IAA Compliance Workshops: The SEC Exam Playbook Advisers Need Now

The Workshops Ended Eight Days Before the SEC Released Its FY2027 Priorities

The Investment Adviser Association's 2026 Compliance Workshops ended in Boston on October 15; eight days later, on October 23, 2026, the SEC announced its Fiscal Year 2027 examination priorities. SEC exam preparation for registered investment advisers starts with amended Regulation S-P, which now applies to every SEC-registered adviser regardless of size. The workshops included sessions on SEC exam priorities, SEC exams, and cybersecurity, data privacy and AI. The workshops ran as a virtual session on Tuesday, October 6 plus in-person sessions in Chicago (Oct. 8), New York (Oct. 14) and Boston (Oct. 15).

The obligations the FY2026 priorities pointed to are already in force.

That timing gap matters less than it looks. New priorities change what examiners emphasize. They do not repeal the Regulation S-P deadlines that have already passed.

Why Regulation S-P Sets the Incident-Response Obligations Advisers Face Now

The SEC adopted the Regulation S-P amendments on May 15, 2024, and published them at 89 FR 47688 on June 3, 2024. Larger entities, meaning SEC-registered advisers with $1.5 billion or more in assets under management, had to comply by December 3, 2025. Smaller entities had until June 3, 2026, according to IAPP's analysis.

Here is the distinction that matters. On June 12, 2025, the SEC formally withdrew its proposed Cybersecurity Risk Management rule for investment advisers and stated it does not intend to issue final rules. That leaves amended Regulation S-P as the SEC rule that imposes specific incident-response and notice obligations on advisers, and that rule carries hard deadlines.

What the rule actually requires

• An incident response program reasonably designed to detect, respond to, and recover from unauthorized access to customer information, per FINRA's advisory.
• Customer notice as soon as practicable, but no later than 30 days after becoming aware of unauthorized access.
• Service-provider oversight designed so providers notify you within 72 hours, as Davis Wright Tremaine summarizes.
• Written records documenting compliance.

The Exam Question Has Shifted From Policy to Proof

The SEC's FY2026 Examination Priorities, released November 17, 2025, covered Regulation S-P and S-ID compliance, AI-related risks, and cybersecurity and vendor oversight. Davis Wright Tremaine reports that examiners will assess whether firms have developed, implemented, and maintained policies under the rule's new provisions.

For a larger adviser, the compliance date is nearly eleven months old. For a smaller adviser, it passed in June. Either way, an examiner can now ask for evidence that the program operated, not just that it exists. A policy binder with no tabletop exercise, no vendor notices, and no incident log is a policy without proof of operation.

AI sits in a different posture. The SEC withdrew its predictive data analytics proposal in June 2025. Examiners can still ask how you supervise AI tools that touch client data, and that question routes straight back to Regulation S-P safeguards and vendor oversight.

What Your Leadership Team Should Decide This Quarter

These steps belong to the CEO, COO, and CCO jointly.

Five decisions for this quarter

1. Inventory every vendor that touches customer information. Custodians, CRMs, portfolio systems, and AI tools all count. Each one should be covered by your service-provider oversight procedures, which must be designed so the provider notifies you within 72 hours; the SEC's adopting release notes a contract term as one way to do that, though the amendments do not expressly require it.
2. Run a tabletop exercise against the 30-day clock. Time how long it takes your team to determine whose sensitive information was affected and to draft the notice.
3. Document what you did. Board or management minutes, test results, and vendor responses are the records that show the program operated, and amended Regulation S-P requires written records documenting compliance.
4. Map AI use to existing safeguards. List each AI tool, what client data it receives, and who approved it.
5. Read the FY2027 priorities against your plan. Ask your CCO to confirm what changed from FY2026 before your next annual review.