STP's new Compliance Services Practice, STP ComplianceAdvisor, was created to meet the growing...
As we head into 2026, the SEC’s examination priorities reflect a clear message: operational effectiveness matters more than policies on paper. Regulators are sharpening their focus on areas where technology, vendor relationships, and evolving business models intersect with investor protection. The coming year will bring heightened scrutiny of incident response readiness, vendor oversight, and transparency around AI use, alongside continued attention to Marketing Rule compliance and the complexities of alternative investments. Firms that proactively strengthen governance frameworks, embed compliance into daily operations, and document their practices will be best positioned to navigate this demanding regulatory landscape.
Data Protection and Identity Risk Take Center Stage
Amended Regulation S-P will be a cornerstone of SEC examinations in 2026. While advisers with more than $1.5 billion in assets under management are already required to comply, the majority of advisers will hit the compliance deadline on June 3, 2026.
In the coming year, we expect the SEC to focus on early adopters, using examinations to establish industry benchmarks around incident response preparedness and vendor oversight. Examiners are likely to scrutinize whether firms have operationally effective incident response programs, clear escalation procedures, and documented decision-making around customer notification.
Oversight of service providers will be a key theme. Advisers should expect questions around how their vendors who have access to client information are protecting that information and assurances from the vendor to meet the 72-hour notification requirement.
Alongside Regulation S-P, Regulation S-ID (the Identity Theft Red Flags Rule) is receiving renewed attention. The SEC has indicated it will examine whether advisers have implemented a written Identity Theft Prevention Program that identifies covered accounts, defines red flags, and includes procedures for detection and response. Training and third-party oversight will be critical components of these reviews.
Artificial Intelligence and Cybersecurity: Governance Over Hype
While we don’t expect new rulemaking regarding artificial intelligence and cybersecurity, advisers cannot fully operate in today’s environment without exposure to both of these themes, and they will continue to be a focus for the regulator.
In 2025, the agency launched the Cyber and Emerging Technologies Unit and a dedicated AI Task Force, and we expect the SEC to apply existing securities laws aggressively to AI-related risks. The SEC has been clear that it views AI not as a separate regulatory category, but as an amplifier of traditional concerns such as fraud, disclosure accuracy, cybersecurity resilience, and investor protection.
In 2026, advisers should expect higher expectations around AI governance frameworks, transparency about AI use and dependencies, and consistency between public statements and actual practices. We are likely to see some investigations tied to misleading AI claims, failures to disclose material reliance on AI systems, and misrepresentations about cybersecurity posture, particularly where AI-enabled tools are involved in incidents or control failures.
Adviser M&A: Integration Risk Under the Microscope
A new SEC focus in 2026 centers around advisory M&A activity as a trigger event that can expose weaknesses in compliance programs, supervisory structures, and conflict management.
In 2026, the SEC is likely to focus on whether firms continue to meet their duty of care and loyalty throughout the integration process, as well as ensuring proper disclosures to impacted clients. Areas of attention include system migrations, cybersecurity safeguards, compliance disclosures required by the Marketing Rule, and the harmonization of policies and procedures.
Advisers should proactively identify potential conflicts, such as fee changes, compensation structures, and differential treatment of clients. Advisers should also review the transaction in light of the testimonial and endorsements requirements of the Marketing Rule, as well as disclosures required in Forms ADV and CRS, to ensure all disclosure requirements are met.
Alternatives and Private Funds: Complexity Demands Control
Alternative investments continue their shift from niche allocations to mainstream portfolio components, including in the retail channel. As access expands through registered structures and lower minimums, regulatory expectations around disclosure, suitability, liquidity, and valuation are rising.
At the same time, private fund advisers remain firmly within the SEC’s focus on fiduciary standards of conduct. In 2026, exam attention is expected to concentrate on private fund advisers that also manage retail accounts, those with newly launched funds, and those with limited prior experience in private markets.
Key risk areas include side-by-side management, allocation practices, valuation governance, fee structures, liquidity management, and the use of side letters. Advisers should ensure their compliance programs accurately reflect how these decisions are made in practice, particularly when marketing new strategies or presenting performance.
Marketing Rule Compliance
In late 2025, the SEC issued a Risk Alert highlighting additional observations on advisers’ compliance with the Marketing Rule, with a particular focus on the use of testimonials and endorsements—practices that were prohibited before the rule’s adoption. Advisers choosing to leverage these tools, including solicitors or those promoting awards and third-party rankings, must ensure full compliance with the rule’s requirements, especially regarding clear disclosures of conflicts of interest. Risk Alerts serve as a call to action, urging firms to review both their written policies and day-to-day practices in the areas spotlighted by the SEC. Looking ahead to 2026, we expect examiners to continue scrutinizing all aspects of the Marketing Rule—from testimonials, endorsements, and ratings to conflicts of interest, substantiation of claims, and performance advertising—to confirm advisers are meeting the SEC’s standards.
What This Means for Advisers in 2026
Across all regulatory focus areas, the message from the SEC is consistent: policies alone are not enough. Advisers must demonstrate that their compliance programs operate effectively and reflect real-world practices.
Firms that invest now in strengthening governance, vendor oversight, technology controls, and documentation will be better positioned for successful examinations and avoid regulatory scrutiny in 2026 and beyond.
