SEC Exam Priorities for Q4 2026: Reg S-P, Alt Investments & AI

The bottom line up front: heading into Q4 2026, the SEC is sending a straightforward message to independent RIAs. Examiners are moving past simply making sure that you have a compliance manual—they now want to see it in action. For Q4, examiners are zeroing in on a few main areas: the new Reg S-P data privacy rules, how you handle alternative investments, the way your team uses AI, and how well your firm can bounce back from a cyberattack.

Since that deadline is now in the rearview mirror, examiners are actively checking to see whether your firm actually put the right safeguards in place. If you get a knock on the door in Q4, expect them to dig into four main areas.

• Your Incident Response Plan: You need a written plan proving that you can spot, stop, and recover from anyone trying to hack your clients’ information.
• Keeping An Eye On Vendors: You have to make sure your third-party tech vendors have strong oversight, including knowing how they handle data breaches.
• Protecting Customer Information: Firms must maintain policies and procedures that include administrative, technical, and physical safeguards to protect customer information.
• Stopping Identity Theft: Examiners want to see that you have a written program to catch “red flags” and prevent identity theft.

The SEC is taking a hard look at recommendations for investments that are illiquid or carry higher risks.

• Alternative Investments: The SEC is heavily focused on private credit and private funds that lock up clients’ money for a long time.
• Complex Products: Expect extra scrutiny if you recommend things like leveraged ETFs or ETFs tied to options.
• Older Retail Investors: Advisors have to walk a fine line with older clients and those saving for retirement. You need to prove that recommendations align with their investment objectives, risk tolerance, and personal backgrounds.

“Emerging financial technologies” is a major focus area for the SEC right now. It is looking closely at automated investment tools, trading algorithms, and artificial intelligence.

If your firm uses AI or any automated tools, examiners are going to check certain areas.

• Do your claims align with reality? If you tell clients that you use automated tools, the SEC wants to make sure those tools actually do what you say they do and that your controls match your disclosures.
• Stopping AI Cyber Threats: Firms are expected to train their staff and use security controls to fight off new risks associated with AI and polymorphic malware attacks.
• Consistent Advice: If an algorithm is giving advice, examiners want to ensure that it consistently matches what the client actually needs and that it is in line with regulatory obligations.