SEC Exam Handbook Sets Expectations for Registrants

The SEC Division of Examinations published a handbook that establishes expectations for registrants, as well as setting deadlines for exam disposition letters, registrant responses, and staff follow-up comments.

The determination of firms to be examined is based on risk-based factors that include (i) exam and disciplinary history; (ii) tips, complaints, and referrals; (iii) time since the last exam; (iv) products and conflicts; and (v) custody of client assets. The staff typically does not say why an exam opened, and selection alone does not signal wrongdoing.

Registrants' records should usually be available within 24 hours, though the staff often allows two weeks. A registrant seeking to withhold privileged material should provide a log.

The staff does not record interviews, consent to recording or AI note taking, or agree to terms such as choice of law when accessing registrant systems. Exam information is presumed confidential under SEC Rule 203.2, and registrants may seek FOIA confidential treatment under SEC Rule 200.83. The staff may share information with other staff and other regulators without notice.

Exams end with a disposition letter indicating that (i) the exam has concluded, (ii) the exam has concluded without findings, or (iii) the staff requests that the registrant undertake corrective action. Most are likely to end with the third type of letter, which is called a deficiency letter. The deficiency letter does not mandate any particular corrective action beyond complying with the law, grade the registrant, or describe best practices. The Division of Examinations staff may refer matters to the SEC Division of Enforcement, self-regulatory organizations, state regulators, or criminal authorities. No outcome bars Commission action, and prompt corrective action may mitigate a referral decision but is not dispositive.

Under Exchange Act Section 4E, the staff will issue a disposition letter within 180 days of either the completion of the on-site portion of the exam, if applicable, or the receipt of all requested records, whichever occurs later. Complex exams may get another 180 days. A registrant should respond to a deficiency letter within 30 days, and the staff aims to comment further within 60 days of the response. The handbook reflects staff views, has no legal force, and creates no new obligations.