What happened
The US Securities and Exchange Commission published the Division of Examinations priorities for fiscal year 2027 on October 23, covering an exam programme that reaches more than 34,000 registrants, from investment advisers and broker-dealers to clearing agencies, municipal advisors, transfer agents and security based swap entities.
Eight areas lead the list: fiduciary obligations and compliance programmes, retail protection in complex and illiquid products, private funds and private credit, broker-dealer financial responsibility and anti money laundering, operational resiliency with cybersecurity and customer data protection, emerging technologies, market infrastructure change including Treasury clearing reforms and tokenisation, and oversight of self-regulatory organisations.
The emerging technology line reads differently this year. The division names super intelligence and other advanced technologies as an area that may affect market operations, compliance, fraud prevention and investor protection. Chairman Paul Atkins said examinations give the Commission insight into emerging risks and evolving business practices. Division director Keith Cassidy said the priorities let staff put resources where they have the most impact.
The division repeated its usual caveat that the list is not exhaustive and can shift during the year. The announcement follows the October 1 publication of the new Exam Handbook, which replaced the 2023 brochure and walks registrants from candidate selection through to the disposition letter.
Why this is a GRC story
Three of the eight areas are technology work. Three of the eight focus areas are technology governance in supervisory language. Resiliency, cybersecurity and customer data protection are one block. Emerging technology is another. Treasury clearing and tokenisation are the third, and that is a change management and third party risk question with a regulatory deadline attached.
The handbook changes the evidence conversation. A consistent published process makes findings easier to compare across firms, and a deficiency letter gets a written response that becomes a record of what the firm promised and when. Firms treating remediation as an email thread will look worse in the file than firms that log the commitment and its closure.
The practical test is retrieval, not policy. An examiner asking for twelve months of access reviews, the current inventory of customer data flows, or the change record for a model in production is testing whether evidence exists in a form someone can hand over. Broker-dealer supervision and anti money laundering staying on the list matters for anyone who assumed the focus had moved entirely to digital assets.
What to watch
The full priorities report holds the detail behind each heading, and that is where specific expectations sit. Watch whether examiners lean on written deficiency letters rather than oral feedback, because that choice decides how much of an exam becomes a permanent record. Watch also how the super intelligence line is tested in practice, since a priority without a test is only a theme.
The useful internal exercise this quarter is to pick the three artefacts an examiner would most likely request and time how long retrieval takes, including the approvals needed to release them. If the answer depends on a specialist who is on leave, the gap is already visible.
Attribution: Analysis based on US Securities and Exchange Commission and related public reporting. This article is original commentary, not a repost of the source material.