What the SEC’s 2027 Exam Priorities Mean for Compliance Teams
The SEC’s Division of Examinations has published its fiscal year 2027 examination priorities, and the message for financial services firms is consistent: show that your controls work in practice. The document is a staff statement and creates no new obligations. But it names the areas where examiners expect to focus, including conflicts of interest, supervision, oversight of AI, cybersecurity, and vendor risk. Firms don’t need to wait for exam findings to start assessing where they stand.
Key takeaways
- The priorities are a staff statement with no legal force, but they show where examiners will look.
- Examiners will test whether conflict-of-interest policies are implemented, not just written, with dual registrants in focus.
- Oversight of AI used in fraud detection, AML, Regulation Best Interest, and trading is named explicitly.
- Cybersecurity, Regulation S-P incident response, and service-provider oversight remain core examination areas.
- Firms that can produce evidence of how controls operate are better prepared than firms that can only produce policies.
Why the priorities matter
Each year, the Division of Examinations publishes the practices, products, and services it believes present heightened risk to investors or market integrity. The SEC is clear that the list is not exhaustive and that priorities can shift in response to new risks or market events.
That makes the document most useful as a map of examination risk rather than a rulebook. It points to areas where firms can assess their programs against existing requirements, before an examiner asks.
A consistent theme runs through the sections that matter most to compliance teams. Examiners are interested in whether policies are reasonably designed, whether they are implemented, and whether the firm can show it.
Conflicts of interest and supervision remain central
Conflicts of interest appear throughout the priorities, and examiners want to see them managed in practice. The Division’s June 2026 risk alert on economic conflicts of interest offers examples of what staff have observed. Focus areas differ by firm type:
- Investment advisers: Whether policies are reasonably designed to address conflicts, whether they are implemented, and whether disclosures cover fee-related conflicts tied to compensation structures.
- Broker-dealers: How firms identify and mitigate conflicts under Regulation Best Interest, including recommendations and account types.
- Dual registrants: A named priority, including how compensation incentives and account-selection decisions, such as brokerage versus advisory accounts, are handled.
- Supervision: Whether supervisory systems, procedures, and controls are reasonably designed, including for new business activities and products, and whether qualified individuals hold supervisory authority.
For firms with more than one line of business, we’d add a practical test: do access controls and information barriers rely on ethical walls alone? The SEC does not use that framing, but it is a reasonable way to check whether conflict controls hold up day to day.
AI oversight is now an examination topic
The SEC notes that registrants use AI for research, drafting, coding, client communications, advisory and portfolio management, and compliance monitoring and surveillance. (The document uses the term “super intelligence,” or SI.)
The Division will prioritize examinations of policies and procedures for monitoring AI, including its use in fraud prevention and detection, back-office operations, AML and Regulation Best Interest compliance, and trading. It will also check that representations about automated tools are fair and accurate.
That puts the tools used to manage risk under scrutiny too. Firms should be able to explain what AI they use, how it is validated and monitored, who is accountable, and how decisions are documented.
This includes tools employees adopt on their own, such as ChatGPT and Claude. Without vetting, firms may not know what data enters these tools, whether outputs are accurate and consistent with disclosures, or which interactions should be retained or supervised. Start with an approved-tools list, usage policies, review of AI-assisted work, and a documented decision on which interactions are records.
Cybersecurity, Regulation S-P, and vendor risk
Cybersecurity remains a key priority, with examiners focused on safeguarding customer information and on risks from third-party providers and shared technologies. High-priority areas include:
- Cybersecurity policies: Governance, data loss prevention, access controls, account management, and response and recovery for incidents, including ransomware.
- Regulation S-P: Incident response programs for unauthorized access to customer information, including customer notification and oversight of service providers.
- Regulation S-ID: Detecting and responding to identity theft red flags, particularly account takeovers and fraudulent transfers.
- AI-enabled threats: Preparation for AI-generated phishing and deepfake voice and video used in social engineering.
Regulation S-P's service-provider oversight requirements are likely to bring greater scrutiny to vendor due diligence. Firms should document how they evaluate and monitor critical providers.
Marketing and disclosure accuracy
Marketing is named among the compliance program areas examiners review for advisers. For broker-dealers, the Division will examine Regulation Best Interest disclosure obligations and the content of Form CRS, including how firms describe their services, fees, conflicts, and disciplinary history.
In each case, the underlying question is the same: can the firm show what investors were told, what was reviewed, and how concerns were resolved?
Tip: Examiners test how controls operate, not how policies read. Keep supervisory reviews, escalations, and resolutions complete and easy to retrieve.
Signs it’s worth reassessing your readiness
Not every firm needs to overhaul its program, but a take a closer look:
- If your conflict-of-interest policies haven’t been revisited since your firm grew, added services, or completed an acquisition
- If conflict controls between advisory and brokerage activity depend mainly on ethical walls
- If you don’t have a current inventory of AI tools used in compliance, trading, AML, or client-facing work
- If your incident response plan doesn’t clearly address customer notification and service-provider responsibilities
- If supervisory reviews are documented in ways that would be slow to retrieve during an examination
These signals don’t necessarily point to a gap, but they show where a firm should look first.
Five actions compliance teams can take now
These five reviews map to the priorities above, so your team can start with the area closest to your firm’s business.
- Inventory and govern AI tools: Identify where AI supports compliance, trading, AML, and client communications. Document validation, monitoring, ownership, and escalation for each.
- Test conflict-of-interest controls: Review whether conflict policies are implemented as designed, including compensation incentives and account-selection practices. Check whether controls go beyond information barriers alone.
- Pressure-test incident response and vendor oversight: Confirm that response procedures cover unauthorized access, customer notification, and service-provider responsibilities. Refresh due diligence files for critical vendors.
- Align marketing and disclosure review: Make sure reviews of marketing, recommendations, and disclosures are documented, consistent with what was told to investors, and retrievable.
- Prepare for the examination process: The Division has also published the SEC Exam Handbook, which describes each stage of an examination. Use it to confirm your team knows what to expect and can produce records efficiently.
Looking ahead
From a regulatory perspective, the most useful takeaway is that evidence matters as much as policy. Firms that can show how supervision, AI governance, and vendor oversight work day to day will be better positioned whether or not they are selected for an examination. Watch for upcoming risk alerts and examination observations, which will show where firms are falling short.
Frequently asked questions
No. The document is a staff statement that does not alter existing law or create new obligations. It identifies areas where the Division expects to focus and where firms can assess their programs against existing requirements.
No. The SEC states the priorities are not the only areas the Division will address, and that they may shift in response to new risks, products, or market events.
Yes. The Division will prioritize examinations of policies and procedures for monitoring AI, including its use in fraud detection, back-office operations, AML, Regulation Best Interest, and trading.
The document does not say that. Recordkeeping obligations depend on the firm, its activities, the content involved, and the applicable rules.
Start with where the priorities overlap with your business: conflict-of-interest controls, supervisory procedures, AI tool oversight, and incident response and vendor oversight under Regulation S-P.
Share this post!
- What the SEC’s 2027 Exam Priorities Mean for Compliance Teams - October 30, 2026
- FINRA Rule 2210 Update Brings AI Supervision Into Focus - September 23, 2026
- What Prediction Markets Mean for Compliance Oversight - July 6, 2026
Smarsh Blog
Our internal subject matter experts and our network of external industry experts are featured with insights into the technology and industry trends that affect your electronic communications compliance initiatives. Sign up to benefit from their deep understanding, tips and best practices regarding how your company can manage compliance risk while unlocking the business value of your communications data.
Ready to enable compliant productivity?
Join the 6,500+ customers using Smarsh to drive their business forward.
More Resources
Subscribe to the Smarsh Blog Digest
Subscribe to receive a monthly digest of articles exploring regulatory updates, news, trends and best practices in electronic communications capture and archiving.
Smarsh handles information you submit to Smarsh in accordance with its Privacy Policy. By clicking "submit", you consent to Smarsh processing your information and storing it in accordance with the Privacy Policy and agree to receive communications from Smarsh and its third-party partners regarding products and services that may be of interest to you. You may withdraw your consent at any time by emailing [email protected].
FOLLOW US