SEC Reg S-P Sweep Exams: What Investment Advisers Should Be Ready To Produce Now

Industry reports indicate that the SEC’s Division of Examinations (“DOE”) has moved from identifying Regulation S-P as a 2026 examination priority to issuing document request letters in what appears to be a sweep examination of registered investment advisers. A reported SEC document request letter, circulated among compliance professionals, aligns with the DOE’s published 2026 priorities and earlier outreach on the 2024 Reg S-P amendments. This alert summarizes the reported focus areas and practical steps advisers should take now.

Why This Matters Now

Both compliance deadlines under the 2024 Reg S-P amendments have now passed:

• December 3, 2025 – Compliance deadline for “large” covered institutions (including SEC-registered investment advisers with $1.5 billion or more in AUM).
• June 3, 2026 – Compliance deadline for “small” covered institutions (including SEC-registered investment advisers below the $1.5 billion threshold).

The DOE’s 2026 examination priorities stated that it would examine compliance with the amended requirements after the applicable compliance dates. For additional background on the Reg S-P amendments, see our September 25, 2025 alert.

What Examiners Appear to Be Asking For

The reported letter requests information in the following areas:

• Governance and Risk Management: Organization charts, cybersecurity reporting lines, committee structures, IT governance, and risk assessment documentation.
• Compliance Program: Advisers Act Rule 206(4)-7 policies and procedures, most recent annual compliance review, compliance testing and automated oversight tools, and records of non-compliance or internal investigations.
• Privacy and Information Security: Privacy notices and delivery evidence, safeguards, complaints, and incident-response materials.
• Cybersecurity Incidents: Incidents or breaches during the review period, including client harm and remediation.
• Service Providers and Vendor Management: Vendor policies, risk assessments, service agreements, monitoring, and complete vendor lists.
• Personnel and AUM: Current and terminated personnel, outside counsel and consultants, and client account/AUM data.

Practical Steps for Advisers

While the SEC has not publicly released the letter, we recommend that registered advisers treat the reported requests as an exam-readiness roadmap and use them to assess whether their written Reg S-P policies align with actual practices. Advisers should also confirm that core documentation (including incident-response materials, vendor-oversight records, risk assessments, privacy notices, and governance materials) can be produced promptly if requested. A focused review now can help identify and address gaps before an examination request arrives.