The Securities and Exchange Commission’s Division of Examinations published a new exam handbook on Oct. 1, 2026. “The SEC Exam Handbook: A Practical Guide on Process and Engagement” replaces and expands upon the previous examination brochure, giving registrants more detail about what to expect during an examination. It covers each stage of an exam, from the risk assessment process through to the disposition letter. For a CCO at a smaller adviser, private fund manager or new broker-dealer, the useful content is not the tone. It is that the Division has written its clock and its conduct down in one place, and a document like that can be worked to.
One caveat for broker-dealers: most of their routine examinations are conducted by FINRA, and this handbook describes the SEC’s own examinations.
What the handbook says about the clock
The handbook states that the Commission expects records to be available to staff within 24 hours in most circumstances, while in practice the staff usually provides two weeks to produce records in response to the initial request. The handbook says the staff will grant requests for reasonable extensions of time or rolling productions, where appropriate. Most examinations begin with a brief call from staff to the chief compliance officer or other regulatory contact. Under 15 U.S.C. § 78d-5(b), the registrant receives a disposition letter within 180 days of the completion of any on-site portion or the receipt of all requested records, whichever occurs later. The handbook adds that for certain complex examinations, and in very limited circumstances, the deadline may be extended by a further 180 days. If that letter is a deficiency letter, the staff will typically request a written response within 30 days of its date. If the staff has comments on the response, it will strive to provide them within 60 days or contact the firm to discuss timing.
Those numbers are the spine of the document. A firm that plans to the two weeks and can produce its core records inside 24 hours is in a strong position. A firm that treats the two weeks as the point at which to start gathering records is not.
What it says about conduct
The handbook is explicit about interviews. The staff does not record or transcribe meetings, instructs participants not to do so, and does not consent to the use of recording, transcription or artificial intelligence notetaking tools. Firms that have adopted AI meeting assistants should plan to switch them off for every examiner call, and should tell anyone who joins those calls.
On privilege, the handbook asks for a log. A firm that believes information is protected by privilege should provide a privilege log that identifies each withheld document and gives the staff enough information to evaluate the claim. The handbook lists what the log must contain: the identity and position of the document’s creator and of all recipients or those informed of its substance, its creation date, a brief description including subject matter, and the reason it is withheld with the specific privilege claimed. The log must also state the specific request to which each withheld document relates. Privilege assertions should also be noted for any redacted portions of produced documents.
On outcomes, the handbook is plain. Most examinations conclude with a deficiency letter. Deficiency letters purposely do not mandate a particular corrective action beyond complying with applicable law, and do not provide a grade, a peer ranking or best practices. Prompt and appropriate action to correct findings, while not dispositive, may be a mitigating factor in whether staff refer an exam finding to the Division of Enforcement. Staff may also refer a matter to Enforcement without an exit conference or a deficiency letter, typically when exigent circumstances exist. Because supervisory examination staff may attend the exit conference to underline the importance of findings, the Division typically asks that members of senior management or the board of directors attend.
The handbook closes its main text with a two-column table: what registrants can expect from EXAMS, and what EXAMS expects from registrants. The registrant column includes notice of other regulatory inquiries that could affect timeliness, prompt responses or timely extension requests, complete and organized productions that conform to the Data Delivery Guidance, and current and accurate required filings.
What it signals
The handbook is staff guidance: it says that, like all staff statements, it has no legal force or effect, does not alter or amend applicable law, and creates no new or additional obligations for any person. Read it as a description of practice, not a change in law.
Even so, in our reading, a document that tells examiners how to behave, and tells registrants what will be asked of them, is likely to become the reference point in every exam. An exam team that departs from it could be asked why. A registrant that misses a 30-day response date without asking for an extension will likely find the table cited back to it. We expect exam teams to treat the expectations table as a shared scorecard, and we suggest firms do the same.
In our reading, the Division has put its own deadlines on paper, and a firm that cannot meet the registrant side of the table is the one out of step.
The emphasis on filings is also worth noting. The handbook says staff will likely review a firm’s filings and websites before the exam, and that keeping filings current and accurate makes examinations more efficient and can reduce the number of findings. That suggests the first judgment an examiner forms is whether the firm’s public record matches its business.
What still applies
Nothing in the handbook changes the underlying obligations. Registration carries requirements to make and preserve books and records, and to make accurate filings with the Commission and keep them current. The examination authority is statutory; the handbook names section 204(a) of the Investment Advisers Act of 1940 as the basis for requests to registered investment advisers. The reason for a particular exam is non-public, the staff typically does not disclose it, and being selected is not in itself a signal that something is wrong. And none of the three disposition outcomes forecloses the Commission from taking any action against a registrant, including an enforcement action.
So a clean disposition letter is not a clearance, and a deficiency letter is not a grade. The handbook changes what a firm can plan for, not what a firm is answerable for.
What firms should do
The handbook reads as a production and staffing specification. Treat it as one and turn it into a quarter’s work.
Build a standing initial-request pack. Assemble the core compliance records, formatted to the Data Delivery Guidance, so that the key items can go out inside 24 hours and the full production inside two weeks. Taft’s ExamReady tests that pack before an examiner asks for it: a mock document request modelled on current SEC request lists, and a review of what the firm produces.
Name the contacts. Decide now who takes the entrance call, who is the designated point of contact for the exam team, and who keeps the list of other regulatory inquiries that should be disclosed on that first call.
Bring filings and the website into line. Reconcile every filing to the business as it operates today, and fix the website where it has drifted. This is the cheapest finding to avoid.
Prepare the people, not just the documents. Identify who can speak knowledgeably to each part of the business and run them through a mock interview. Write into the interview protocol that recording, transcription and AI notetakers are off for any examiner meeting.
Write a privilege protocol. Decide in advance how privilege claims are identified, who approves them, and how the log fields are captured at the point of production. Privilege is a legal judgment; Taft does not provide legal advice, and the protocol should be settled with your lawyers.
Reserve the board slot and the calendar. Put the exit conference on the standing agenda of senior management or the board as a contingency. Build the 30-day response workflow and the 60-day follow-up into the compliance calendar, and ask for an extension early rather than miss a date. Taft’s guide to audit readiness for financial firms covers how to keep the pack and the calendar current between exams.
Taft prepares firms for examinations: it issues the mock request, reviews what comes back, interviews and coaches the people an examiner would ask for, and reports what it found with recommended fixes. The handbook has told you what the examiners expect. The work this quarter is to be able to show it.
Sources
- SEC’s Division of Examinations Announces New Exam Handbook, U.S. Securities and Exchange Commission
- A Practical Guide on Process and Engagement, U.S. Securities and Exchange Commission
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.