Where We Have Been, Where the Signals Point, and What to Do Before Year-End

The regulatory calendar does not pause at midyear, but it does offer a moment for reflection. Six months into 2026, the promise of deregulatory momentum and the reality of it have diverged in the ways they always do. Enforcement volumes are down. Tone has shifted. But the obligations governing registered firms have not dissolved, and the examination apparatus has not stood down. What has changed is the terrain, and that terrain rewards firms that are paying attention.

The Enforcement Landscape at Midyear

The SEC released its FY2025 enforcement results on April 7, 2026, several months later than historical norms, a timing gap noted publicly and likely due to government shutdown. The headline: 456 total enforcement actions, including 303 standalone actions, representing decreases of 22% and 30% respectively from FY2024. Adjusted for the Stanford International Bank outlier, a 2009 matter finally resolved, monetary relief falls to approximately $2.7 billion. The addendum makes clear that the $2.3 billion in off-channel communications penalties from FY2022 through early FY2025 represented, in this Commission's view, an inappropriate use of enforcement resources that did little to advance investor protection. Whistleblower tips reached a record 53,753, up 19%, while payouts fell from $255 million to $60 million, signaling selectivity rather than withdrawal. The appointment of David Woodcock as Enforcement Director reinforces the direction: fraud, not technical violations, is the supposed organizing principle.

FINRA filed 625 new disciplinary cases in 2025, a 14.4% decline, but fines rose 31.7% to $99.6 million, arithmetically explained by a single $26 million Robinhood penalty. Strip that out, and total fines fell 15%. AML remained the top enforcement category; communications violations returned to the top five for the first time in years, driven by social media and crypto-adjacent messaging. Regulation Best Interest generated 47 actions -- no longer transitional, now durable.

The CFTC's enforcement posture shifted sharply toward fraud targeting U.S. retail customers. A May 2026 case, parallel DOJ and CFTC insider trading charges involving prediction market event contracts, signals that derivatives compliance and digital asset compliance are formally converging. The NFA's March 2026 exemption affirmation deadline passed without grace: any CPO or CTA exemption not timely affirmed was withdrawn, a consequence with real operational weight.

The most consequential midyear development may belong to FinCEN. Its April 7, 2026 proposed rule fundamentally restructures AML/CFT program requirements, moving away from process-driven, technical compliance toward a regime focused on demonstrable outcomes and effectiveness. The FinCEN fact sheet confirms that enforcement exposure will be reserved for significant AML/CFT supervisory actions, with a new notice and consultation framework between federal banking supervisors and FinCEN. Comments closed June 9; a 12-month implementation window follows. The RIA AML rule has been delayed to January 1, 2028, but it is coming. CRC-Oyster's analysis is available in AML in Transition: Enforcement Trends, Regulatory Direction, and the Expanding Expectations for Financial Institutions.

What the 2026 Exam Priorities Are Telling You

The SEC Division of Examinations' 2026 priorities arrived with an explicit framing shift from Chairman Atkins: examinations are not a "gotcha exercise," and the release is designed to enable firms to prepare for a constructive dialogue with SEC examiners. Core obligations persist, fiduciary duty, compliance program effectiveness, custody, Regulation S-P. Crypto assets were omitted from the priorities for the first time since 2018. What intensifies: adherence to fiduciary standards of conduct, effectiveness of compliance programs, and concentrated attention on never-examined and recently registered advisers.

FINRA's 2026 Annual Regulatory Oversight Report was published earlier than in prior years, aligning more closely with the SEC's exam priorities release, and adds a new section on continuing and emerging trends in generative AI. FINRA warns that GenAI use, whether in-house or via third-party vendors, introduces new compliance challenges including data privacy, transparency, auditability, hallucinations, and potential misuse, and reaffirms that firms cannot outsource their regulatory obligations. Under FINRA Forward, Member Supervision, Market Oversight, and Enforcement have unified into a single Regulatory Operations function; expect a more integrated, cross-functional examination lens.

The Market Forces Compliance Programs Cannot Ignore

The GENIUS Act created the first U.S. federal framework for payment stablecoins, declaring them outside the securities definition and resolving years of structural uncertainty. The SEC's interpretive guidance on digital asset categories provides the market's first durable taxonomy. Compliance teams that have waited to build digital asset policies are now behind the market. CRC-Oyster's perspective is detailed in Digital Assets and the Road to Institutional Trust.

Artificial intelligence is no longer theoretical, it is operational. Both the SEC and FINRA identify AI governance as a distinct examination area, requiring demonstrable oversight, not just disclosure. The compliance risk is not that the tool will give bad advice; it is that the firm cannot demonstrate governance over a tool influencing client outcomes.

Off-channel communications enforcement, the $2.3 billion chapter, is formally over as a standalone priority. The underlying recordkeeping obligation is not. Firms that built eComms programs under penalty threat now need to determine whether those programs are genuine operational infrastructure or compliance theater. CRC-Oyster's recent E-Communications Monitoring service spotlight addresses this distinction directly.

A lighter enforcement posture can produce a loosening of compliance discipline that accumulates into genuine exposure. The statutory framework has not changed. Reg BI, the custody rule, AML program requirements, and the 2024 Reg S-P amendments are all active. Adaptability is a virtue; complacency dressed as it is a fault line.

What to Do Before Year-End: Testing & Exam Prep

The second half of 2026 is not a waiting period, it is the window to stress-test the compliance infrastructure that will be visible to examiners in the cycle ahead.

Click Here for the Interactive Widget: What to Do Before Year-End: Testing & Exam Prep Tracker

Partner with CRC-Oyster

The regulatory environment described here is actively being written. The rules being finalized now, the examination priorities already in effect, and the product categories crossing into mainstream distribution all have compliance implications that are best addressed ahead of an examination, not in response to one.

CRC-Oyster works with registered investment advisers, broker-dealers, NFA members, fintech firms, and family offices to build compliance programs that are operational, documented, and defensible, whether that means a full-cycle annual review, targeted AML or cybersecurity evaluation, digital asset policy development, AI governance documentation, or ongoing outsourced compliance support.

Contact us or download our 2026 Registered Investment Adviser and Broker Dealer Regulatory Outlook to see where this year's compliance landscape is heading, and how to get ahead of it.