• |

    Feb. 12, 2026

Best Practices for Complying With Regulation S‑P’s New Notification Requirements

The SEC’s May 16, 2024, adoption of enhancements to Regulation S‑P (Reg S‑P) has significantly broadened the obligations of registered entities following the detection of a cyber breach that has, or is reasonably likely to have, compromised sensitive customer data. Larger entities faced a compliance deadline of December 3, 2025, while smaller ones have until June 3, 2026. In addition to the strict requirements that Reg S‑P already imposed with regard to cybersecurity policies and procedures, fund managers must have policies and procedures in place that are reasonably designed to notify customers as soon as practicable, and not more than 30 days, after detection of a breach. As bad actors grow ever more sophisticated and resourceful, the cyber threat facing the private funds sector has never been more acute, as the SEC recognized when the agency devoted a large section of its new 2026 Examination Priorities to Reg S‑P compliance. This article summarizes the amendments to Reg S‑P; sets forth practical steps that fund managers should take upon discovery of a cyber incident; outlines best practices with regard to customer notification, including what to mention and what to exclude; and provides expert legal analysis. See “SEC Staff Discuss Regulation S‑P Amendments and Related Examination Process” (Oct. 23, 2025).

SEC 2026 Exam Priorities: Retail Investor Protection In, Crypto Out

On November 17, 2025, the SEC Division of Examinations released its 2026 examination priorities (Priorities). The new Priorities once again stress examining regulated firms on fiduciary duties, compliance program effectiveness, fees, expenses and conflicts of interest, while omitting cryptocurrency as an area of exam focus. In particular, the regulators are taking investor protection seriously. Although President Donald J. Trump and SEC leaders have publicly supported broadening retail investor access to private funds, the Division stresses that it will scrutinize how investment advisers, fund managers and broker-dealers treat retail customers – particularly those saving for retirement. The Hedge Fund Law Report interviewed several legal experts on the Priorities’ areas of emphasis and notable omissions, with an eye toward helping fund managers prepare themselves for examinations in 2026. This article summarizes the Priorities’ key takeaways that are the most relevant to private fund managers and the experts’ accompanying insights. See “What to Expect on SEC Examinations Under the New Administration” (Jul. 17, 2025).

Marketing Rule Risk Alert Focuses on Testimonials, Endorsements and Third-Party Ratings

In May 2021, the SEC adopted Rule 206(4)‑1 (Marketing Rule or Rule) under the Investment Advisers Act of 1940. Since then, the Division of Examinations (Division) has issued multiple risk alerts on Rule-related examinations and compliance expectations. The SEC has also resolved multiple enforcement proceedings for alleged violations of the Rule and associated compliance failures. The Division’s fourth risk alert (Risk Alert), released on December 16, 2025, is based on the staff’s review of advertisements disseminated to investment advisers’ current or prospective clients, including private fund investors, that included testimonials, endorsements and/or third-party ratings. Just weeks after the Division issued the Risk Alert, the Division of Investment Management issued two new FAQs regarding the Rule. This article discusses the relevant provisions of the Marketing Rule, the deficiencies identified in the Risk Alert and the two new FAQs. See “Nine More Advisers Fined by SEC in Ongoing Marketing Rule Sweep” (Nov. 7, 2024).

Key Takeaways From FINRA’s 2026 Annual Regulatory Oversight Report

FINRA has released its latest annual regulatory oversight report (Report), with insights from its regulatory operations. This year’s Report includes a new section for trends in generative artificial intelligence. It also covers the perennial topic areas of financial crime prevention; firm operations; digital assets; communications and sales; market integrity; and financial management. As in prior reports, each topic area identifies relevant laws and regulations; weaknesses FINRA has observed in members’ compliance programs; findings from FINRA’s examination, enforcement and other regulatory activities; and effective practices FINRA has observed that may help firms enhance their compliance programs. As always, the Report “does not create any new legal or regulatory requirements or new interpretations of existing requirements, or relieve firms of any existing obligations under federal securities laws and regulations.” This article discusses the key takeaways from the Report. See “A Look at FINRA’s 2025 Oversight Report” (Mar. 13, 2025); and coverage of its 2023, 2022 and 2021 reports.

A Baker’s Dozen AI Governance Resolutions for 2026

Many firms spent 2025 scrambling to integrate artificial intelligence (AI) into all aspects of business, just as a second transformative technology, which allows for independent decision-making by an AI agent, was entering early adoption. With pressure building throughout the business environment to incorporate these new technologies, the humans responsible for corporate AI efforts should pause at the start of 2026 to reflect on how risks have evolved and continue to do so. The Hedge Fund Law Report asked a group of experts, including presenters at the AI Summit NYC conference in December 2025, what firms should resolve to do for their AI governance efforts in 2026. They recommended a baker’s dozen practical resolutions for organizations to develop greater trust in their AI use, advance responsible AI development, mitigate the technology’s array of risks and respond in a balanced way to the AI-related pressure building inside and outside organizations. See “Benchmarking AI Uptake by Compliance Functions” (Dec. 4, 2025).

Andrew Cross Joins Morgan Lewis in Pittsburgh

Morgan Lewis strengthened its investment management and digital assets team with the arrival of Andrew P. Cross as counsel. Based in Pittsburgh, Cross brings deep experience in the legal and regulatory aspects of CFTC matters, advising commodity trading firms, family offices, public companies, investment advisers and investment funds on complex derivatives transactions and related trade agreements. For insights from other Morgan Lewis attorneys, see “SEC Regulatory and Examination Priorities in 2025” (Aug. 14, 2025); and “How to Approach Marketing Material Reviews” (Feb. 27, 2025).

Most-Read Articles