SEC exams: the document request, the deficiency letter, and the 2026 priorities

An SEC exam of an investment adviser usually starts with a letter and an initial document request. The request asks for four kinds of information: how the business works, the compliance risks the firm has identified and the policies that address them, data for testing the firm’s trading, and records the staff will test itself. Where the exam finds deficiencies, the staff sets them out in a deficiency letter.

This answer runs in nine parts:

• Where the SEC’s authority to examine comes from: section 204(a) of the Investment Advisers Act.
• How the SEC chooses which advisers to examine, from the September 6, 2023 risk alert.
• What the SEC exam document request asks for: the four groups of information, and the rule on how records are produced.
• What happens during an SEC exam, and Redan’s position on producing what the request covers.
• The deficiency letter: what it sets out, the five topics found most often, and what follows a firm that does not correct them.
• The SEC exam priorities for 2026.
• How it’s actually done, from the day the letter arrives to answering the deficiency letter.
• The record it should leave.
• Frequently asked questions, then the sources.

Where the SEC’s authority to examine comes from

Section 204(a) of the Investment Advisers Act requires an adviser to make and keep the records the Commission prescribes, and makes all of those records “subject at any time, or from time to time, to such reasonable periodic, special, or other examinations by representatives of the Commission as the Commission deems necessary or appropriate” (15 U.S.C. 80b-4(a)). The records the Commission has prescribed are in Rule 204-2, the books and records rule.

How the SEC chooses which advisers to examine

The Division of Examinations described its approach in a September 6, 2023 risk alert. Selection is risk-based. The Division reported that it had examined approximately 15% of “all (domestic and international) advisers” in each of the three years before that alert.

Reasons the staff gives for selecting an adviser include its risk characteristics, a tip, complaint or referral, and interest in a particular compliance risk area. Firm-specific factors it lists include:

• prior examination findings, especially repeated deficiencies and fee and expense issues;
• disciplinary history of associated people or affiliates;
• outside business activities and dual registration with a broker-dealer;
• how long since the firm registered or was last examined;
• material changes in leadership or personnel;
• vulnerability to financial or market stress;
• news coverage and third-party data; and
• access to client assets, and gatekeeper or service provider risks.

Once a firm is selected, the staff scopes the exam further. Exams typically include custody and safekeeping, valuation, portfolio management, fees and expenses, and brokerage and best execution.

What the SEC exam document request asks for

The initial request, as the September 6, 2023 risk alert describes it, falls into four groups. The alert attaches the staff’s typical initial request list for an adviser without additional activities such as private funds. What follows is a summary of it.

1. General information. Organization, affiliations and control persons; branch offices; current and former supervised persons; committees and their minutes; advisory agreements; third-party arrangements such as sub-advisers and referral arrangements; service providers; Form ADV and Form CRS; litigation and disciplinary matters.
2. The compliance program. The compliance policies in effect during the exam period; tests the firm performed; compliance consultant reports; annual and interim reviews, “including any reports prepared”; the record of compliance exceptions; client complaints and the process for monitoring communications, including electronic communication; the inventory of compliance risks and conflicts behind the policies; training given to employees and documentation of attendance; valuation; information security, business continuity and cybersecurity incidents.
3. Information for testing trading. Client account information; holdings across client portfolios; the trade blotter; best execution documentation; soft dollars; principal and cross trades; trade errors; allocations; the code of ethics, attestations and access persons’ transaction reports.
4. Information for the staff’s own testing. Advertisements and marketing materials, including websites and social media; performance and composite information; requests for proposal and due diligence questionnaires; testimonials, endorsements and payments for them; third-party ratings; financial records; custody records and surprise examination documentation.

The request is generally sent by secure email and answered electronically. Exams can be announced or unannounced. On an unannounced exam, the staff may hand over the request on arrival. As the exam goes on, the staff often sends further requests.

The rule on how records are produced. Records kept electronically must be arranged and indexed so any particular record can be located and retrieved (204-2(g)(2)(i)), and the adviser must “provide promptly” to the Commission’s examiners a legible, true and complete copy in the format it is stored in, a printout, and the means to access, view and print the records (204-2(g)(2)(ii)(A) to (C)).

What happens during an SEC exam

The staff reviews what the firm produces, tests it against the firm’s policies, disclosures and the rules, and sends further requests as the exam progresses. The September 6, 2023 risk alert says the purpose of the documents is to understand the adviser’s conflicts, risks and controls, and to test whether its compliance policies work.

Redan’s position: produce what the request covers. If the request asks for vendor due diligence for the last three years, the approvals, renewals and reviews across those three years go out. Determination memos and a vendor’s own audit report go out when the request names them, partly because volunteering them widens the exam and partly because they are a third party’s confidential material. Read the letter itself, and where the scope is unclear, ask the staff contact. Guessing produces short productions and over-productions.

The deficiency letter

A deficiency letter sets out what the exam found. In its fiscal year 2022 priorities, the Division said it had issued more than 2,100 deficiency letters in fiscal year 2021, and that “most firms, as a result of the deficiency letters we issue, take steps to remediate the staff’s findings,” most often by changing policies and procedures, updating filings or improving disclosures, and in some cases by returning fees to clients.

The five compliance topics found most often in deficiency letters to advisers, according to a February 7, 2017 risk alert from the SEC’s Office of Compliance Inspections and Examinations, were:

1. the compliance rule, Rule 206(4)-7;
2. required regulatory filings;
3. the custody rule, Rule 206(4)-2;
4. the code of ethics rule, Rule 204A-1; and
5. the books and records rule, Rule 204-2.

The staff singles out findings a firm has not corrected. The Division’s September 14, 2026 risk alert on annual compliance reviews lists advisers that “had not taken corrective action after receiving previous deficiency letters from the staff” as recidivist conduct, and its September 6, 2023 alert lists repeated deficiencies among the reasons a firm is selected for examination.

The rules and staff documents cited here do not say how or when a firm must respond to a deficiency letter. The date is in the letter.

The SEC exam priorities for 2026

The Division of Examinations’ fiscal year 2026 priorities name three priorities for investment advisers:

• Fiduciary duty. Adherence to the duties of care and loyalty, particularly where advisers serve retail investors. The Division lists alternative investments such as private credit, complex products such as leveraged and inverse ETFs, and higher-cost products; recommendations to older investors and those saving for retirement; dual registrants; advisers using third parties to access client accounts; and advisers that have merged or been acquired.
• Effectiveness of compliance programs. Exams on this topic typically cover marketing, valuation, trading, portfolio management, disclosure and filings, and custody, and “typically include an analysis of advisers’ annual reviews of the effectiveness of their compliance programs.”
• Never-examined and recently registered advisers, which the Division continues to prioritize.

Across firm types, the Division also names cybersecurity and operational resiliency; Regulation S-ID and Regulation S-P, including firms’ progress on incident response programs ahead of the Regulation S-P amendments’ compliance dates; emerging financial technology, including automated investment advice; and anti-money laundering.

The priorities are a staff statement. The Division says in them that they are not the only areas it will examine.

How it’s actually done

The day the letter arrives. Read it, calendar the due date, and tell the chief executive and outside counsel the same day. Suspend every auto-delete rule on email, chat and file storage before anything else, because a deleted record may not be recoverable. Put one person in charge of everything that goes to the staff, so nobody at the firm answers a question alone. Then split the request into its numbered items, put an owner and a source system against each, and pull what already exists before building what does not.

Readiness. Firms that start building the file when the letter arrives struggle in the exam. Everything the staff asks for should already exist from the year’s ordinary work: the reviews happened, the approvals were written at the time, the training records exist. The exam is then an export.

Answering the deficiency letter. Answer every numbered finding on its own, in the order the letter gives them, by the date on the letter, or ask in writing for more time before that date passes. For each finding, say what changed, when it took effect and who owns it now, because a fix already made reads differently from a plan to make one. Do not argue findings that can be fixed. Where the firm disagrees, say so in plain facts and have counsel read the whole response first. Write it for the next examiner, who will read the letter and the response before anything else in the file.

Self-reporting. Whether to report a problem to the Commission is a decision taken with counsel once the facts are known. The problem stays open after the report and after any payment. In the 2024 off-channel actions, the firms that self-reported paid lower penalties than they otherwise would have. They were still found to have violated the recordkeeping rules, censured and ordered to cease and desist. The February firms also agreed to retain independent compliance consultants. A resolution can bring that kind of outside oversight with it, on top of any payment. The work is the same whether or not the firm reports: fix the cause, make clients whole where they were harmed, document what happened and what changed, then decide on reporting with counsel. Whichever way it goes, the firm should be able to show the fix holds.

The record it should leave

Almost every item on the document request is a record the firm should have made during the year:

• each advertisement, its review and the evidence behind its claims;
• the annual review and any reports prepared, with the testing behind them;
• the record of compliance exceptions and what was done about each;
• training given, with documentation of attendance; and
• diligence on the service providers the firm relies on.

For each one, an exam asks whether the record exists, whether it was made when the work was done, and whether the firm can produce it promptly in a form someone else can read (204-2(g)(2)(ii)).

Frequently asked questions

What does the SEC ask for in an exam of an investment adviser? The initial request typically covers general information about the business, the compliance program, information for testing trading, and records for the staff’s own testing, such as advertisements, performance and custody records (September 6, 2023 risk alert).

How does the SEC decide which advisers to examine? By risk. The Division’s stated factors include prior exam findings, tips and complaints, time since registration or the last exam, leadership changes and access to client assets (September 6, 2023 risk alert).

Can an SEC exam be unannounced? Yes. The Division says exams may be announced or unannounced, and on an unannounced exam the staff may provide the request on arrival (September 6, 2023 risk alert).

What are the SEC exam priorities for 2026? For advisers: fiduciary duty, especially toward retail investors; the effectiveness of compliance programs, including annual reviews; and never-examined and recently registered advisers. Across firm types: cybersecurity, Regulation S-ID and S-P, emerging financial technology and anti-money laundering (fiscal year 2026 examination priorities).

What is a deficiency letter? The letter in which the staff sets out what an exam found. Most firms respond by remediating, according to the Division’s fiscal year 2022 priorities.

How long does a firm have to respond to a deficiency letter? The letter sets the date. The rules and staff documents cited here set no deadline of their own.

Does a firm have to report a problem to the SEC itself? The rules cited here create no general duty to report every problem to the staff, though particular rules carry their own notice requirements. Whether to self-report is a decision taken with counsel once the facts are known. In the 2024 off-channel actions, self-reporting lowered the penalty. It did not remove the violation or the remediation, and the February firms also agreed to retain independent compliance consultants.

Sources