The SEC’s FY2027 Exam Priorities, Read for Investment Advisers

Fiduciary Standards and Economic Conflicts

The adviser section opens with fiduciary duty, and it gets specific quickly. The staff single out economic conflicts above everything else, and the risk alert they point to described disclosures that were missing, incomplete or misleading, practices that did not match the advisory agreement, and compliance programs that never reached the conflict in the first place. The simplest way to prepare is to write down every way money or value reaches the firm, or its people, other than through the advisory fee. Take custodian support, sweep revenue, revenue sharing, affiliated service providers, soft dollars and referral fees as examples. For each one, a firm should be able to say where it is disclosed, which policy covers it, and what record shows the policy actually working. Most firms can answer the first two without much trouble, and it is the third that tends to come up empty.

What the Request Letter Will Ask For

• Form ADV Parts 1 and 2A, current and prior, along with the advisory agreements and fee schedules, reconciled to what is actually billed and received.
• Fee billing records, meaning the methodology, sample invoices, custodian debits, rebates and credits, and how client cash is treated in sweep programs and money market selection.
• Every economic benefit beyond the fee, such as custodian support, revenue sharing, affiliated providers, soft dollars and referral arrangements, with the disclosure, the policy and the operating record for each.
• The valuation policy, committee minutes, pricing sources and fair value memos for anything illiquid.

Investment Advice and Complex, Illiquid Products

The second emphasis is on how advice gets formed. The report names the products most likely to draw attention, and the examples are more specific than in past years. If any of these sit in client accounts, examiners will likely ask for three things, namely the due diligence file on the product itself, the suitability record for the clients who hold it, and the disclosure those clients received about liquidity and exit costs. Older clients and retirement savers are mentioned twice on page 5, so it is reasonable to expect that question to be asked account by account.

What the Request Letter Will Ask For

• The due diligence file on each such product, showing who reviewed it, what was considered and who approved it.
• The suitability records for the clients who hold it, together with the liquidity and exit cost disclosure they received. For older clients and retirement savers, expect this account by account.

Private Funds and Private Credit

For private fund managers, the shift from last year is the clearest in the entire report. The FY2026 priorities focused on allocations between funds and separate accounts, interfund transfers, side letters and newly launched funds. This year, every example the staff give is about money. Private credit appears in the press release headline and three more times in the report itself, as loans made by private funds in the adviser section, as private credit held by registered funds, and as the pricing of private credit at broker-dealers. A manager running a credit strategy would do well to have its valuation policy ready, particularly for loans where the borrower is in trouble.

What the Request Letter Will Ask For

• The expense allocation policy and the ledger showing it was applied.
• Every subscription line and NAV facility, with the LPA and PPM language that disclosed it.
• The affiliated service providers, what they are paid and where investors were told.
• The management fee calculations, including offsets and who checks them, along with allocation records across funds and any separate accounts.
• For credit strategies, the valuation policy for a loan whose borrower is in difficulty.

Third Parties With Access, and Proxy Advisers

Two shorter items follow. The first covers anyone with login or data access to client accounts, from account aggregators to billing providers, and a firm should have the list, the controls and the diligence on each. The second is new this year. For firms that vote proxies through a service, the question is whether anyone actually reviewed the service and its recommendations, or whether the firm simply followed them.

What the Request Letter Will Ask For

• The list of every vendor or person with login or data access to client accounts, the controls around each, and the diligence file.
• If proxies are voted through a service, the record of the firm's own review of the service and its recommendations.

The Compliance Program and the Annual Review

Rule 206(4)-7 has required an annual review since 2004, yet the September 2026 risk alert on annual reviews describes the same problems again and again, reviews that are not documented, do not cover the whole program, or find nothing and change nothing. A review that holds up in an exam shows what was tested and how, including sample sizes, what was found, even the small things, what changed as a result, and who did the work, dated and signed. A review that finds nothing tends to read as a review that looked at nothing. The report also says twice that examiners will look at whether policies "are implemented," and implementation is really a question of records. Take a preclearance policy for example. It is implemented if there are requests, decisions and the reasoning behind each one. In the same way, a marketing policy is implemented if every advertisement has a review, an approver and a date, and a gifts policy is implemented if there are filings and someone other than the person filing decided them. Form 13H is new to the filings list this year.

What the Request Letter Will Ask For

• The compliance manual with its version history, and the annual review under Rule 206(4)-7 showing what was tested, what was found, what changed, and who did it and when.
• For marketing, the advertisement inventory, the review and approval on each piece, the substantiation for every number, and the distribution log.
• For trading, the preclearance records, holdings and transaction reports, the restricted list, allocation and best execution reviews, and the trade error log.
• For filings, the amendment history of Form ADV with the trigger for each, and the filing calendar with owners.
• For custody, the surprise examination reports, custodian statements and standing letters of authorization.

Change as a Trigger

The question here is whether the compliance program changed along with the business. If any of this describes a firm's last two years, it is worth writing a short memo now explaining what changed, what new conflicts it created and what the program did about them. That memo is far easier to write before the request letter arrives than after it.

What the Request Letter Will Ask For

• A memo on each change in the last two years, covering what changed, what conflicts it created and what the program did about it.
• The onboarding of acquired or new personnel into the code of ethics, preclearance and attestations, and the branch supervision schedules.

Never-Examined and Recently Registered Advisers

This part of the report is a single paragraph, and some version of it has appeared in every priorities report for years. For a firm that registered in the last two years and has not been examined, the most likely reason for an exam is simply that it has never had one. The gap the staff find most often in these firms is the gap between adopting a manual and being able to show it working, and the quickest way to close it is a compliance calendar that actually ran this year, with evidence behind each item.

What the Request Letter Will Ask For

• The full initial request list.
• A compliance calendar that fired this year with the evidence behind it, complete code of ethics records, and a first annual review done properly, even if the firm is fourteen months old.

Cybersecurity, Super Intelligence, Reg S-P and S-ID

Pages 12 and 13 apply to every registrant. The report has dropped the phrase "artificial intelligence" in favor of "super intelligence (SI)," and the focus runs in two directions. The first is attacks on the firm, where the control that matters most is a call-back procedure for every request to move money, one that staff are trained on and that gets tested. The second is the firm's own use of these tools, and the report notes that firms now use them for "compliance monitoring and surveillance" (p.2). That includes compliance software. In other words, if a tool reviews a firm's advertisements or emails, an examiner will want to know who checks its output and where that decision is recorded. Regulation S-P now applies to every SEC-registered adviser, with larger firms complying since December 2025 and smaller firms since June 2026, so the incident response program and the customer notification template are no longer documents a firm can say it is working on. They are now among the first things an examiner will request.

What the Request Letter Will Ask For

• The written information security program, access reviews, MFA evidence, the incident response program and any incident log, backup and recovery tests, and phishing training records.
• A call-back procedure for money movement requests, and deepfake awareness training.
• An inventory of the AI tools in use, including compliance tools, with the person who reviews each tool's output and what the brochure and marketing say about AI.
• The customer notification template with its 30-day clock, the service provider oversight procedure, and the identity theft program's last review.

What Changed from FY2026

So, what is actually different this year? Quite a bit, in fact. What follows is a line-by-line comparison with the FY2026 priorities (November 17, 2025), limited to the adviser and cross-cutting sections. What stayed the same is just as telling as what moved.

New or Sharper

• A named list of economic conflicts (fee rebates, fee and expense calculations, cash management, quid pro quo arrangements, deposits and withdrawals), with the June 2026 risk alert behind it.
• "Reasonable due diligence into products" and "the reasonableness of their valuation processes" now appear in the opening paragraph.
• Products named for the first time, including loans made by private funds or BDCs, SPV investments in private companies, single-stock ETFs and zero-days-to-expiration options.
• For private funds, the focus has moved from allocation favoritism, side letters and new launches to fund-level credit lines, affiliated service providers, and fee and expense calculations at the fund and investment level.
• Reliance on proxy advisory firms appears for the first time.
• Growth by acquisition and "multiple geographically dispersed branch offices" are named as compliance program triggers.
• Form 13H joins the activist filing list.
• Identity theft programs are to be updated for "SI and stolen credentials."

Moved or Renamed

• Best execution is no longer named on its own in the adviser section, where it was item three in FY2026. It still sits inside the "trading" component of the program, so firms should not read that as a lower bar.
• Dual registrants moved to the broker-dealer section, where they are discussed through account selection and Regulation Best Interest.
• "Artificial intelligence" became "super intelligence" throughout. The obligations, as the report says, remain "existing, technology-neutral."
• Regulation S-P moved from "in preparation for the compliance dates" to in force, for larger entities from December 2025 and for smaller entities from June 2026.

Unchanged

• The six program components, namely marketing, valuation, trading, portfolio management, disclosure and filings, and custody.
• The annual compliance review, which examinations will "typically" analyze.
• Never-examined and recently registered advisers.
• Retail and older investors, including those saving for retirement, as the lens for everything else.

The Exam-Readiness Checklist

The following twelve items can each be done in an afternoon. A never-examined firm should do all twelve, and a firm that was examined recently might start with items 2, 3 and 10.

1. Reconcile Form ADV, the website, the current pitch deck and the fee schedule against one another. Examiners read a firm's filings and website before they ever call.
2. List every economic benefit beyond the advisory fee. For each one, note where it is disclosed, which policy covers it and what record proves it.
3. Pull last year's annual review. Can it show what was tested, what was found and what changed? If not, plan this year's review around testing.
4. List what changed in the business over the last two years (strategy, client types, asset classes, offices, acquisitions) and note where the compliance program changed with it.
5. Build a due diligence file for anything illiquid, leveraged or unusual, and a suitability record for the clients who hold it.
6. Test fee billing by recalculating ten accounts from their agreements, including rebates and offsets.
7. For marketing, keep an inventory of advertisements, the review and approval for each, and support for every number.
8. For the code of ethics, confirm holdings and transaction reports are on time, preclearance decisions have reasoning, attestations are signed, and nobody approved their own filing.
9. Keep a filings calendar with an owner for each item: the ADV annual amendment, 13F, 13D and 13G, 13H, N-PX, Form PF and state renewals.
10. For Reg S-P, have the written incident response program, the customer notification template, the service provider oversight list, and the date of the identity theft program's last review.
11. Inventory every AI tool in use, including compliance tools, along with the human review step and what the brochure and marketing say about them. Train staff on deepfake and voice-clone requests to move money.
12. Keep a vendor list showing who can access client accounts or data, and the diligence done on each.

None of this is new law, but all of it is on the list. The right time to answer these questions is well before an examiner asks them.

FY2027 SEC exam-readiness checklist (lunacompliance.io/resources/exam-priorities-2027)

 1. [ ] Reconcile Form ADV, the website, the current pitch deck and the fee schedule against one another. Examiners read a firm's filings and website before they ever call.
 2. [ ] List every economic benefit beyond the advisory fee. For each one, note where it is disclosed, which policy covers it and what record proves it.
 3. [ ] Pull last year's annual review. Can it show what was tested, what was found and what changed? If not, plan this year's review around testing.
 4. [ ] List what changed in the business over the last two years (strategy, client types, asset classes, offices, acquisitions) and note where the compliance program changed with it.
 5. [ ] Build a due diligence file for anything illiquid, leveraged or unusual, and a suitability record for the clients who hold it.
 6. [ ] Test fee billing by recalculating ten accounts from their agreements, including rebates and offsets.
 7. [ ] For marketing, keep an inventory of advertisements, the review and approval for each, and support for every number.
 8. [ ] For the code of ethics, confirm holdings and transaction reports are on time, preclearance decisions have reasoning, attestations are signed, and nobody approved their own filing.
 9. [ ] Keep a filings calendar with an owner for each item: the ADV annual amendment, 13F, 13D and 13G, 13H, N-PX, Form PF and state renewals.
10. [ ] For Reg S-P, have the written incident response program, the customer notification template, the service provider oversight list, and the date of the identity theft program's last review.
11. [ ] Inventory every AI tool in use, including compliance tools, along with the human review step and what the brochure and marketing say about them. Train staff on deepfake and voice-clone requests to move money.
12. [ ] Keep a vendor list showing who can access client accounts or data, and the diligence done on each.

A never-examined firm should do all twelve. A firm examined recently might start with items 2, 3 and 10.