The US Securities and Exchange Commission's Division of Examinations has published a new guide that lays out, step by step, how its examiners run an exam and what they expect from the firms they visit. Released on 1 October 2026, The SEC Exam Handbook: A Practical Guide on Process and Engagement replaces the division's earlier examination brochure and goes further, covering everything from how firms are picked for review to how an exam is formally closed.
For chief compliance officers at registered investment advisers, broker dealers and other firms the division oversees, the 19-page document is the closest thing yet to a published playbook, including the deadlines that apply on both sides.
"The Division's new handbook clarifies the examination process, offering regulated entities greater insight into what to expect during an exam and establishing clear expectations," said Paul S. Atkins of the US Securities and Exchange Commission
How firms end up on the list
The exam programme is risk-based. Each year the division chooses and publishes priority areas, though it stresses these are not a complete list of what examiners will look at, and some become thematic initiatives examining several firms on the same topic.
What puts a firm in the frame? The handbook lists a broad mix of signals: how earlier exams went, the disciplinary records of its people and affiliates, incoming tips and complaints, how long it has been since the firm registered or was last reviewed, who its clients are, whether its products carry conflicts, turnover at the top, vulnerability to market shocks, press coverage, what it has filed, and whether it has custody of, or access to, client money and securities.
Firms will usually not be told why they were chosen. Selection is not, in itself, a sign that something is wrong, and examiners do not assume misconduct.
From the first call to the information request
Before an exam opens, staff plan its initial scope, which will likely include reviewing a firm's filings and websites. Current, accurate filings make exams more efficient and can reduce the number of findings, the division notes.
Most exams begin with a short call to the chief compliance officer or another regulatory contact, a good moment to flag other regulatory inquiries that might slow responses. A formal letter follows, with an initial request for information made under the examination authority that applies to the firm, such as section 204(a) of the Investment Advisers Act of 1940 for registered advisers.
On timing, the Commission expects records to be available within 24 hours in most circumstances, although in practice staff usually allow two weeks for the initial request. If a deadline is unrealistic, firms can ask for more time or deliver records in batches. A firm withholding documents on privilege grounds should provide a privilege log identifying each document and the privilege claimed.
Examiners may also go directly to custodians, administrators and auditors to verify that reported client assets exist, and may contact clients or customers.
Interviews, site visits and the ground rules
At a minimum, an exam team generally includes one or more examiners, an exam manager, and an assistant director, with a designated lead contact for the firm. Senior division staff joining an exam should not be taken as a sign of heightened concern.
Staff will interview the chief compliance officer and other personnel, and the handbook advises firms to put forward knowledgeable people, which can mean fewer, more productive meetings. During an on-site visit, staff will generally give notice of the start date and may ask for an office tour to understand the flow of work and the control environment.
One rule stands out. When interviews happen over video, examiners keep no recording or transcript of their own, ask firms to do the same, and will not agree to AI notetakers joining the call. Compliance teams that have built AI assistants into their workflows should keep them out of these sessions.
Firms are asked to speak up early if they think examiners have misunderstood a policy or practice. Staff communications are not legal advice.
How an exam ends
The division says it cannot estimate how long a particular exam will take. Under federal law, however, a firm will receive a disposition letter within 180 days of the later of two events: the end of any on-site work, or receipt of all requested records. For certain complex exams, and in very limited circumstances, that deadline can be extended for a further 180 days.
Before that, staff typically hold an exit conference to go through any issues. Because supervisory staff may attend, the division typically asks senior management or board members to be present. This is the firm's chance to correct anything it believes is inaccurate and to describe the steps it has taken or plans to take.
There are three possible endings: a letter closing the exam, a letter closing it with no findings, or a letter asking the firm to fix something. The third, a deficiency letter, is how most exams end. Firms should not expect a remediation plan: the letter asks only that they comply with the law, and it offers neither a score against peers nor a model of best practice. The handbook also warns that if a letter does not mention a particular activity, that does not mean the activity is compliant.
Issues can also be referred to the Division of Enforcement, a self-regulatory organisation, state regulators or criminal authorities. When a situation is urgent, staff may skip the exit conference and the letter altogether and pass the matter straight to Enforcement. None of the three letter types stops the Commission from taking action later, including enforcement action.
Responding, and where to push back
Firms that receive a deficiency letter will typically be asked to respond in writing within 30 days, setting out what they have done or will do to fix the issues and stop them recurring. Fixing problems quickly will not settle the matter on its own, but staff may give it weight in the firm's favour when deciding whether a finding goes to Enforcement. Staff aim to send any further comments within 60 days of the response. The handbook cautions that staff silence should not be read as agreement with the firm's position.
For feedback or unresolved concerns, firms can go to their exam team and its supervisors, or call the Examination Hotline on 202-551-EXAM, which connects to the division's Office of Chief Counsel, allows anonymity and offers the option of speaking to the SEC's Office of Inspector General.
"By answering the call from registrants to provide more clarity to the exam process, we aim to make the process more consistent and predictable for everyone involved," said Keith Cassidy of the US Securities and Exchange Commission
What compliance teams should take from it
The practical message is preparation: current filings, organised records that can be produced quickly, a clear point of contact, briefed interviewees and a proper privilege log. The three deadlines, 180 days for the disposition letter, 30 days for the firm's response and 60 days for staff comments, are worth building into internal exam response procedures.
The handbook is a staff document, not a rule. It has no legal force and creates no new obligations, but it gives firms a clear written account of how the division says it will behave and what it expects in return.
