Key takeaways
The SEC is touting a return to fundamentals in FY27, but also says it will increase scrutiny of AI, cybersecurity, operational resilience, and private credit.
D&O and E&O underwriters may increasingly scrutinize governance, compliance, technology controls, conflicts, valuations, disclosures, and investment practices.
Companies should reassess D&O and E&O limits, coverage triggers, exclusions, and program structure ahead of upcoming renewals.
The Securities and Exchange Commission (SEC) is returning its focus to familiar regulatory fundamentals, but the risks surrounding them are evolving. For SEC-regulated organizations, those priorities could shape not only regulatory scrutiny, but D&O and professional liability underwriting and coverage discussions.
Back to basics, with some new areas of emphasis
On Oct. 23, the SEC’s Division of Examinations announced its priorities for fiscal year 2027 (opens a new window), which began on Oct. 1, 2026. The priorities reflect a return to core responsibilities while adapting examinations to evolving risks, business practices, and technologies.
Among the areas receiving particular attention in FY 2027 are:
Investment advisors: Fiduciary obligations, conflicts of interest, compliance programs, valuations, and complex or illiquid investments, with additional attention to recently registered or never-examined advisors.
Investment companies: Fees and expenses, portfolio management, disclosures, governance, and investments in complex or illiquid products, including private credit.
Broker-dealers: Financial responsibility, trading practices, Regulation Best Interest, anti-money laundering programs, and supervision.
Information security and operational resilience: Cybersecurity governance, data-loss prevention, access controls, incident response and recovery, third-party technology risk, and safeguards for customer information.
Emerging technology: Firms’ use of artificial intelligence (AI) — which the federal government is now referring to as “super intelligence” (opens a new window) — in areas including investment analysis, customer management, code development, compliance, fraud detection, and trading.
Technology and private markets move further into focus
The SEC is examining the use of AI and other technologies along with regulated companies’ preparations for technology-enabled threats, including AI-generated phishing and synthetic or deepfake voice and video. The SEC is also incorporating these tools into its own examinations and risk-assessment activities.
The SEC examination priorities specifically note private credit among the less-liquid investments that may receive additional attention, including questions about valuation, redemptions, conflicts, and risk disclosures.
More enforcement activity on the way?
While the SEC’s Division of Enforcement is distinct from its Division of Examination, examination priorities and findings can influence enforcement activity, which has been depressed of late. In fiscal year 2026, which ran from Oct. 1, 2025, through Sept. 30, 2026, the SEC filed 308 enforcement actions (opens a new window), according to consulting firm Brattle, less than half the annual average of 710 for fiscal years 2018 through 2025.
Activity picked up considerably during the second half of the year, with 99 actions in September alone. Brattle attributed FY 2026’s limited enforcement activity, particularly in the first half, to low SEC staffing levels and disruptions from the 2025 government shutdown. Brattle projects 350 to 450 enforcement actions in FY 2027, still well below the FY 2018 to FY 2025 average but a significant increase from FY 2026. Some of that activity could align with the SEC’s examination priorities.
More underwriting scrutiny expected
Investment advisors, broker-dealers, and organizations with meaningful private market exposures should expect directors and officers liability (D&O) insurers to pay attention to the same regulatory themes attracting SEC scrutiny. Underwriters may seek more information about compliance programs, governance, conflicts of interest, and risk controls relevant to those activities.
Organizations using AI and other emerging technologies should be prepared to explain how they are governed and monitored, including controls around operational use and technology-enabled cyber risks.
Private credit may warrant special attention. The examination priorities specifically address valuation, liquidity, disclosures, and conflicts associated with private credit in several contexts. Organizations exposed to this sector should be prepared for underwriters to probe how relevant risks are identified and managed.
Financial services professional liability (E&O) underwriters may similarly take a closer look at how investment advisors, investment companies, and broker-dealers manage risks arising from their investment activities, products, and services. Areas of inquiry may include investment due diligence, suitability and best-interest standards, conflicts of interest, valuation practices, fee and expense allocations, client disclosures, and controls to prevent trading errors and misuse of material nonpublic information.
For firms offering complex or illiquid investments, underwriters may pay closer attention to controls around product selection and firm processes for assessing whether specific products are appropriate for individual investors to whom they are recommended and whether associated risks, including liquidity constraints, are adequately disclosed.
The SEC’s emphasis on information security, operational resilience, and emerging technology may also prompt more detailed E&O underwriting questions. Firms should be prepared to explain how they test and supervise AI-assisted investment advice, automated trading, and other technology-supported services, including human oversight, data quality, model validation, and the accuracy of representations made to clients. Underwriters may similarly examine oversight of third-party providers, safeguards against unauthorized transactions, business continuity arrangements, and the ability to maintain client services during cyber incidents or technology outages.
Reassessing investigation coverage
The SEC’s FY 2027 examination priorities should prompt regulated companies to reassess whether their D&O programs’ limits and structure remain appropriate — and whether coverage will respond if regulatory attention develops into investigations.
An important consideration is entity investigation coverage. Traditional public company D&O policies generally provide coverage for investigations involving insured individuals, subject to policy terms and conditions. But public D&O policies typically do not provide broad coverage for investigations of corporate entities themselves. Entity investigation coverage added via endorsement, typically for additional premium, can potentially provide coverage for significant investigation response costs such as outside counsel, e-discovery, and forensic accounting services.
The details matter. There is no market standard for entity investigation coverage; triggers can vary substantially among insurers and policy forms. Some coverage may require an associated securities claim or investigation of an insured individual that independently meets the policy’s definition of a claim. Routine regulatory examinations also typically fall outside coverage regardless of whether entity investigation coverage is purchased. Whether a particular SEC inquiry is covered, therefore, heavily depends on the policy wording and the nature and circumstances of the inquiry.
If entity investigation coverage is important to an organization, a buyer should evaluate not simply whether coverage is nominally available, but what triggers it, what costs it covers, and how it interacts with the rest of the D&O program. Along with pricing and claims-paying reputations, the availability and breadth of that coverage may also be a relevant consideration when selecting insurers.
Meanwhile investment advisors, investment companies, and broker-dealers should reassess whether their E&O coverage is keeping pace with their activities, products, and use of emerging technology. E&O policies can respond to customer, investor, and regulatory claims alleging negligent advice, fiduciary breaches, unsuitable recommendations, conflicts of interest, misleading disclosures, trading errors, and failures of supervision. Not all E&O policies are created equal, however. In reviewing their options, buyers should consider whether:
The definition of claim adequately addresses regulatory proceedings and investigations.
Professional services encompass activities performed using AI and other technology.
Broadly worded exclusions could restrict coverage for otherwise covered claims.
The SEC’s focus on information security and operational resilience also underscores the need for financial institutions to understand how E&O coverage interacts with cyber and other insurance policies.
For all organizations subject to greater SEC scrutiny, understanding where regulatory exposure and insurance protection intersect should be a critical part of 2027 renewal conversations. Companies should consult with outside legal counsel about regulatory obligations and industry-specific exposures and work with their insurance advisors to assess insurance program limits and structure.
