The SEC Just Rewrote Its Enforcement Playbook for the First Time Since 2017
On February 24, 2026, the SEC’s Division of Enforcement released the first major update to its Enforcement Manual since 2017. Nearly a decade between revisions. That alone tells you how significant this one is.
The Manual isn’t law. It doesn’t carry binding legal force. But it is the internal operating guide that SEC attorneys use when deciding how to open investigations, when to issue Wells notices, how to handle cooperation credit, and when to refer cases to the DOJ. In practice, it shapes everything about how an enforcement action unfolds including whether a firm gets a fair hearing before charges are filed, or finds out about them after.
For RIAs, the 2026 update changes the calculus on several things that matter: how much time you have to respond to a Wells notice, whether you can negotiate a settlement and a regulatory waiver at the same time, and what it actually means to “cooperate” with the SEC. None of these are abstract. They’re operational decisions your firm may need to make under pressure, and the window to act is usually shorter than it looks.
Here are the four changes that matter most and what each one means for how your firm should be positioned right now.
1. The Wells Process Now Has Structure and a Clock
The Wells process is how the SEC tells a firm or individual that it’s considering bringing charges and gives them a chance to respond before the Commission decides. In theory, it’s a safeguard. In practice, it has historically been inconsistent: timelines varied by office, access to the investigative record was unpredictable, and getting a meeting with senior leadership was difficult enough that practitioners routinely complained about it.
The 2026 Manual tightens all of that.
Recipients of a Wells notice now generally have four weeks to submit a written response. A meeting between the subject’s counsel and SEC staff will follow within four weeks of that submission and a senior Division member at the Associate Director level or above will be present. Under the Biden administration, getting that kind of senior engagement was reportedly uncommon. The updated Manual makes it the default.
There’s also a new transparency requirement that cuts both ways. Staff must now affirmatively inform Wells recipients of salient, probative evidence gathered during the investigation that the staff believes may not be known to the recipient. That’s a meaningful change from prior practice, where disclosure of the investigative record was discretionary.
What this means for your firm: The four-week clock starts running the moment a Wells notice lands. That’s not a lot of time to gather documents, build your response, and coordinate with outside counsel. RIAs that don’t have their documentation; policies, trade records, marketing review logs, compliance attestations; organized and accessible will burn a significant portion of that window just locating what they need. If an exam ever escalates toward enforcement, the firms that have been running continuous compliance will have a real head start.
2. Cooperation Credit Is Now Defined, Not Just Implied
“Cooperating with the SEC” has always been treated as a mitigating factor. The old Manual acknowledged it. What it didn’t do was explain how cooperation gets evaluated or what it actually buys you in a settlement. Firms were expected to cooperate without a clear picture of what that cooperation was worth.
The 2026 Manual changes that, at least on paper.
The revised Manual now incorporates a list of examples of conduct that may constitute “exemplary cooperation,” and a new section on “Other Benefits of Cooperation” expressly highlights settlements with no or reduced monetary penalties as potential benefits of cooperation. The Manual also formally recognizes the Division’s Cooperation Committee for the first time, giving it a defined role in ensuring that cooperation decisions are made consistently across offices.
The caveat worth noting: cooperation remains a flexible tool fully controlled by the Division of Enforcement, not a defined incentive system on which respondents can reliably plan. The framework is clearer. The discretion hasn’t gone away.
What this means for your firm: Self-reporting and early remediation now have a more explicit path to recognition but only if you can show your work. Cooperation credit isn’t given for good intentions; it’s given for documented action. Firms that identify a compliance gap and fix it quietly, without paper trail, won’t be able to point to that remediation later. The ones that log the discovery, the response, and the resolution are in a meaningfully different position if the issue ever resurfaces during an exam.
3. Settlement and Waiver Requests Are Now Handled Together
This one is less visible but has significant practical consequences for firms trying to resolve an enforcement action.
When a firm settles an SEC enforcement action, certain violations automatically trigger collateral consequences like being disqualified from making exempt offerings under Rule 506 of Regulation D. Firms often need to request a waiver of those disqualifications as part of settlement. Under the old process, the settlement and the waiver were handled separately. That created a layered uncertainty: you could agree to settle without knowing whether the waiver would be granted, and if it wasn’t, you had to decide whether to unwind the whole thing.
The revised Manual now formally requires the Division to consider settlement proposals and waiver requests simultaneously, rather than sequentially. If the Commission accepts the settlement but rejects the waiver, the settling party generally has five business days to decide whether to proceed.
The SEC Chairman first announced this policy change in September 2025, reversing the previous policy that treated these as separate questions that could not be conditioned on one another. The 2026 Manual now memorializes it as standard practice.
What this means for your firm: If your firm ever faces settlement negotiations, the combined process gives you cleaner information earlier and a defined window to make a decision if the waiver doesn’t come through. The practical implication right now is that firms should understand which regulatory disqualifications their business model depends on before an enforcement situation arises, not during one.
4. Criminal Referrals Now Follow a Formal Six-Factor Test
Previously, decisions about whether to refer a matter to the DOJ for criminal prosecution were made at the Associate Director level, with limited senior oversight and no standardized criteria. Practices varied significantly across regional offices. The 2026 Manual changes that with a formal framework.
SEC staff must now consider six factors when deciding to make a criminal referral: harm or risk of harm, potential gain to the defendant, specialized knowledge or licensing, knowledge of harm or illegality, recidivism or pattern of misconduct, and whether DOJ involvement provides additional investigative tools or remedies not available to the SEC.
The 2026 Manual also reflects an extended limitations period for certain violations, ten years for scienter-based securities law violations and equitable remedies such as injunctions, bars, suspensions, and cease-and-desist orders. The general period for disgorgement remains five years.
What this means for your firm: The factors that weigh most heavily; prior misconduct, knowledge of harm, specialized licensing are precisely the things that an ongoing compliance program is designed to address. A firm that catches a violation internally, remediates it, and documents the process looks very different against these factors than one where the SEC finds it first. Pattern of misconduct is particularly worth noting: isolated incidents handled properly rarely become patterns. Unaddressed ones often do.
The Through-Line Across All Four Changes
Read together, these updates point in one direction: the SEC is moving toward a more structured, documented, and auditable enforcement process. The Wells clock, the cooperation framework, the referral criteria all of them reward firms that can demonstrate a compliance posture, not just claim one.
That distinction matters. Claiming compliance is easy. Demonstrating it means having timestamped attestations, marketing review logs, vendor oversight records, and incident documentation that holds up when someone outside your firm is looking at it closely.
The firms that will navigate a 2026-era enforcement environment most effectively are the ones that have been running their compliance programs as if documentation is the product not just an administrative byproduct.
How Smartria Helps RIAs Stay Positioned
When the SEC’s enforcement posture shifts, the gap between firms with structured compliance infrastructure and those without it widens fast. Smartria gives RIAs the tools to stay on the right side of that gap not by adding compliance burden, but by making the documentation continuous and automatic.
- Compliance Calendar & Attestation Tracking: Timestamped records of every employee sign-off, policy acknowledgment, and attestation cycle; the kind of documentation that matters in a Wells response
- Marketing Review Workflow: Audit-ready approval trails for every advertisement, testimonial, and social post reviewed under the SEC Marketing Rule
- Vendor Oversight Dashboard: Ongoing monitoring logs and contract management to demonstrate active third-party oversight, not just a one-time review
- Incident Documentation: Structured records of compliance events, including non-notifiable ones with rationale on file
Most smaller RIAs don’t have a dedicated compliance team standing by when an exam escalates. Smartria is built so the documentation is already there when you need it.
Final Word
The 2026 Enforcement Manual isn’t a threat, it’s a signal. The SEC is telling firms exactly how it intends to operate: more structured Wells timelines, clearer cooperation standards, simultaneous settlement consideration, and a formal test for criminal referrals. That level of transparency is genuinely useful, but only if you read it and adjust accordingly.
The firms that treat this as a compliance administration problem will keep doing what they’ve been doing. The firms that treat it as a strategic signal will use it to close gaps before the SEC finds them.
That preparation; documented, continuous, and already in place is what the updated Manual is ultimately designed to reward.
