The Division of Examinations has announced its priorities for Fiscal Year 2027. If you're waiting for a formal notice before taking action, you're already behind. With over 34,000 registrants under oversight, your firm won't get advance warning before an examination. However, you now have a clearer picture of where examiners will focus their attention. This is your opportunity to strengthen your compliance posture.
This checklist translates the SEC's FY 2027 priorities into concrete steps your compliance team can take before an examiner arrives. Each item includes what "done right" looks like in practice.
Prerequisites
Before working through this checklist, confirm you have:
- Current organizational chart showing reporting lines for compliance, legal, and risk functions.
- Access to your firm's compliance policies (not just the published versions, but the working documents your team actually uses).
- Last 12 months of compliance committee meeting minutes to identify gaps between stated priorities and actual resource allocation.
- Documentation of your last internal compliance review or external audit findings.
If you can't locate these materials quickly, it's a signal that documentation practices need attention.
Examination Readiness Checklist
1. Fiduciary Duty and Conflicts of Interest Review
Action: Audit every revenue stream your firm earns from client relationships. Map each one to the disclosures clients receive.
Requirement reference: Investment Advisers Act Rule 206(4)-7 (compliance program rule)
What good looks like: You can produce a matrix showing revenue source, conflict type, disclosure location, and date of last client acknowledgment. When an examiner asks, "How do you make money on this product?", your team answers in under two minutes with documentation in hand.
2. Retail Product Complexity Assessment
Action: Create a written definition of what your firm considers a "complex" product. Score your current retail offerings against that definition. Flag anything involving leverage, illiquidity beyond 90 days, or structures requiring more than two steps to explain.
What good looks like: You have a documented process that triggers enhanced disclosure, suitability review, or sales supervision when products meet your complexity threshold. Your training team can show that retail-facing staff completed scenario-based training on these products in the last six months.
3. Private Fund and Private Credit Controls
Action: If you manage private funds or private credit strategies, document your valuation methodology for illiquid assets. Review your last four quarters of investor communications for consistency with actual performance and fee calculations.
What good looks like: Your valuation committee meets on a documented schedule. You can produce meeting minutes showing how you valued hard-to-price assets and what assumptions you made. Your fee calculations reconcile to the fund documents, and you've tested that reconciliation in the last 90 days.
4. Broker-Dealer Financial Responsibility Verification
Action: Pull your most recent net capital computation. Verify that the person who prepared it and the person who reviewed it both documented their work. Check that your FOCUS filings match your internal records.
Requirement reference: SEC Rule 15c3-1 (net capital rule)
What good looks like: Your net capital computation includes a supervisor's sign-off with date and notes explaining any unusual items. You maintain a calendar showing when computations are due and who's responsible. Your CFO can explain your current net capital position without consulting notes.
5. Cybersecurity and Operational Resiliency Testing
Action: Review your incident response plan. Schedule a tabletop exercise that simulates a customer data breach occurring during a market stress event.
What good looks like: Your plan identifies specific individuals by name and role, not just titles. You've tested it in the last 12 months and updated it based on what you learned. You can show documentation of the exercise, lessons learned, and changes implemented afterward.
6. Customer Information Protection Audit
Action: Inventory where customer nonpublic information lives, not just in your primary systems, but in email archives, collaboration tools, and third-party vendor environments.
Requirement reference: SEC Regulation S-P (privacy rule)
What good looks like: You maintain a data map showing customer information flows, including third-party access points. Your vendor contracts include specific data protection obligations. You've verified vendor compliance with those obligations in the last year through questionnaires, certifications, or audits.
7. Emerging Technology Risk Assessment
Action: Document every instance where your firm uses automated tools, algorithms, or AI in client-facing activities, portfolio construction, trading, recommendations, customer service, compliance monitoring.
What good looks like: For each technology tool, you can describe its function, who oversees it, how you test it, and what controls prevent it from operating outside defined parameters. You've documented the business justification and risk assessment that led to adopting each tool.
8. Anti-Money Laundering Program Review
Action: Pull a sample of customer accounts opened in the last quarter. Verify that your Customer Identification Program documentation is complete and that beneficial ownership information is current.
Requirement reference: Bank Secrecy Act and FinCEN Customer Due Diligence Rule
What good looks like: Every account file includes complete CIP documentation collected at onboarding. Your AML testing program has reviewed a representative sample of accounts in the last 12 months. You've escalated and resolved any red flags your monitoring system generated.
9. Supervision and Training Effectiveness
Action: Select three registered representatives or investment adviser representatives at random. Review their last six months of client communications, trade activity, and outside business activity disclosures. Check whether your supervisory system would have caught a potential violation.
What good looks like: Your supervision isn't just sign-offs on reports. You can show that supervisors review exception reports, follow up on anomalies, and document their analysis. Your training records show not just completion rates but assessment scores demonstrating comprehension.
Common Mistakes
Treating this as a one-time project. Examination readiness isn't a sprint before the examiner arrives. It's ongoing discipline. If you're creating documents just to have them, examiners will notice the fresh timestamps.
Confusing policies with practices. Your compliance manual might be perfect, but if your team doesn't follow it, that's worse than having no manual at all. Examiners test what you actually do, not what you say you do.
Delegating without verifying. Compliance officers who assume their team completed all these tasks without spot-checking often learn otherwise during an examination. Trust, but verify.
Overlooking vendor and third-party risks. Your compliance obligations don't end at your firewall. If a vendor handles customer data, processes trades, or performs compliance functions, their failures become your failures.
Next Steps
Work through this checklist in priority order based on your firm's business model. If you're primarily an investment adviser, start with items 1, 3, and 7. If you're a broker-dealer, prioritize items 4, 8, and 9.
Set a completion target of 90 days for the full checklist. Assign each item to a specific person, not a department. Schedule a compliance committee review of findings before the end of the quarter.
The SEC's examination priorities tell you where they're looking. What you do with that information determines whether your next examination confirms the strength of your program or exposes gaps you should have addressed months earlier.
