US investment managers are facing continued compliance pressure in 2026, despite expectations that a change in leadership at the Securities and Exchange Commission (SEC) could bring a more relaxed regulatory approach.
Investor protection, fiduciary duties and compliance programme effectiveness remain priorities, while requirements covering cybersecurity, artificial intelligence (AI) and data protection are adding to firms’ operational responsibilities. The challenge is increasingly about demonstrating that compliance controls work in practice, rather than simply showing that policies exist.
Leo RegTech argues that compliance should be embedded into core business operations rather than treated as an administrative exercise. Managing director US Janice Kioko highlights how fragmented processes and incomplete documentation can expose investment managers to risk as regulators demand clearer evidence of effective monitoring, governance and internal controls.
The appointment of Paul Atkins as SEC chair has prompted expectations of a lighter regulatory touch. However, a greater emphasis on fraud and demonstrable investor harm does not remove the need for effective oversight. The SEC’s Division of Examinations continues to focus on retail investor protection, the fiduciary responsibilities of registered investment advisers (RIAs) and the effectiveness of firms’ compliance programmes.
Published in November 2025, the Division’s fiscal 2026 examination priorities cover investment advisers, investment companies, broker-dealers and other registrants. Areas of focus include marketing practices, valuation, trading, portfolio management, disclosures, regulatory filings and custody. Conflicts of interest and standards of conduct also remain under scrutiny, alongside cybersecurity, due diligence and the amended Regulation S-P requirements. Investment managers must be prepared to demonstrate that their records are complete, compliance testing is conducted regularly and controls operate as intended.
AI governance is becoming another important consideration. Examiners may assess whether a firm’s actual use of AI is consistent with the claims it makes to clients and regulators. For instance, a manager that says AI informs portfolio decisions should be able to demonstrate how the technology influences investment outcomes, rather than simply supporting research or administrative work. Clear oversight procedures, reliable audit trails and appropriate documentation can help substantiate these representations.
The amended Regulation S-P requirements further highlight the importance of operational preparedness. The rules introduce incident response planning and customer notification obligations following certain data breaches. Compliance deadlines were set for 3 December 2025 for larger entities and 3 June 2026 for smaller entities. Firms need to maintain incident response programmes, risk assessments, breach records and vendor oversight documentation that can be produced when requested. Where policies are scattered across shared drives and supplier records remain buried in email chains, demonstrating compliance can become considerably more difficult.
Investment managers with commodity interest exposure must also account for requirements overseen by the Commodity Futures Trading Commission (CFTC). Firms relying on exemptions under CFTC Rules 4.13 and 4.14 must affirm their eligibility annually through the National Futures Association’s (NFA) Exemptions Filing System. Failure to meet the applicable requirements can result in the loss of an exemption and potentially bring broader Part 4 obligations into effect.
Some regulatory relief has also emerged. A CFTC no-action letter issued in December 2025 allows certain SEC-registered private fund managers to avoid registration as commodity pool operators or commodity trading advisers. However, managers must carefully assess whether they qualify and retain appropriate documentation to support their position.
Across the SEC, Financial Industry Regulatory Authority (FINRA) and CFTC, the underlying expectation remains consistent: investment managers must be able to demonstrate that their compliance arrangements are effective, appropriately documented and consistently applied. Reliance on disconnected spreadsheets, manual checklists and institutional knowledge can undermine oversight, make emerging risks harder to identify and delay responses to regulatory requests.
Leo RegTech presents its configurable platform as a way for investment managers to consolidate compliance activities within a single system. Its capabilities include policy and procedure management, regulatory filing calendars, AI monitoring, training, due diligence workflows, vendor oversight and audit-ready documentation. Bringing these processes together can give firms greater visibility into their regulatory obligations and the evidence supporting their controls.
As regulatory expectations continue to evolve, investment managers will need to show that compliance is integrated into everyday operations, not simply documented in written policies. Leo RegTech’s analysis highlights the role of connected systems, reliable records and effective oversight in helping firms navigate regulatory complexity and reduce avoidable operational risks.
Read the full Leo RegTech analysis
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
