The SEC's 2024 amendments to Regulation S-P represent the most significant overhaul of consumer financial data protection rules for broker-dealers and investment advisers in years. For smaller entities, including registered investment advisers with less than $1.5 billion in AUM and certain smaller broker-dealers, the compliance deadline was June 3, 2026.

The amended rule requires firms to maintain a written incident response program specifically designed to detect, respond to, and recover from unauthorized access to customer information. Critically, firms must also notify affected customers promptly when their sensitive data has been, or is reasonably likely to have been, compromised. This is not a box-checking exercise. FINRA's 2026 Regulatory Oversight Report cited recordkeeping and cybersecurity lapses over 50 times, signaling that examiners will actively test whether programs exist and actually work.

Action Steps If You Have Not Yet Complied:

• Finalize and document your written incident response program under amended Reg S-P
• Build and test customer notification procedures for potential data breaches
• Confirm your vendor contracts address breach notification obligations
• Conduct a tabletop exercise to validate that your program works in practice, not just on paper
• Determine whether your firm qualifies as a "larger" or "smaller" entity—the definitions are not interchangeable between FINRA and SEC

The SEC extended the compliance date for broker-dealers required to move to daily reserve formula computation under Rule 15c3-3(e)(3)(i)(B)(1) to June 30, 2026. Firms that were required to compute their customer protection reserve daily as of December 31, 2025 must be fully operational under the new schedule by this date. Other firms may elect daily computation by providing 30 days' prior written notice to their examining authority.

FINRA has flagged recurring issues with Supplemental Liquidity Schedule (SLS) reporting, including misidentified counterparties, incomplete noncash securities lending data, and inaccurate co-reporting, that are directly tied to liquidity management and reserve computation practices. Firms that are not precise on SLS reporting are likely to surface problems when daily computation begins.

Action Steps:

• Confirm your daily reserve computation system is operational and tested before June 30
• Review SLS reporting for counterparty accuracy and completeness of securities lending data
• If electing daily computation voluntarily, submit 30-day prior notice to your examining authority
• Update liquidity stress testing models to reflect the daily computation cadence

FINRA's Rule 6500 Series—the Securities Lending and Transparency Engine (SLATE), went live on January 2, 2026. This new framework, mandated by SEC Rule 10c-1a under the Securities Exchange Act, requires persons entering into securities loans to report specific terms of each loan to SLATE on the same day the loan is effected or modified. This is the first-ever system of its kind for the securities lending market.

Lenders are generally the Covered Person responsible for reporting, unless an intermediary such as an agent lender is used. Broker-dealers operating retail or institutional fully paid lending programs are responsible for reporting their loans with lending customers. Each Covered Person must become a SLATE Participant, pay reporting fees to FINRA, and comply with the cybersecurity and physical security requirements embedded in the SLATE rules.

On March 11, 2026, SEC Chairman Paul Atkins and CFTC Chairman Michael Selig signed a Memorandum of Understanding establishing a joint framework for oversight of digital assets, committing both agencies to clarify, coordinate, and harmonize policies, including a fit-for-purpose regulatory framework for crypto assets with a "minimum effective dose" approach to regulation.

On March 17, 2026, the SEC and CFTC followed with a joint Interpretive Release, the first major SEC statement clarifying how federal securities laws apply to cryptoassets and related transactions. The SEC's June 2026 Draft Strategic Plan for fiscal years 2026–2030 has designated digital assets and distributed ledger technology as the agency's first regulatory objective under Goal 1. This is no longer a peripheral issue.

For broker-dealers, current SEC guidance clarifies how custody rules, net capital requirements, and supervisory obligations apply to digital asset holdings. The agency has confirmed that broker-dealers can facilitate in-kind creations and redemptions in connection with spot crypto ETPs, subject to net capital accounting requirements. However, no blanket safe harbor exists, guidance is fact-specific and conditional, and firms that rely on it must remain within its contours.

In one of the most significant pending developments for the investment adviser industry, FinCEN formally delayed the effective date of the Investment Adviser AML/CFT Rule from January 1, 2026 to January 1, 2028. The rule, finalized in 2024, formally designates most SEC-registered investment advisers (RIAs) and exempt reporting advisers (ERAs) as "financial institutions" under the Bank Secrecy Act, triggering obligations to establish AML programs, file Suspicious Activity Reports (SARs), conduct ongoing customer due diligence, and maintain related records.

The delay does not mean the rule is going away. FinCEN has explicitly stated its intent to review and further tailor the rule during the extended timeline, including potential coordination with the SEC on a joint Customer Identification Program (CIP) rule for investment advisers. The final scope of obligations may shift, but the core structure of the rule is expected to remain intact. For independent RIAs without existing AML infrastructure, January 2028 is not as distant as it sounds.

Action Steps for RIAs and ERAs:

• Assess your firm's current AML posture and identify gaps relative to the pending rule requirements
• Determine whether your firm qualifies for any exemptions or reduced obligations under the rule
• Monitor FinCEN rulemaking updates for revised scope and CIP rule coordination
• Designate an AML compliance officer and begin policy framework development
• For affiliated firms: confirm whether existing bank or broker-dealer AML programs will satisfy the forthcoming rule

In February 2026, FINRA filed a proposed amendment to Rule 2210 (Communications with the Public) that would, for the first time, permit broker-dealers to include projected performance and targeted returns in communications with institutional customers, and in limited circumstances, retail customers, provided firms maintain written policies and procedures ensuring the content is relevant to the likely financial situation and investment objectives of the intended audience.

This proposal takes a meaningful step toward closing a long-standing competitive imbalance between broker-dealers and investment advisers, who have operated under the more permissive SEC Marketing Rule since 2021. The rule is still under SEC review and is not yet final. Firms should monitor for adoption timeline updates and begin drafting supervisory frameworks in anticipation.

What Firms Should Do Now:

• Monitor the SEC's review of FINRA's Rule 2210 proposal for adoption timeline
• If you offer projections today under Investment Adviser rules, assess how a Rule 2210 adoption would affect your dual-registrant obligations
• Begin drafting written supervisory procedures (WSPs) governing the use of projected performance in communications

FINRA filed a rule proposal with the SEC in January 2026 to streamline and update the existing requirements governing outside business activities (OBA) and private securities transactions (PST) for registered representatives. The proposal is intended to reduce unnecessary burdens while preserving investor protection. Changes to OBA and PST rules could affect how firms supervise, review, and approve outside activities—particularly at firms with large numbers of dual registrants.

This matters more than ever: the 2026 FINRA Industry Snapshot found that dual registrants, individuals registered as both broker-dealer representatives and investment adviser representatives, now outnumber broker-dealer-only registrants, with 331,802 dual registrants versus 307,921 single registrants. The compliance complexity of OBA oversight is only growing.

The SEC has amended its requirements governing the electronic submission of broker-dealer annual reports and FOCUS Reports. Annual reports must now be filed on EDGAR as Interactive Data Files using XBRL tagging. For firms with a minimum fixed dollar net capital requirement of $250,000 or more as of December 31, 2025, this applies to filings due on or after June 30, 2027. For all other firms, the requirement applies to filings due on or after June 30, 2029.

Firms that have not previously filed on EDGAR will need to obtain EDGAR access credentials well in advance of their applicable deadline. Paper submissions of annual reports are no longer accepted by the SEC under amended Rule 17a-5(d)(6)(i).

Action Steps:

• Determine your applicable EDGAR/XBRL filing deadline based on net capital requirements
• If not already registered, obtain EDGAR access credentials via Form ID submission on SEC.gov
• Engage your financial reporting team to assess XBRL tagging capabilities and system requirements
• Do not wait until 2027 to test EDGAR submission workflows—build the process now