Inside the New SEC Exam Handbook: Practical Takeaways for Registered Firms

By Jason Spitalnick, Dominic M. Hulse, and Mark P. Stern

Key Takeaway

The Securities and Exchange Commission’s (the “SEC” or the “Commission”) Division of Examinations (the “Division”) has replaced its short examination brochure with a nineteen-page handbook describing how the staff selects registrants, conducts examinations, communicates findings, and closes its work. The handbook is a staff statement; because it is not a rule, regulation, or statement of the SEC, it has no legally binding effect. It does, however, serve as a go-to resource for what registrants can expect from the examination process, including staff expectations for registrant interactions, documentary best practices, and deadlines that, without the handbook, registrants have previously been forced to learn through experience. Firms now have a published roadmap and correspondingly less room to explain why they were not ready for any stage of it. With the Commission’s staff making such efforts to prepare registrants for regulatory review, firms should proactively ensure that they are prepared for their next examination.

Background

On October 1, 2026, the Division published The SEC Exam Handbook: A Practical Guide on Process and Engagement, replacing and expanding its prior examination brochure.¹ The new document follows the full life cycle of an examination from risk assessment and candidate selection through the disposition letter. The handbook repeatedly emphasizes accessibility, consistency, and collaboration with staff.

The handbook appears to emphasize a staff willingness to work with firms if they are willing to work with the Division. The Division states that it does not assume misconduct, that being selected for an examination is not an inherent sign of misconduct, and that its staff strives to approach each examination with an “accessible and collaborative mindset” instead of confrontation, adding that the Division expects the same from registrants. A new “Working Together” matrix clearly articulates that expectation in plain English. Per the handbook, registrants should expect tailored requests with reasonable deadlines, an entrance call, coordination to alleviate regulatory overlap, and a willingness to satisfy reasonable requests from registrants. In return, Division expectations include designated points of contact for registrants, notice of other regulatory inquiries that could affect timely responses, complete and organized productions, and transparency about known compliance issues.

While useful, the handbook should not be mistaken for leniency. The handbook describes process rather than a retreat from examination authority. Staff may still request records from third parties, share what a registrant produces with other authorities (without disclosure to registrants), and refer matters to Commission Enforcement, a self-regulatory organization, a state regulator, or criminal authorities, in each case without holding an exit conference or sending a deficiency letter where exigent circumstances exist. A more predictable examination is still an examination that requires preparation and regular compliance reviews.

The Examination Begins Before the Phone Call

As described in the handbook, the Division uses a risk-based process for examination selection informed by, among other things, prior examination and disciplinary history, tips and complaints, time since registration or the last examination, leadership changes, financial or market stress, media reporting, and regulatory filings. The precise reason a firm is selected remains nonpublic information.

To illustrate the importance of day-to-day compliance, Division staff conducts pre-examination diligence before announcing the exam. That review will likely include the registrant’s filings and public-facing website. The handbook expressly states that current and accurate filings can make an examination more efficient and reduce findings. Accordingly, registrants should recognize that issues such as a stale Form ADV or inconsistencies in disclosures can shape a firm’s examination even before the firm knows it has begun.

Most examinations will begin with a brief call to a firm’s chief compliance officer or other regulatory contact, followed by a formal examination letter and an initial information request. As early as possible in the process, firms should consider identifying overlapping regulatory matters or scheduling problems that may affect responsiveness to staff. The Division’s staff has expressed a willingness to work with the examinee on timing where facts and circumstances allow. Even in instances where examinations are unannounced, the Division staff has committed to providing information requests on arrival and conducting an initial interview at that time. When examiners do arrive, firms should note that staff identity can be confirmed through the Examination Hotline.²

Document Production

The handbook draws a distinction that firms should not overlook. The Commission expects records to be available in most circumstances within 24 hours, although the staff usually provides two weeks to respond to the initial information request. Supplemental requests will carry deadlines based on their nature. Reasonable extensions and rolling productions remain available where appropriate, but the handbook expects prompt communication when a request presents a problem for registrants.

This is not a new books-and-records rule. It is a clear statement about operational readiness. Firms should know where responsive records reside, who controls them, how quickly they can be collected, and whether they can be produced in the format required by the Division’s data-delivery guidance. The two-week period should be used to review and organize records – not to discover for the first time whether they exist.

The handbook also formalizes expectations for privilege logs. A log should identify each withheld document and give the staff enough information to evaluate the claim, including, without limitation, the identity and position of the creator, the identity and position of every recipient or person informed of the document’s substance, the creation date, a brief description including subject matter, the specific privilege asserted, and the request to which the document responds. Privilege assertions covering redacted portions of produced documents should be noted as well. For counsel managing an examination production, that is a log built during collection, not assembled afterwards. Any firm that does not currently have a playbook for building a privilege log would be well advised to prepare now instead of when an examination is announced.

Interviews and Site Visits (and no AI Notetaking)

Staff may begin examinations with an interview of a registrant’s personnel to understand the business and refine the examination’s scope. Additional interviews and an on-site visit may follow. These interactions provide meaningful opportunities for a registrant to demonstrate its “culture of compliance” and the tone set by leadership. Senior executives, including the chief compliance officer and other members of the C-suite, should expect to participate and be prepared to speak credibly about the firm’s compliance infrastructure. While the Division expects firms to make knowledgeable personnel available, such persons should be educated by a registrant’s compliance team in best practices for staff interactions before sitting across from examiners.

Fittingly for a period with expanding artificial intelligence, the handbook makes note of recording policies. Staff does not record or transcribe meetings, instructs participants not to do so, and does not consent to the use of recording, transcription, artificial-intelligence notetaking tools, or other similar technologies. Firms that have deployed automated meeting assistants across their calendaring or conferencing environments should confirm that those tools are disabled for examination meetings rather than relying on individual participants to decline them. The Commission expressly withholds consent to recording – a bot that joins by default is unlikely to be viewed as a mere administrative detail.

During examinations, firms that may be able to expect clickwrap to be enforceable against clients should not expect the same from the Division. When staff accesses a registrant’s or its service provider’s systems containing books and records, it expressly does not agree to any associated terms or conditions.

Staff interviews also create a familiar preparation problem. Examiners may ask what seem to be basic questions in order to establish a shared understanding of the business, but the answers can define or expand the examination’s scope. Interviewed personnel, including senior executives, should understand the relevant policies and the firm’s actual practices, know the limits of their own knowledge, and be trained to resist improvising where a follow-up production is the better answer. Leadership participation signals seriousness, but only if those leaders can speak with precision. Professionalism and cooperation do not relieve a firm of disciplined preparation.

The Exit Conference Is an Advocacy Opportunity

Before an examination ends, staff generally will discuss status and potential findings throughout the process. But the exit conference gives the registrant an opportunity to correct inaccuracies, provide overlooked information, and explain remediation already undertaken or planned. Division Director Keith Cassidy has separately encouraged “robust dialogue” at the exit conference and acknowledged that exam teams can overlook information or misunderstand a policy or procedure.³

That invitation should be taken seriously. The exit conference is not merely a preview of the deficiency letter; it may be the last practical opportunity to narrow a finding before it enters the written examination record. Firms should accordingly isolate factual errors, assemble the documents that correct them, and decide in advance which issues warrant management-level engagement. And because supervisory examination staff may attend exit conferences, firms’ compliance teams should be ready to prepare senior management to participate.

Examination Outcomes and Deadlines

Following an examination, the staff’s disposition letter will state (1) that the examination has concluded, (2) that it has concluded without findings, or (3) that the staff requests corrective action. No response is requested or expected in the event of the first two statements. A request for corrective action is a deficiency letter, which as the handbook states, is the result of most examinations. A deficiency letter details findings of potential violations and other findings within the scope of the exam; it does not signal an evaluation of or mandate to the firm. Nor does any examination outcome prevent the Commission from bringing an enforcement action.

While the handbook also declines to estimate how long an examination will take, it does set out three timing benchmarks. First, the registrant will receive a disposition letter within 180 days of either the completion of any on-site portion of the examination or the receipt of all requested records, whichever occurs later (a deadline that may be extended by an additional 180-day period for certain complex examinations in very limited circumstances). Second, the staff will typically request a response within 30 days of the date of the deficiency letter and will consider an extension if the registrant asks as soon as it knows it cannot meet the deadline. Third, if the staff has further comments, it will strive to provide them within 60 days of the response or contact the registrant about timing.

The response to the Commission deserves the same attention as the production. It should address each finding, distinguish disagreement from remediation, and avoid commitments the firm cannot operationalize. Prompt and appropriate corrective action, while not dispositive, may be a mitigating factor in whether the staff refers a finding to Enforcement. Two cautions follow from the handbook: the staff generally does not comment on the adequacy of proposed corrective action and the absence of comment should not be read as concurrence. Likewise, closure is not a finding or conclusion binding on the Commission, though a registrant can ask the exam team to confirm that the examination has been closed.

What Registrants Should Do Now

The handbook’s principal value is that it converts a previously experience-based process into a public readiness checklist. Registrants should use it that way.

First, review regulatory filings, websites, and client-facing disclosures for accuracy and consistency with actual operations. The Division has expressly identified those materials as part of its pre-examination diligence.

Second, test whether core examination records can be located, reviewed, and produced quickly. A mock request that assumes a two-week deadline – and tests whether records are genuinely available within 24 hours – will expose weaknesses that an ordinary annual review may miss.

Third, update examination protocols to address privilege logs, third-party and asset-verification requests, interview preparation, videoconference and AI notetaking practices, confidential treatment under SEC Rule 83, escalation channels, and responsibility for the deficiency-letter response.

Finally, plan for substantive engagement. The Division is promising a more accessible process with solicitations for feedback on both the exam process and staff conduct. Firms should use identified channels deliberately rather than confusing collaboration with informality. Questions, extensions, factual corrections, and disagreements should be raised early, supported carefully, and documented. For firms that would appreciate real-time engagement with the Division on the examination process, compliance seminars will take place in Denver on October 27, 2026, and in Salt Lake City on October 29, 2026.⁴

The handbook does not change the substantive obligations of registered firms. It changes the information environment in which those obligations will be examined. Registered investment advisers, broker-dealers, investment companies, transfer agents, clearing agencies, and municipal advisors – and, of course, their chief compliance officers and legal personnel who manage their examinations – should take steps to align their examination protocols with the published process now rather than during the opening call.