The SEC’s 2027 Examination Priorities: What Independent RIAs Should Be Paying Attention To
Practical Guidance for Small Advisory Firms Navigating the Year Ahead
Every fall, the SEC’s Division of Examinations releases its priorities for the coming fiscal year — and every year, RIAs ask the same question:
“What does this actually mean for my firm?”
Quick navigation:
On October 23, 2026, the SEC's Division of Examinations released its Fiscal Year 2027 Examination Priorities.
For independent Registered Investment Advisers (RIAs), the announcement presents a valuable opportunity to evaluate whether their compliance programs continue to reflect regulatory expectations and, more importantly, how their firms actually operate.
While the priorities address several types of market participants, there are important takeaways for smaller advisory firms.
And perhaps the most important takeaway is this:
Regulatory readiness isn't just about having the right policies. It's about demonstrating that those policies are appropriate for your business and are being implemented effectively.
Fiduciary Duty: Are Your Practices Supporting Your Disclosures?
Fiduciary obligations remain a central focus of the SEC's examination program.
For 2027, examiners will continue evaluating whether investment advisers are acting in their clients' best interests, particularly when serving retail investors, older clients, and individuals preparing for retirement.
One area receiving particular attention is economic conflicts of interest.
These can arise through advisory fees, compensation arrangements, cash management practices, and other financial incentives that may influence an adviser's recommendations.
For smaller RIAs, the important question isn't simply whether a potential conflict has been disclosed.
It's whether the firm's actual practices, disclosures, and supervisory procedures work together to identify and address those conflicts.
Consider:
Are advisory fees calculated consistently with client agreements and disclosures?
Are potential compensation-related conflicts adequately identified and addressed?
Can the firm demonstrate the basis for investment recommendations, particularly when recommending complex or less-liquid products?
A disclosure may explain a conflict, but the firm's procedures must also address how that conflict is managed.
Compliance Programs: Effectiveness Matters More Than Volume
Another significant priority is the effectiveness of investment advisers' compliance programs.
The SEC indicates that examinations will typically evaluate an adviser's annual compliance review, along with relevant policies and procedures covering areas such as marketing, trading, portfolio management, disclosures, and custody.
For small firms, this doesn't mean creating unnecessarily complicated manuals or adding procedures that serve no practical purpose.
Instead, it means ensuring the compliance program is reasonably designed for the firm's actual operations.
Consider a firm that recently changed custodians, introduced a new advisory service, or began using different technology.
Were the corresponding policies updated? Were new risks evaluated? And can the firm demonstrate that its supervisory activities continued as intended?
These are the types of questions that can reveal differences between a compliance program on paper and the one operating in practice.
The goal isn't to build the largest compliance manual. It's to maintain a program that works for the business you actually run.
New Services, New Risks, and Changing Business Models
The SEC also identifies advisers that have experienced operational changes as an examination focus.
These changes may include offering new services, recommending different asset classes, serving new types of clients, expanding through acquisitions, or operating across multiple locations.
But significant compliance changes don't always begin with major business decisions.
For a solo adviser, introducing a new financial planning service, engaging a third-party provider, or changing an account-management process may be enough to warrant a review of existing procedures.
When the business changes, compliance responsibilities may change with it.
Taking time to evaluate those changes can help firms identify potential conflicts and documentation gaps before they become examination concerns.
Cybersecurity and Emerging Technology: Oversight Still Belongs to the Firm
Information security and operational resiliency continue to receive substantial attention.
The 2027 priorities identify cybersecurity, third-party service providers, customer information protection, and emerging technology as areas of examination interest.
The SEC also discusses the increasing use of advanced technology, including what the report calls super intelligence (SI), in investment analysis, client communications, compliance monitoring, and other business activities.
Examiners will consider how firms address technology-related risks, including fraudulent communications, stolen credentials, and sophisticated phishing attempts.
For independent RIAs, this presents several practical questions.
Who has access to confidential client information?
How are technology providers evaluated?
Does the firm have an incident-response process that reflects its actual systems and responsibilities?
If automated or advanced technology tools are being used, does the firm understand how those tools operate and whether their outputs are consistent with client obligations and disclosures?
Technology may support compliance activities, but it doesn't eliminate the adviser's responsibility for appropriate oversight.
Regulation S-P: Are Your Safeguards More Than Written Procedures?
The amended Regulation S-P is another important area identified in the examination priorities.
The SEC indicates that examinations will evaluate safeguards for customer information, incident-response programs, customer notification procedures, and oversight of service providers.
For firms subject to the amended requirements, this is an opportunity to confirm that written policies are supported by actual processes.
A written incident-response plan is an important starting point. But the firm should also understand who is responsible for responding to an incident, how potential unauthorized access will be evaluated, and how applicable notification obligations will be addressed.
Smaller firms may rely heavily on outside technology vendors, but vendor relationships do not eliminate the need for appropriate safeguards and oversight.
Never Examined? That Doesn't Mean You're Off the Radar
The SEC will continue prioritizing examinations of advisers that have never been examined, particularly recently registered advisers.
For firms that have not yet experienced an SEC examination, this is an important reminder that exam preparation should not begin with an examination notice.
Registration approval is only the beginning of an ongoing compliance responsibility.
Advisers should be able to demonstrate that they have identified their business risks, implemented appropriate policies, maintained required records, and evaluated their compliance programs as their businesses evolve.
For smaller firms, maintaining organized documentation and a manageable supervisory process throughout the year can make an eventual examination significantly less disruptive.
What Should Smaller RIAs Do Now?
The SEC's annual examination priorities are not a list of new regulatory requirements. They identify areas of heightened examination interest and do not limit what examiners may review.
For independent RIAs, the most useful response is not necessarily to overhaul the entire compliance program.
Instead, start with a focused assessment of the areas most relevant to your firm's operations.
Ask yourself:
Fiduciary obligations: Do our recommendations, fees, and conflict-management practices align with our disclosures?
Compliance procedures: Do our written policies reflect current business activities?
Annual review: Have we evaluated the effectiveness of our compliance program and documented the results?
Technology and cybersecurity: Are our safeguards, access controls, and vendor oversight appropriate for the risks we face?
Examination readiness: Can we locate documentation demonstrating that required compliance activities occurred?
These questions can provide a practical starting point without creating unnecessary administrative work.
Moving Forward with Clarity and Confidence
The SEC’s 2026 priorities reinforce a familiar truth: Good compliance is operational, not theoretical.
For small RIAs, the firms most likely to struggle are those relying on outdated manuals, inconsistent procedures, or infrequent testing. The SEC is looking closely at how firms implement compliance — not just how they write about it.
Because examination readiness isn't something you create when regulators call. It's something you build through consistent, thoughtful compliance practices.
For additional guidance, explore our Exam-Ready Resources or learn more about how Three Lumos Consulting supports independent RIAs.
Corrie Scoby
Chief Consultant & Owner, Three Lumos Consulting, LLC
We guide RIAs with clarity, integrity, and partnership—so you can spend less time on compliance and more time serving clients.
Note: This article provides general information and does not constitute advice. Consult your compliance team for guidance specific to your firm.
