Fiduciary duty, cybersecurity and AI top SEC's 2025 exam priorities

The SEC has unveiled its 2025 examination priorities, highlighting the emerging and continuing risk areas it perceives among wealth firms, investment advisers, broker-dealers, and wealth technology companies.

In its announcement on Monday, the Securities and Exchange Commission's examinations division emphasized the evolving regulatory landscape surrounding fiduciary duty, the rise of artificial intelligence, cybersecurity, and new rules intended to safeguard investors and the capital markets.

"In examining for compliance with our time-tested rules, the Division plays a critical role in protecting investors and facilitating capital formation," SEC Chair Gary Gensler said in a release. "Working with registrants to understand the rules helps ensure that markets work for investors and issuers alike.”

For investment advisers, one key focus among the SEC's 2025 exam priorities will be adherence to fiduciary standards of conduct. Among other priorities, the division said it aims to ensure advisers act in the best interest of their clients, a central element of their fiduciary duty.

Over the coming 2025 fiscal year, examiners will take a hard look at investment strategies, especially high-cost, illiquid, and hard-to-value products. The SEC said it will also be paying closer attention to recommendations tied to assets vulnerable to fluctuating interest rates and economic conditions.

The regulator also confirmed it will continue to assess the effectiveness of advisers' compliance programs, probing for vulnerabilities in how advisers address conflicts of interest, manage third-party service providers, and oversee the valuation of difficult-to-assess assets. The division will also be paying close attention to firms using AI for advisory services including portolio management, trading, marketing and compliance, evaluating whether algorithms align with stated investment strategies and client profiles​.

"If an adviser utilizes a large number of independent contractors working from geographically dispersed locations, examinations may focus on supervision and oversight practices," the SEC said.

For broker-dealers, the SEC said it will continue to examine firms' practices around Regulation BI, including those impacting product and investment recommendations, how they disclose and mitigate conflicts of interest, and how they take investors' goals and account characteristics into consideration.

"In particular, examinations of broker-dealer practices will focus on those recommended products that are complex, illiquid, or present higher risk to investors," the statement said, specifically pointing to "highly leveraged or inverse products, crypto assets, structured products, [and] alternative investments."

The SEC said it may also conduct exams focused on brokers' recommendations made through automated or digital tools, advice related to opening option, margin, and self-direct IRA accounts, and recommandations made to specific investor cohorts such as older investors or people saving for retirement or college.

Cybersecurity was another key theme for the regulator. Highlighting risks from cyberattacks and the threat of operational disruptions to wealth firms and technology platforms the SEC bared plans to assess firms’ practices in preventing data breaches and safeguarding customer information, as well as how they respond to ransomware attacks and other breaches. Beyond the security of AI tools, the scope of the SEC's scrutiny will include third-party IT services and the data infrastructure used by wealth managers.

"The Division remains focused on registrants’ use of certain services, such as automated investment tools, AI, and trading algorithms or platforms, and the risks associated with the use of emerging technologies and alternative sources of data," the statement said.

For firms that use digital engagement practices, the SEC said its reviews will generally be paying attention to whether they make fair and accurate reperesentations, whether their operations and controls are in line with their disclosures to investors, and whether those recommendations fall within the bounds of their regulatory duties to investors, including older individuals.

"[T]he Division will assess whether firms have implemented adequate policies and procedures to monitor and/or supervise their use of AI, including for tasks related to fraud prevention and detection, back-office operations, anti-money laundering (AML), and trading functions, as applicable," the SEC statement said.