US investment managers expecting a more relaxed regulatory environment in 2026 may need to reconsider. Regulatory scrutiny remains focused on investor protection, fiduciary responsibilities and the effectiveness of compliance programmes, while evolving requirements around cybersecurity, artificial intelligence (AI) and data protection are adding to firms’ operational demands. For managers, the challenge is no longer simply having compliance policies in place, but demonstrating that their controls work in practice.
Leo RegTech argues that firms need to treat compliance as a core operational capability rather than an administrative obligation. Managing director US Janice Kioko highlights how fragmented processes and inadequate documentation can leave investment managers exposed as regulators increasingly expect firms to demonstrate that their policies, monitoring and governance arrangements are effective.
The appointment of Paul Atkins as chair of the Securities and Exchange Commission (SEC) has prompted some market participants to anticipate a softer regulatory approach. However, a greater focus on fraud and tangible investor harm should not be interpreted as an absence of scrutiny. The SEC’s Division of Examinations continues to prioritise retail investor protection, the fiduciary duties of registered investment advisers (RIAs) and the effectiveness of compliance programmes.
Published in November 2025, the Division’s fiscal 2026 examination priorities cover investment advisers, investment companies, broker-dealers and other registrants. Key areas include marketing, valuation, trading, portfolio management, disclosures, regulatory filings and custody. Conflicts of interest and documented standards of conduct also remain important, alongside emerging risks involving cybersecurity, due diligence and amended Regulation S-P requirements.
Investment managers should therefore be prepared to demonstrate that they maintain appropriate records, conduct regular compliance testing and verify that their controls operate as intended. Policies alone may not be enough if firms cannot show how those policies are implemented and monitored.
AI governance is another area attracting regulatory attention. Examiners may assess whether a firm’s actual use of AI aligns with representations made to clients and regulators. For example, a manager claiming that AI drives portfolio decisions should be able to demonstrate how those tools influence investment outcomes, rather than merely supporting research or administrative tasks. Documented processes, clear oversight and reliable audit trails can help firms substantiate their claims.
The amended Regulation S-P illustrates the growing importance of operational readiness. The rules introduce requirements covering incident response planning and customer notification following certain data breaches. Compliance deadlines are 3 December 2025 for larger entities and 3 June 2026 for smaller entities. Firms need to be able to produce incident response programmes, risk assessments, breach records and vendor oversight documentation when required. Policies scattered across shared drives and supplier records buried in email chains can make it harder to demonstrate compliance.
Managers with commodity interest exposure must also consider requirements administered by the Commodity Futures Trading Commission (CFTC). Firms relying on exemptions under CFTC Rules 4.13 and 4.14 must affirm them annually through the National Futures Association’s Exemptions Filing System. Failure to meet the relevant requirements can result in the loss of an exemption and potentially expose a manager to broader Part 4 obligations.
There has also been some regulatory relief. A CFTC no-action letter issued in December 2025 allows certain SEC-registered private fund managers to avoid registering as commodity pool operators or commodity trading advisers. However, determining whether a manager qualifies requires careful assessment and appropriate supporting documentation.
Across the SEC, Financial Industry Regulatory Authority (FINRA) and CFTC, investment managers face a common challenge: demonstrating that compliance arrangements are effective, consistent and properly documented. Disconnected spreadsheets, manual checklists and reliance on institutional knowledge can make it difficult to maintain oversight, identify emerging risks and respond efficiently to regulatory requests.
Leo RegTech positions its configurable platform as a way for investment managers to bring key compliance activities together in one system. Its capabilities include policy and procedure management, regulatory filing calendars, AI monitoring, training, due diligence workflows, vendor oversight and audit-ready documentation. Centralising these processes can help firms maintain a clearer view of their obligations and the evidence supporting their controls.
As regulatory expectations evolve, investment managers will need to show not only that compliance policies exist, but that they are embedded in day-to-day operations. Leo RegTech’s analysis underscores the importance of integrated systems, reliable records and demonstrable oversight in helping firms manage regulatory complexity and reduce avoidable operational risk.
Read the full Leo RegTech analysis
Copyright © 2026 FinTech Global
