SEC FY 2027 Exam Priorities What RIAs Need to Know
SEC FY 2027 Exam Priorities What RIAs Need to Know
SEC FY 2027 Exam Priorities What RIAs Need to Know
The SEC’s fiscal year examination priorities are not just a preview of regulatory themes. For Registered Investment Advisers, they are a practical roadmap for what examiners are likely to test, question, and document.
On October 23, 2026, the Securities and Exchange Commission’s Division of Examinations released its Fiscal Year 2027 Examination Priorities. The report gives RIAs a clear signal about where the Division intends to focus during upcoming audits. Under SEC Chairman Paul S. Atkins and Division Director Keith Cassidy, the Division appears focused on a rigorous, data-informed exam program that reacts to changing markets, new products, and emerging client risks.
For compliance teams, the message is direct: do not wait for an exam letter to find gaps. The best defense is a proactive offense.
This article is informational only and is not legal advice. RIAs should consult qualified counsel or compliance professionals about firm-specific obligations.
Fiduciary duty remains the center of the RIA exam
The fiduciary standard remains the foundation of the RIA model. For FY 2027, examiners are expected to focus closely on whether investment advice, recommendations, disclosures, and internal controls align with the client’s best interest.
That means the SEC will not look only at what appears in a firm’s documents. Examiners will compare written policies with actual practices. If the Form ADV says one thing, the compliance manual says another, and client files show something else, that inconsistency may become an exam issue.
Key areas RIAs should review include:
How the firm identifies conflicts of interest
How those conflicts are disclosed to clients
Whether disclosures are specific enough to be meaningful
How the firm mitigates or eliminates conflicts where disclosure alone is not enough
Whether recommendations are supported by client objectives, risk tolerance, liquidity needs, and time horizon
A generic conflict disclosure may not be enough. For example, saying a firm “may receive compensation from certain products” is less useful if the firm regularly recommends products that create higher compensation or other incentives. Examiners may ask whether clients can understand the conflict and its practical effect.
What RIAs should do now
Start with Form ADV Part 2A, Part 2B, client agreements, and the compliance manual. Confirm that each document reflects how the firm actually operates today.
Focus on these questions:
Have fee arrangements changed?
Has the firm added new services, products, custodians, or referral relationships?
Do disclosures explain conflicts in plain English?
Does the annual compliance review address real testing, or does it simply repeat last year’s language?
Can the firm show how it responded to issues found during testing?
The annual review should be more than a calendar item. It should show that the firm tested its controls, found issues where applicable, and took steps to correct them.
Retail investor protection will drive product scrutiny
Retail investor protection continues to be a core SEC priority. For FY 2027, RIAs should expect close attention on recommendations involving complex, higher-risk, or illiquid products.
This may include:
Alternative investments
Structured products
Private funds offered to retail or high-net-worth clients
Non-traded real estate products
Illiquid credit products
Strategies using derivatives or leverage
Crypto-related exposure, where offered or recommended
The issue is not whether these products are always inappropriate. The issue is whether the firm can prove that the recommendation fit the client.
For complex products, examiners may look for evidence that the firm understood the product and explained the key risks to the client. A signed subscription document alone may not carry the full weight. Documentation should show why the product made sense in the broader portfolio.
Suitability is not enough for RIAs
Broker-dealer suitability concepts do not replace an RIA’s fiduciary duty. RIAs must be able to show that advice was in the client’s best interest, based on the client’s full profile and the firm’s understanding of the product.
A strong file may include:
Notes explaining why the product was recommended
Evidence of liquidity analysis
Product due diligence records
Client risk profile and investment objective records
Documentation of alternatives considered
Clear disclosure of fees, limitations, redemption terms, and risks
If a product is illiquid, the file should explain why a client can bear that illiquidity. If a product has complex fees, the firm should be able to show that the client received clear disclosure.
Compliance programs must match the firm’s real business
A compliance manual is not useful if it describes a firm that no longer exists.
The SEC’s focus on core compliance programs means RIAs should expect examiners to test whether policies and procedures are reasonably designed for the firm’s current operations. Examiners may review whether the firm’s compliance program covers its actual advisory services, client base, trading practices, marketing activity, fee billing, custody exposure, and supervision model.
This is especially important for firms that have grown, changed ownership, launched new services, adopted new technology, or expanded into new client segments.
A policy that looks complete on paper can still fail if no one follows it, tests it, or updates it.
Areas that often create exam risk
Many firms do not have one major compliance failure. Instead, risk builds through small gaps that remain unresolved.
Common examples include:
The fee billing process changed, but the written policy did not
New marketing practices were adopted before review procedures were updated
A portfolio management system changed, but exception reports were not revised
The firm began using outside consultants, but vendor oversight stayed informal
The Code of Ethics exists, but personal trading reviews are inconsistent
Client files lack enough support for recommendations
The exam risk rises when these gaps affect clients or appear repeatedly.
A practical compliance program check
RIAs should compare three things side by side:
Review area | What to compare | Why it matters |
Disclosures | Form ADV, client agreements, website language, marketing materials | Examiners look for consistency and accuracy |
Policies | Compliance manual, Code of Ethics, testing calendars | Written procedures should reflect real controls |
Records | Client files, billing records, trade reviews, due diligence notes | Records should prove the firm followed its process |
This exercise often reveals outdated language, missing records, or procedures that staff no longer use.
Conflicts of interest need clear disclosure and real controls
Conflicts are a recurring exam concern because they cut across nearly every part of an advisory business. The SEC will likely continue to examine whether firms identify conflicts, disclose them fully, and manage them in practice.
Conflicts may arise from:
Revenue sharing
Referral arrangements
Proprietary products
Affiliated service providers
Compensation differences across products
Gifts and entertainment
Outside business activities
Personal trading
Allocation of investment opportunities
Fee billing practices
The most effective conflict review starts with a simple inventory. List every place where the firm, its personnel, or an affiliate may benefit in a way that could affect advice to clients.
Then ask whether the conflict is disclosed, mitigated, or eliminated.
Disclosure should be specific
A vague disclosure may not help clients understand the issue. If a conflict affects compensation, product selection, allocation, or recommendations, the disclosure should explain how.
For example, if the firm receives different compensation depending on the product used, the disclosure should say that clearly. If the firm recommends an affiliated manager, the client should understand the relationship and the resulting incentive.
Policies should also show what the firm does about the conflict. Disclosure alone may not satisfy regulatory expectations if the firm has no process to reduce the risk of harm.
Marketing, testimonials, and performance claims remain high-risk
RIA marketing has changed quickly. Websites, podcasts, webinars, paid promoters, testimonials, endorsements, and performance presentations can all create exam risk if controls do not keep up.
The SEC’s Marketing Rule has been in effect long enough that examiners may expect firms to have mature review procedures. RIAs should be ready to show how marketing materials are approved, archived, tested, and corrected when needed.
Common risk areas include:
Testimonials or endorsements without required disclosures
Misleading performance claims
Cherry-picked results
Improper hypothetical performance use
Promoter arrangements without adequate oversight
Website language that overstates services or experience
Outdated claims that remain published
Marketing review should not focus only on glossy brochures. Examiners may review websites, pitch materials, client communications, videos, newsletters, and third-party profiles.
Performance claims need support
If a firm presents performance, it should be able to support the numbers and the methodology. That includes knowing which accounts are included, which are excluded, how fees are treated, and whether the presentation is fair and balanced.
If a claim cannot be supported quickly, it should not be used.
Cybersecurity and data protection are compliance priorities
Cybersecurity is now a core RIA compliance issue, not just an IT concern. RIAs hold sensitive client information, rely on vendors, and interact with custodians, portals, and cloud-based systems. That creates operational and privacy risk.
Examiners may review whether firms have policies and procedures for:
Protecting client information
Responding to incidents
Managing vendor access
Training personnel
Backing up data
Controlling access rights
Testing systems and response plans
The best cybersecurity policies are practical. Staff should know what to do if they receive a suspicious email, lose a device, or suspect unauthorized access.
Vendor oversight deserves attention
Many RIAs rely on third-party technology providers. That does not transfer regulatory responsibility away from the adviser. Firms should maintain a vendor list and understand which vendors have access to client information or key systems.
At a minimum, vendor oversight files should include contracts, security information where available, access reviews, and notes showing periodic evaluation.
Fees, expenses, and billing remain exam staples
Fee and expense issues are among the most common findings in adviser exams because they are easy to test and directly affect clients.
RIAs should expect examiners to review whether fees are calculated accurately, billed according to agreements, and disclosed properly.
Areas to test include:
Advisory fee calculations
Billing in advance or arrears
Proration for new or terminated accounts
Household fee breakpoints
Valuation of illiquid or hard-to-price assets
Custodian fee deductions
Refunds
Expense allocations
A firm should be able to recreate a fee calculation from source records. If the billing process depends on manual edits, spreadsheet adjustments, or exceptions, those steps should receive extra review.
How RIAs can get exam-ready before the SEC calls
The strongest firms do not prepare for an SEC exam after the notice arrives. They build exam readiness into normal compliance work.
Use the FY 2027 priorities as a planning tool. Start with the areas most likely to affect clients, then document what you reviewed and what you changed.
A practical 60-day review could include:
Refresh conflict disclosures
Compare Form ADV, client agreements, and internal practices. Update vague or outdated disclosures.
Test fee billing
Select a sample of accounts. Recalculate fees and confirm that billing matches agreements and disclosures.
Review complex product files
Confirm that due diligence, client rationale, and risk disclosures are complete.
Update the compliance manual
Remove procedures that no longer apply. Add procedures for current business practices.
Test marketing materials
Review websites, presentations, testimonials, performance claims, and promoter arrangements.
Check cybersecurity controls
Review access rights, vendor lists, incident response procedures, and staff training records.
Document the annual review
Make the review specific. Identify tests performed, exceptions found, and corrective steps taken.
The key is not perfection. The key is evidence that the firm has a thoughtful process, uses it, and corrects issues when they appear.
The main takeaway for RIAs
The SEC FY 2027 Exam Priorities point to a clear regulatory theme: RIAs should expect examiners to compare promises with proof.
If disclosures say the firm manages conflicts, records should show how. If policies describe a review process, files should show that the review happened. If a recommendation involves risk, complexity, or illiquidity, the client file should explain why it was in the client’s best interest.
The firms best positioned for exams will be the ones that treat compliance as an ongoing discipline. Review the priorities now, test the areas that matter most, and fix gaps before an examiner finds them.
Comments