The SEC's New BCP Expectations: What Every RIA Must Know in 2026

Picture a hypothetical, but increasingly common, scenario: an SEC examiner reviews a mid-sized RIA's business continuity plan and finds that it hasn't been updated in years — a finding that's becoming one of the more frequent threads in BCP-related examination feedback.

It's the kind of problem a firm's principal might think was solved when they paid a consultant to produce a thorough, well-organized Business Continuity and Succession Plan — one that was, by any reasonable measure, completely irrelevant to how the firm actually operates years later.

Staff change. Key vendor relationships change. Firms move to new custodians. Advisors retire. A BCP that doesn't reflect any of that — that names former staff in its emergency contact tree, or references a phone system the firm decommissioned years ago — is exactly the kind of gap an examiner is trained to spot.

This scenario — increasingly common, according to FINRA and SEC examination staff — reflects a fundamental misunderstanding of what regulators now expect from a business continuity plan. The era of the static BCP document is over. What examiners want in 2026 is something altogether different: a living, tested, demonstrably current plan that reflects the firm as it actually exists today.

What Changed — and When

The SEC's examination focus on business continuity planning has been sharpening for years, but 2024 and 2025 marked a meaningful acceleration. Two developments drove this shift.

The SEC's Division of Examinations has named operational resilience among its published examination priorities in recent years, signaling that business continuity planning is an area examiners are specifically trained to probe rather than treat as a checkbox item.

Compliance professionals who work closely with examination staff have also pointed to a pattern: operational failures at smaller advisory firms — from cybersecurity incidents to the sudden incapacitation of a sole practitioner — tend to draw renewed regulatory attention to whether a firm's continuity plan was current and tested at the time.

The regulatory expectation has evolved from "do you have a BCP?" to a much more demanding set of questions: Does your plan reflect your current operations? Have you tested it? Do your employees know it exists and know their roles within it? Can you demonstrate continuity of client service in multiple disruption scenarios?

The Rule Framework: What Reg BI and Rule 17a-4 Actually Require

A common misconception among RIA principals is that business continuity planning requirements are vague or discretionary. They are not. The regulatory framework is specific, and examiners are trained to test against it precisely.

Rule 206(4)-7: The Compliance Program Rule

The Investment Advisers Act Rule 206(4)-7 requires registered investment advisers to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act. The SEC has consistently interpreted this to include business continuity planning — not as an optional component, but as a required element of a reasonably designed compliance program.

Importantly, "reasonably designed" has evolved. What was reasonable in 2018 is not necessarily reasonable in 2026. Examiners now benchmark BCP quality against what technology and planning tools make achievable, and the bar has risen considerably.

Regulation Best Interest (Reg BI)

For dually-registered firms and those with broker-dealer affiliates, Reg BI's care obligation has direct BCP implications. Firms must be able to demonstrate that their continuity planning protects the best interests of their clients — not just the operational continuity of the firm. This means client notification protocols, asset transfer procedures, and service continuity arrangements are all in scope for examination.

State Regulatory Overlay

RIAs registered at the state level (generally those with AUM below $110 million) face the additional complexity of state-specific requirements. A number of states impose their own BCP-related obligations on state-registered investment advisers, and some go beyond the federal baseline in their specificity.

Important: If your firm is state-registered and your BCP was built to federal standards only, you may be out of compliance with state requirements regardless of your federal standing. Consult your compliance counsel about state-specific obligations.

The Eight Things Examiners Are Actually Testing

Drawing on publicly available examination guidance and commonly reported deficiency patterns, the following eight elements represent areas compliance professionals frequently flag as current points of BCP examination scrutiny.

1. Currency and Accuracy of Contact Information

This is the most common deficiency finding, and the most embarrassing: emergency contact trees, key personnel lists, and vendor contact information that is months or years out of date. Examiners will call the numbers listed in your BCP. If they don't reach the right people, that is a finding.

2. Named Succession of Client-Facing Responsibilities

Your BCP must identify, by name, who assumes responsibility for client relationships and portfolio management in the event of the incapacitation or departure of key personnel. "Another qualified advisor" is not sufficient. Examiners want specific names, specific responsibilities, and evidence that those individuals have been informed of and have agreed to their contingency roles.

3. Technology Continuity and Cybersecurity Integration

With the SEC's cybersecurity disclosure rules now in effect, there is increasing examiner interest in how BCPs address technology-specific disruption scenarios. Can you demonstrate access to client data if your primary CRM is unavailable? Do you have offline backup procedures? Is your BCP integrated with — or at minimum informed by — your cybersecurity incident response plan?

4. Evidence of Annual Review

Rule 206(4)-7 requires annual review of compliance policies and procedures. Examiners will ask for documentation that your BCP was reviewed in the past 12 months, by whom, and what changes resulted. A BCP with a "last reviewed" date older than 14 months will almost certainly generate a comment.

5. Client Notification Procedures

In a material disruption, how will you notify clients? Within what timeframe? Through what channels? BCPs that address firm continuity but say nothing about client communication are incomplete by current standards. Examiners want to see specific notification timelines, communication templates, and identification of who is responsible for execution.

6. Vendor and Custodian Continuity

Your business continuity depends in part on the continuity of your key vendors — especially your custodian. Your BCP should address what happens if your primary custodian experiences an extended outage. Do you have secondary custody arrangements? Do you have offline records sufficient to reconstruct client positions?

7. Testing and Tabletop Exercises

This is the emerging frontier of examiner scrutiny. Increasingly, examiners are not just asking whether you have a plan — they're asking whether you've tested it. Documentation of at least one annual tabletop exercise, with participants, scenario, and outcomes documented, is rapidly becoming a best-practice expectation.

8. Board or Principal Review and Approval

For multi-principal firms, examiners expect evidence that the BCP has been reviewed and approved at the principal or board level, not simply delegated to a compliance officer. This doesn't require a formal board resolution, but documentation of principal-level review is expected.

RIA BCP Self-Assessment Checklist

• Contact information reviewed and verified within the last 90 days
• Named successors for all client-facing roles identified and confirmed
• Technology disruption scenarios addressed (including cybersecurity)
• Annual review documented with date, reviewer, and change log
• Client notification procedures with timelines and templates
• Custodian and key vendor contingency procedures documented
• At least one tabletop exercise conducted and documented in the past 12 months
• Principal or board-level review documented
• State-specific requirements reviewed (if state-registered)
• BCP integrated with or cross-referenced to cybersecurity incident response plan

Building a Living Plan: The Operational Framework

Understanding what examiners want is the first step. Building a system that delivers it — reliably, repeatedly, without consuming your compliance budget — is the harder challenge.

The firms that consistently pass BCP examination scrutiny share a common characteristic: they have converted their BCP from a document into a process. The plan is not a PDF stored on a shared drive; it is a system with owners, triggers, and maintenance routines built into the firm's operating calendar.

A living BCP framework has four operational components:

Trigger-based updates — rather than relying solely on annual review, living plans are updated when triggering events occur: staff changes, vendor changes, technology migrations, regulatory updates, or changes in the firm's services or client base. Each trigger type should have a defined owner and a defined response procedure.

Distributed ownership — each section of the BCP should have a named owner responsible for its accuracy. The compliance officer doesn't need to personally verify that the IT vendor contact is current; that responsibility belongs to whoever manages the IT vendor relationship.

Documented testing — at minimum, an annual tabletop exercise with documentation. Leading-edge firms conduct scenario-specific exercises (e.g., "the principal is incapacitated during a market crisis" or "our CRM is unavailable for 72 hours") with specific participants and structured after-action reviews.

Technology-enabled maintenance — firms that have moved away from static document management tools toward purpose-built continuity planning platforms report a noticeably lower maintenance burden and greater confidence heading into an examination. AI-enabled platforms like Plan & Recover can help automate trigger detection, flag outdated information, and draft updated plan sections — reducing the manual effort compliance teams spend keeping a BCP current.

The Cost of Getting It Wrong

The regulatory consequences of BCP deficiencies range from examination comments (which require written response and documented remediation) to formal findings, to — in cases involving client harm — enforcement action. But the regulatory cost is only part of the picture.

The more immediate cost of an inadequate BCP is operational: when a disruption actually occurs, firms without tested, current plans spend the first hours and days of a crisis figuring out what to do. That lost time has real consequences for clients — and for the firm's relationships with them.

Consider the relative arithmetic: a short, well-run tabletop exercise costs a firm little more than an hour or two of a handful of people's time. Responding to a deficiency letter — including compliance counsel time, documentation, and remediation — costs considerably more. An actual operational crisis without a functional recovery plan can cost more still, in client attrition, staff overtime, and regulatory scrutiny.

Six Action Steps for 2026

If this article has identified gaps in your current BCP posture, here are the six highest-priority actions to take before your next examination cycle.

1. Audit your current plan's currency. Pull your existing BCP and systematically verify every contact, every named individual, and every technology reference. Document what you find and what you change.

2. Identify your trigger inventory. Make a list of every change that should prompt a BCP update: staff changes, vendor changes, technology migrations, regulatory updates, changes in services. Assign an owner to each trigger category.

3. Schedule your tabletop exercise. Put it on the calendar now. Choose a scenario that reflects a realistic threat to your specific firm — not a generic template. Invite your principal(s), compliance officer, and at least one operations person.

4. Review your client notification procedures. For each major disruption scenario, answer: How will we tell clients? Within what timeframe? Who sends the communication? Do you have pre-drafted templates? Update your BCP with specific answers.

5. Assess your technology continuity posture. Work with your IT vendor or internal technology lead to document your data backup procedures, recovery time objectives, and offline access capabilities. Add this documentation to your BCP.

6. Consider purpose-built continuity planning technology. If your BCP is currently a Word document or PDF, evaluate whether a platform designed specifically for living BCP maintenance might reduce your compliance burden and improve your examination readiness. The ROI calculation is usually straightforward.