Key Takeaways
- • The SEC's examinations division's 2027 priorities report, released Oct. 23, signals more intensive reviews of AI-related cyber risks and illiquid product valuation, including private credit.
- • Examiners are prioritizing how firms defend against AI-enabled cyber threats, requiring documentation of AI inventory, governance, monitoring controls, and incident response programs that account for AI-generated attacks and stolen credentials.
- • Firms relying on third-party vendors must conduct extensive due diligence on those vendors' cybersecurity controls and data protection practices, per Debevoise & Plimpton and Sidley Austin attorneys.
- • Private credit valuation processes, fee and expense provisions tied to valuation, and private credit redemptions are under close examination staff scrutiny, particularly as the SEC expands retail access to alternatives.
- • Legal experts advise firms to conduct policy reviews and mock examinations now to avoid costly enforcement actions later.
Summary
The SEC's Division of Examinations has sharpened its focus on artificial intelligence cybersecurity and private credit valuation for 2027, according to a 2027 examination priorities report released October 23 and reported by Pensions & Investments. The division continues to emphasize fiduciary duties, conflicts of interest, retail investor protection and cybersecurity, but signals more intensive reviews of economic conflicts, illiquid product valuation, and risks associated with cyberattacks involving AI, which the SEC refers to as "super intelligence." Legal experts say firms that do not tighten their policies now risk costly, time-consuming enforcement actions later.
On AI, the SEC is moving beyond probing firms' representations about their AI capabilities to prioritizing how firms defend against AI-driven cyber threats. Elizabeth Shea Fries, a partner and global leader of the investment funds practice at Sidley Austin, said firms should be ready to describe their AI inventory, governance and monitoring controls, and to show that identity theft and incident response programs account for AI-generated attacks and stolen credentials. That responsibility extends to third-party vendors, with Fries noting that firms must consider how outside providers protect data, particularly from a privacy perspective. Kristin Snyder, a litigation partner at Debevoise & Plimpton, said firms contracting with outside vendors must conduct extensive due diligence on those vendors' cybersecurity protections, especially when handling sensitive customer information.
On private credit, examiners will focus on standards of conduct in recommending complex products, particularly given SEC Chair Paul Atkins's push to expand retail access to private markets. The agency has taken steps including an April no-action letter permitting open-end funds, including mutual funds and ETFs, to co-invest in negotiated private market transactions, and two proposals released September 30 to make it easier for private fund managers to raise money from retail investors. The SEC's report says reviews will assess investment-related risk disclosures for consistency with fiduciary standards, covering debt use, fund-level lines of credit, affiliated service providers, and the accuracy of fee and expense calculations. Snyder said the SEC will also test whether advisers have reasonably assessed valuation processes for private credit and illiquid products, noting that valuation remains a perennial exam focus, particularly for troubled credits or defaulted investments. The SEC also said it will monitor private credit redemptions. Snyder added that fee provisions intersecting with valuation draw close attention, since an impairment could lower fees depending on how a fund calculates them. Experts recommended mock examinations in higher-risk areas as a proactive step.
On AI, the SEC is moving beyond probing firms' representations about their AI capabilities to prioritizing how firms defend against AI-driven cyber threats. Elizabeth Shea Fries, a partner and global leader of the investment funds practice at Sidley Austin, said firms should be ready to describe their AI inventory, governance and monitoring controls, and to show that identity theft and incident response programs account for AI-generated attacks and stolen credentials. That responsibility extends to third-party vendors, with Fries noting that firms must consider how outside providers protect data, particularly from a privacy perspective. Kristin Snyder, a litigation partner at Debevoise & Plimpton, said firms contracting with outside vendors must conduct extensive due diligence on those vendors' cybersecurity protections, especially when handling sensitive customer information.
On private credit, examiners will focus on standards of conduct in recommending complex products, particularly given SEC Chair Paul Atkins's push to expand retail access to private markets. The agency has taken steps including an April no-action letter permitting open-end funds, including mutual funds and ETFs, to co-invest in negotiated private market transactions, and two proposals released September 30 to make it easier for private fund managers to raise money from retail investors. The SEC's report says reviews will assess investment-related risk disclosures for consistency with fiduciary standards, covering debt use, fund-level lines of credit, affiliated service providers, and the accuracy of fee and expense calculations. Snyder said the SEC will also test whether advisers have reasonably assessed valuation processes for private credit and illiquid products, noting that valuation remains a perennial exam focus, particularly for troubled credits or defaulted investments. The SEC also said it will monitor private credit redemptions. Snyder added that fee provisions intersecting with valuation draw close attention, since an impairment could lower fees depending on how a fund calculates them. Experts recommended mock examinations in higher-risk areas as a proactive step.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.