On October 23, 2026, the SEC’s Division of Examinations released its fiscal year 2027 examination priorities. The summaries that follow this week will catalog what the document contains. The more useful question is what it reveals about how examiners intend to put these priorities to work in the year ahead.
The answer is continuity in substance alongside expansion in scope. Fiduciary duty, conflicts of interest, compliance programs, retail sales practices, private funds, and cybersecurity remain the document’s foundation, as they have for several cycles. What has shifted is the terrain those principles now reach: single-stock ETFs and zero-day options, private credit packaged for retail investors, Super Intelligence (SI) as both an engine of investment and operational efficiency and a new source of risk to each, and firms whose growth has outpaced the compliance programs meant to govern them.
Why did the SEC stop saying “AI”?
The 2027 priorities use “super intelligence” (SI), consistent with Executive Order 14434, which directs federal agencies to replace “artificial intelligence” and “AI” with the new terminology. As NASA explains, it is updating its communications while continuing to follow the statutory definition of artificial intelligence. Firms should therefore read the terminology change as a change in vocabulary, rather than a narrowing of examination scope: the SEC continues to scrutinize technology use, related disclosures, oversight, and compliance with existing obligations.
For firms that spent 2026 absorbing a cycle of rewrites, this could be welcome clarity. The document reads less as a set of new demands than as a description of how examiners intend to test existing ones, and nearly everything it describes can be prepared for today.
The FY2027 Priorities at a Glance, by Registrant Type
The Division organizes its priorities first by registrant type and then by risks that span all registrants.
| Area | Where examiners will focus |
|---|---|
| Investment advisers | Fiduciary duty toward retail and senior investors; economic conflicts; how advice is formulated; illiquid and complex products; fund-level and investment-level risk at private fund advisers; third-party account access and proxy advisory reliance; compliance programs, including the annual review; firms that have changed; never-examined and recently registered advisers |
| Investment companies | Fees, expenses, waivers, and reimbursements; portfolio management against stated strategy; private credit and other illiquid holdings; leverage at BDCs and inverse and leveraged ETFs; reliance on exemptive orders; never-examined funds |
| Broker-dealers | Net capital and customer protection, including daily reserve computations and Treasury clearing; extended-hours trading, best execution, and pricing of illiquid instruments; Reg BI, Form CRS, and dual registrant conflicts; AML, including foreign omnibus accounts; supervision of new business activities; payments to unregistered finders |
| SROs and clearing agencies | Exchanges, FINRA, MSRB, and PCAOB oversight; clearing agency default management, recovery and wind-down, securities lending, and tokenization; new Treasury clearing rules |
| Other market participants | Municipal advisors, transfer agents, funding portals, security-based swap dealers, and security-based swap execution facilities |
| Cross-cutting risks | Cybersecurity and operational resiliency; super intelligence (SI) and other emerging technology; Regulation S-P and Regulation S-ID; Regulation SCI |
The leadership message merits a full reading in its own right. It directs registrants to The SEC Exam Handbook, published earlier this month; announces an enhanced Memorandum of Understanding with the CFTC and a companion agreement with NFA; and introduces an examination projection model designed to sharpen risk-based resource allocation. It also states, without hedging, that the Division is integrating “super intelligence” into its own examinations and risk assessments, “supplementing, but not replacing, staff judgment.”
Familiar Principles, Wider Reach: What Carried Over From the FY2026 Exam Priorities
Much of the document affirms the direction regulators set over the past year. Its value, however, lies less in that affirmation than in the specificity the Division has now added.
What Stayed the Same: Conflicts, Custody, Cybersecurity, and Fiduciary Duty
As our outlook anticipated, the subject matter changed little from prior cycles. Conflicts, custody, cybersecurity, private fund governance, and fiduciary execution all return, and marketing, valuation, trading, disclosure, and custody are again identified as core components of the adviser compliance program review.
Old Obligations, New Territory: Technology-Neutral Obligations Applied to New Products and Services
The most revealing language appears in the leadership message, which describes the Division’s effort to assess “whether firms continue to comply with existing, technology-neutral obligations.” That principle recurs throughout the document. The adviser section prioritizes firms that have “started advising different types of clients, providing advice regarding new asset classes, or providing new services,” while the broker-dealer supervision section asks whether controls extend to “new business activities and investment products.”
The lesson for firms is straightforward: where no tailored rule exists, the general obligation still applies, and examiners are prepared to apply it.
How Examiners Will Review Your Annual Compliance Review
The priorities note that “examinations will also typically analyze an adviser’s annual compliance review.” Read together with the Division’s September 2026 Risk Alert on annual compliance reviews, the expectation becomes precise. Examiners want evidence that the firm followed its own stated process, that the process surfaced findings, and that those findings produced change. A review capable of standing as the first document produced in an examination is also the best preparation for one, and an independent mock examination offers a practical way to test whether it can.
Economic Conflicts of Interest: Fee Rebates, Expense Calculations, and Cash Management
Economic conflicts open the adviser section, and the document’s sole footnote cites the June 9, 2026 Risk Alert on the subject. The areas of review are concrete: “fee rebates, fee and expense calculations, cash management, quid pro quo arrangements, deposits, and withdrawals.” Because the standard is implementation rather than adoption, the critical question is whether a firm’s conflicts inventory captures what actually occurs, not merely what “may” occur.
Private Credit, Illiquid Products, and BDC Loans Sold to Retail Investors
Few themes run as deeply through this year’s priorities. The Division will focus on advisers recommending products that “are difficult to trade, have unusual features, or are illiquid,” citing specifically “loans provided by private funds or business development companies (BDCs)” and “investments in private companies through special purpose vehicles.” Private credit surfaces repeatedly: in fund holdings, in Reg BI product reviews, and in broker-dealer pricing of illiquid instruments.
At the fund level, examiners will scrutinize the “use of debt and fund-level lines of credit, use of affiliated service providers, and the accuracy of fee and expense calculations at both the fund and investment levels.” Valuation underlies each of these, and the SEC’s recent fair value statement on private credit offers a natural reference point for firms revisiting their methodologies before an examiner prompts them to.
Super Intelligence (SI): What the SEC Now Calls AI, and How Examiners Will Review It
No AI-specific rule yet governs advisers or broker-dealers, and the Division accordingly situates SI within information security and operational resiliency. Examiners will review policies for monitoring SI, “including its use in fraud prevention and detection, back-office operations, compliance with AML and Reg BI obligations, and trading functions.” They will also assess whether “representations are fair and accurate” and whether algorithms generate advice consistent with client profiles.
The reference to AML and Reg BI compliance deserves particular attention, because it brings SI used within the compliance function itself into the scope of examination. An effective AI governance framework must therefore reach those internal applications, not only client-facing tools.
How the SEC Selects Firms for Examination: The New Projection Model
The Division describes “an examination projection model to improve risk-based resource allocation” and reaffirms its focus on never-examined advisers, funds, and security-based swap dealers. When fewer examinations are allocated through more sophisticated analytics, selection itself becomes a meaningful signal.
SEC–CFTC and NFA Coordination: What Dual Registrants Should Expect
For firms holding multiple registrations, some of the most consequential news appears in the leadership message. The enhanced SEC–CFTC Memorandum of Understanding provides for “coordinated examination planning and opportunities for joint or aligned examinations,” and a separate MOU with NFA “supports similar coordination where our responsibilities intersect.” As policies written for separate regimes are increasingly read side by side, CFTC and NFA registrants that also answer to the SEC have good reason to reconcile them now.
Cybersecurity, Regulation S-P, and Third-Party Service Provider Oversight
Service provider oversight runs throughout the cybersecurity section. Examiners will evaluate Regulation S-P response programs, “including customer notification procedures and oversight of service providers,” and will assess the “risks associated with registrants’ increased use of third-party service providers and shared technologies.” For firms also subject to NFA requirements, a single incident may trigger two notification regimes, and the two are best reconciled before that incident occurs.
What’s New in the FY2027 Priorities
Beyond these familiar themes, the Division extended its priorities into several areas that warrant attention in their own right.
Super intelligence (SI) as an attack vector
The Division now treats SI as a threat as well as a tool, observing that “threat actors are using SI to automate and accelerate cyberattacks, making those attacks more efficient and harder to detect.” Examiners will assess how firms are preparing for “SI-generated phishing messaging and synthetic or deepfake voice and video used for social engineering.” Regulation S-ID reviews, meanwhile, will ask whether Identity Theft Prevention Programs address “emerging risks, such as those related to SI and stolen credentials,” particularly in account takeovers and fraudulent transfers.
State regulators are moving in the same direction, as NASAA’s recent AI scam advisory makes clear. An incident response tabletop built around a convincing deepfake of a client requesting a wire transfer would be a sensible place to begin.
Complex Products Named: Single-Stock ETFs, Zero-Day (0DTE) Options, and Leveraged ETFs
This year’s product list is notably more specific than its predecessors. It names “single-stock ETFs, and zero-days-to-expiration options” alongside option-based and inverse ETFs, ETFs built on less liquid assets, low-priced and small-capitalization securities, and products “based on exotic benchmarks.” The suitability factors are equally precise, with examiners weighing “projected performance across diverse market and economic conditions” and “costs (including exit costs).” Exit cost is, in effect, a liquidity question posed at the point of recommendation, and it belongs in the file at that moment.
Firms that have changed shape
The Division will prioritize advisers “that have grown through mergers, acquisitions or other means, or are operating from multiple geographically dispersed branch offices,” assessing whether their compliance programs have kept pace. On the broker-dealer side, examiners will ask whether “appropriate and qualified individuals have been designated with the authority to carry out their supervisory responsibilities.”
A growing firm’s compliance program should be measured against the firm it has become rather than the one it was. The discipline of a new product process review translates naturally to a new branch, acquisition, or line of business.
Dual Registrant Conflicts, Account Type Recommendations, and Unregistered Finders
Dual registrant conflicts “remain a priority,” with particular attention to “the recommendation to open a brokerage versus an advisory account or recommendations to open wrap fee accounts” and to the allocation of investments across a client’s accounts. The Division will also examine how broker-dealers supervise compensation paid to unregistered persons “who may be acting as finders,” as well as “transaction-based compensation paid to personal-service entities not registered as broker-dealers.” That it frames this review as “part of its mission to inform policy” suggests the findings may shape future rulemaking.
Reliance on third parties: Proxy Advisory Firms, Third-Party Account Access, and Cloud Vendors
Advisers that rely on proxy advisory firms will be asked how they “evaluate such recommendations, examine their bases, identify potential conflicts of interest,” and advisers that permit third parties to access client accounts remain a focus. Under Regulation SCI, the Division will likewise examine reliance on “cloud and other third-party vendors.” Read as a whole, the document treats vendor oversight not as a discrete topic but as a thread running through nearly every section.
AML through the broker-dealer lens
The AML priorities speak specifically to broker-dealers. They address foreign omnibus accounts and “nested” relationships, ongoing customer due diligence, SAR filing, OFAC sanctions, and trading in foreign-based companies that may involve “pump-and-dump” or “ramp-and-dump” schemes, an effort the Division will coordinate with the SEC Cross-Border Task Force.
Because the adviser AML rule does not take effect until January 1, 2028, just beyond this cycle, 2027 remains the build year for advisers. The broker-dealer priorities nonetheless offer a useful preview of what SEC examiners will expect once that rule attaches, as the gap between the two regimes closes on a fixed timeline. Recent enforcement trends suggest the measure will be whether a program works, not merely whether it exists.
Digital Assets and Tokenization in the FY2027 Priorities
Digital assets enter this year’s priorities through infrastructure rather than products. Tokenization is a named focus at clearing agencies and under Regulation SCI, alongside SI, extended trading hours, and quantum computing, and transfer agents will be examined “for the use of emerging technology to perform transfer agent functions.” The SEC’s emerging digital market architecture has been taking shape throughout the year. For firms operating in digital assets and prediction markets, operations and controls are where examiners are most likely to encounter it first.
Broker-dealer financial responsibility and trading
Examiners will test the recent Customer Protection Rule amendments “relating to daily customer reserve computations and U.S. Treasury clearing,” along with liquidity under stress and concentration in prime brokerage. Reviews of extended-hours trading will ask whether liquidity providers are “willing, ready, and able to provide liquidity on and off exchange.” For smaller broker-dealers, these are frequently the reviews in which consistent FinOp coverage matters most.
What Firms Should Do Now: Five Steps to Prepare for an FY2027 Exam
The priorities reward firms that can demonstrate their reasoning before anyone asks to see it. Five steps follow directly from the document.
- Map the priorities against your most recent annual review. Wherever a priority applies to your business and the review did not test it, that gap is likely the first thing an examiner will notice.
- Inventory every illiquid product, and every product with “unusual features,” that reaches retail clients, and confirm that each file documents exit costs and expected performance across market conditions.
- Catalog every use of Super Intelligence (SI), including within compliance, AML monitoring, and Reg BI processes, and extend the Identity Theft Prevention Program to address deepfake-driven account takeovers.
- Where the firm has grown, merged, added branches, or launched a new line of business, confirm that its compliance program and supervisory designations have evolved accordingly.
- For firms registered with both the SEC and the CFTC or NFA, prepare for the possibility of a coordinated or joint examination by maintaining a single, reconciled set of policies.
Regulators have not written a new rulebook for the frontier, and the Division has now made clear that it does not need one. The firms best positioned for 2027 will be those that extend their highest standard of care to their least familiar lines of business, and that keep the record to prove it.
CRC Oyster can help. Contact us to learn more and get started.