain the bedrock, particularly when dealing with older or vulnerable investors.  
 
But compliance officers shouldn’t mistake a steady priority for a stale one. When the SEC keeps a priority on the list year after year, it means examiners have moved past the basics. Their questions are getting sharper, and your documentation needs to keep pace.

5. AML programs get a cross-border lens

Broker-dealers should expect examiners to assess whether AML programs are tailored to the business and kept current, with particular attention to omnibus accounts (especially for foreign financial institutions) and periods of significant growth. Other focus areas include: 

• Independent testing 

• Ongoing customer due diligence 

• SAR filing obligations 

• Trading in foreign-based companies, including "pump-and-dump" and "ramp-and-dump" schemes, coordinated with the SEC's Cross-Border Task Force 

• Monitoring of OFAC sanctions and compliance with them 

For foreign omnibus accounts, examiners may review "special due diligence" programs for foreign correspondent accounts, especially where underlying customers or beneficial owners are unknown because of nested relationships. Those blind spots are where risk tends to hide. 

6. Cybersecurity, Reg S-P, and the vendor problem 

Cybersecurity remains a core priority: governance, data loss prevention, access controls, account management, and incident response and recovery, including for ransomware.  
 
The SEC’s cybersecurity and amended Regulation S-P priorities make one thing abundantly clear: outsourcing a function does not outsource accountability.  
 
Whether it is advisers granting third-party providers access to client accounts, transfer agents and funding portals adjusting to amended Reg S-P, or SCI entities leaning on cloud vendors, examiners want to see rigorous vendor oversight, tested incident-response playbooks, and airtight customer notification procedures. 

7. Growth is a compliance event 

Finally, the SEC reminds the industry that growth itself is a compliance event.  
Mergers, acquisitions, new asset classes, dispersed branch networks, and rapid scaling are great for the bottom line, but to an examiner, rapid change is the exact moment when internal controls tend to fracture. 

The Compliance Playbook for FY2027 - Recommendations

Audit practice against paper: Pull your latest disclosures, marketing decks, and compliance manuals, and put them side-by-side with your actual fee calculations, cash sweep practices, and trading operations. Find the discrepancies before an examiner does. 

Map your AI footprint: You cannot govern shadow AI. Map every instance of AI across the firm, assign clear human ownership, verify that public claims about automation aren't inflated, and document how algorithmic outputs are tested. 

Rebuild the threat model: Add deepfake voice and video and AI-generated phishing to training, call-back and verification procedures, and account-takeover red flags. 

Treat conflicts as a program: Map compensation, rebates, affiliated services, and cash management and deposit arrangements. Then confirm that procedures are followed and the evidence exists. 

Pressure-test complex product processes: Revisit due diligence, Care Obligation documentation, and valuation practices for private credit, leveraged and inverse ETFs, annuities, and options-based products, especially for retail, older, and retirement-saving clients. 

Re-examine AML tailoring and testing (broker-dealers): Check that your risk assessment reflects your current business mix, growth, foreign omnibus exposure, and cross-border trading patterns. Make sure independent testing is meaningful and that sanctions and SAR processes are documented.  
Firms running manual or fragmented screening and monitoring workflows should ask where better data and automation could reduce risk. 

Tighten third-party oversight: Inventory vendors with access to client accounts or data, confirm contractual and monitoring controls, and make sure your Reg S-P incident response covers service providers. 

Treat change as a compliance event: Mergers, new products, new client types, and new branches should trigger a program review and a fresh conflicts assessment. 

Use the SEC’s own tools. The Division recently published The SEC Exam Handbook: A Practical Guide on Process and Engagement, and it regularly issues risk alerts. Both are useful for mock exams and benchmarking. 

The bottom line

The FY2027 priorities reinforce a familiar message with a modern twist: fundamentals such as fiduciary duty, AML, supervision, and customer protection are not going away, but examiners are paying closer attention to how technology changes the risk picture.  

The firms best placed for the coming year will be those that can show a program that is tailored, well tested and well documented.