What are the SEC’s 2027 examination priorities?

With 2026 soon coming to an end, the Securities and Exchange Commission (SEC) has set out its primary focus areas for the year ahead in its 2027 Examination Priorities. These priorities have been shaped by emerging risks the regulator has identified within in examinations and give industry participants insight into where the Division of Enforcement will direct its energy in 2027.

Changing markets, evolving examinations

The SEC’s director of the Division of Examinations, Keith Cassidy, explained that the regulator’s examination program must evolve alongside transforming markets:

“Our approach enables us to adapt to changing market conditions, identify developing risk patterns, respond to emerging threats, and anticipate areas where investors and the markets may be vulnerable.”

Following the same format as previous years, the priorities set forth a range of examination activities applicable to specific sectors within the industry, including investment advisers, broker-dealers, and self-regulatory organizations.

While many of the 2027 Priorities overlap with those from 2026, some focus areas are new or heightened, including new technologies and the need to increase resilience against emerging risks. Considering the speed at which markets are evolving, the SEC seems to be paying close attention to generative AI tools and how financial institutions oversee them, as well as how they’re impacting business outcomes and the wider market.

What are the SEC’s 2027 examination priorities?

Investment advisers

Themes: Compliance programs and third-party risk

The SEC will continue to focus on the effectiveness of investment advisers’ compliance programs. The 2027 Priorities highlight that this is a “critical element” of examinations, and that the Enforcement Division will particularly review how adviser programs manage areas such as marketing.

As firms increasingly use generative tools to draft content, they should also consider how they review and capture any marketing-related advertisements. Advisers should also consider potential risks presented by finfluencers, especially as investors turn to social media for investment advice.

Similarly, the Division is paying attention to advisers that use third-party providers to access sensitive client information and how they’re protecting this data. Regulators have stressed that third-party risk management is instrumental as operational incidents escalate, meaning firms should maintain clear oversight of vendors within their network.

Broker dealers

Themes: Supervision, Reg BI, and AML compliance

Two ongoing focuses for broker dealers include supervision and Regulation Best Interest (Reg BI), both vital to protecting investors and reinforcing compliance obligations. The Division will evaluate how firms maintain written supervisory procedures, including those around communications compliance, and examine sales practices related to product and investment strategies.

Anti-money laundering (AML) programs are another ongoing focus area for broker dealers. The Division will review whether firms are updating programs to reflect evolving AML risks, such as market manipulation schemes.

Financial crime deterrence has been a primary objective for U.S. regulators, with the Department of Justice encouraging firms to monitor and report instances of misconduct, and the Financial Crimes Enforcement Network (FinCEN) proposing that generative artificial intelligence (AI) can help “combat financial crime” in recent proposals to reform AML laws.

Risk areas impacting various market participants

Cybersecurity, resilience, and data protection

Cybersecurity has been an essential focus for financial services, and several recent developments have underscored its importance. Alongside increasingly complex AI cyberthreats, myriad operational incidents have impacted firms over the past years, such as the AWS outage, and the severity of these incidents is escalating. To manage this, the SEC is prioritizing examinations of information security and operational resilience practices.

The SEC will also review firms’ policies and procedures on data loss prevention, access controls, account management, and response and recovery protocols for cyber-related incidents. It specifically mentioned third-party service providers and the effectiveness of risk management in these areas.

Considering that many operational incidents involve third-party providers, firms should take particular care when it comes to oversight of not only third-party vendors in their supply chain, but also the vendors that their vendors might rely on. 

Emerging technologies like AI

AI and advancing technologies are not just ongoing priorities, but standout topics for the SEC. The regulator noted that firms are continuing to incorporate AI, which it refers to as “super intelligence (SI),” into their businesses across a range of use cases:

“[Firms] are using generative SI tools to support research, drafting, coding, and client communications, as well as advisory and portfolio management functions, and compliance monitoring and surveillance.”

The regulator also noted that, as capabilities become more advanced and embedded into workflows, it will “intensify efforts to understand how technologies influence outcomes” and whether firms “continue to comply with existing, technology-neutral obligations.”  

Firms aren’t the only ones using AI tools more widely. Threat actors also use AI to automate and accelerate cyberattacks, such as by creating phishing messages and deepfakes or using social engineering. As a result, the SEC will review the procedures firms have in place to assess and prepare for AI-generated threats.

The regulator will also examine how firms use automated tools for investment advisory services, recommendations, and trading algorithms. As employees more frequently use these tools to support data analysis or client-facing chatbots, the Division will assess whether representations are fair and accurate, operations align with disclosures, and algorithms providing advice reflect investors’ strategies.

The SEC’s 2027 Examination Priorities balance a continuing focus on familiar areas, while also increasing attention on quickly evolving risks, giving firms insight into areas that will be under the spotlight in the year ahead. Alongside other guidance from the regulator, including its new Exam Handbook, firms that add these areas to their “regulatory resolutions” for 2027 will be set up for success when the new year comes around.

The SEC has emphasized that third-party oversight remains a foundational pillar of compliance for 2027, especially as firms integrate advancing technologies and defend against emerging threats. To maintain resilience and manage risk, firms should choose a vendor that prioritizes data protection and information security.