SEC Enforcement AI

State of play.

• SEC enforcement has structurally reset under Chairman Atkins. FY2025 brought 456 actions—down 22% year-over-year—with crypto enforcement collapsing 60% and public company actions dropping 30%; the agency has explicitly reoriented toward direct investor harm, fraud, and individual accountability .
• Super Micro is the new multi-front enforcement template for AI hardware companies. A DOJ indictment alleging $2.5 billion in diverted Nvidia-chip servers to China—layered on top of a prior SEC accounting fraud charge, BDO adverse internal-control opinion, and active investor class action—illustrates the compounding exposure when export-control violations intersect with financial reporting failures at an AI infrastructure company (→ DOJ export indictment triggers new probe of Super Micro’s controls).
• The crypto regulatory architecture is now staff-guidance-dependent. The April 20 Howey classification framework, the DeFi broker-dealer safe harbor, and the SEC-CFTC coordination MOU are all interpretive or interim—reversible without notice-and-comment and subject to a five-year sunset on the broker-dealer exemption (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• Cybersecurity enforcement against RIAs is entering its examination phase. The June 3, 2026 Regulation S-P deadline for smaller entities is days away; the Division of Examinations has stated it will begin reviewing compliance immediately after the deadline, compressing remediation time to near zero .
• For counsel advising AI hardware, semiconductor, or technology companies with China-facing supply chains, the practical baseline is that export-control violations now carry a direct SEC financial-reporting dimension—DOJ indictments of employees trigger independent investigations, auditor adverse opinions, and investor class actions that compound the primary enforcement exposure.

Where things stand.

• Enforcement posture: fewer actions, individual focus, fraud-first. The Division of Enforcement has updated its manual to emphasize procedural fairness, remediation credit, and targeted pursuit of non-fraud violations only where warranted; two-thirds of standalone actions now target individuals rather than entities .
• Crypto classification framework is now in place. The SEC-CFTC joint interpretive release and the April 20 Howey guidance establish a five-category taxonomy—digital commodities, collectibles, tools, stablecoins, digital securities—with named assets (Bitcoin, Ether, Solana, XRP, and others) explicitly designated as commodities; the SEC-CFTC MOU establishes coordinated oversight .
• DeFi broker-dealer safe harbor is time-limited and staff-only. The April 13, 2026 staff statement exempts neutral Covered User Interface providers—DeFi front-ends, wallet apps, browser extensions—from Section 15(a) registration for five years, expiring April 13, 2031; custody, order routing, transaction negotiation, and investment advice remain prohibited activities that forfeit the exemption; the statement carries no formal rulemaking weight (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• Disgorgement scope is before the Supreme Court. Sripetch v. SEC (No. 25-466) tests whether the SEC must prove investor pecuniary harm before ordering disgorgement; a First/Ninth Circuit split favoring the SEC conflicts with the Second Circuit's harm requirement; Justice Gorsuch raised Seventh Amendment concerns at oral argument .
• Cybersecurity enforcement against RIAs is active and the compliance window is closing. Amended Regulation S-P requirements—mandatory incident response protocols, 30-day breach notification, and service-provider oversight—take effect for smaller entities on June 3, 2026; the SEC's Division of Examinations has flagged Reg S-P as a 2026 examination priority and will begin examining smaller entities shortly after the deadline .
• Capital formation agenda is advancing on multiple tracks. Atkins' "Make IPOs Great Again" initiative targets disclosure modernization, state governance deference, and litigation reform; the SEC has proposed optional semiannual reporting in place of quarterly filings; equity tender offer minimums have been cut from 20 to 10 business days; open-end funds now have co-investment relief alongside BDCs and closed-end funds .
• Whistleblower program is under pressure from two directions. The SEC OIG launched an internal Cash Awards Program for employee tips; simultaneously, the SEC denied Desiree Fixler's award for the DWS ESG investigation on the ground that pre-complaint media publication rendered her disclosure "involuntary" despite the $19 million fine her tip generated .
• Prediction markets and insider trading are an active CFTC enforcement frontier. CFTC Chairman Selig has announced a "zero tolerance" policy for manipulation and insider trading in prediction markets, hired a former CIA officer as Enforcement Director, and is deploying AI surveillance capabilities; the CLARITY Act remains the legislative linchpin for crypto jurisdiction .
• Form PF rollback is proposed. The SEC and CFTC jointly propose raising the general filing threshold from $150 million to $1 billion AUM—exempting roughly half of current filers—and the large hedge fund adviser threshold from $1.5 billion to $10 billion .

Latest developments.

• SEC Division of Trading and Markets clarifies that "Covered User Interface" providers—DeFi front-ends, wallet apps, browser extensions facilitating self-directed crypto transactions—do not need to register as broker-dealers under Section 15(a), subject to strict neutrality conditions prohibiting custody, order routing, and investment advice; the safe harbor expires in five years and carries no formal rulemaking weight, with public comment currently open (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).

Active questions and open splits.

• Disgorgement without investor harm: will Sripetch hold? Oral argument signals the Court may preserve the SEC's broad disgorgement authority, but Justice Gorsuch's Seventh Amendment framing introduces a constitutional dimension that could constrain the remedy even if the harm-proof requirement is rejected; the outcome directly affects settlement leverage in every SEC enforcement matter .
• Export-control violations as a securities disclosure trigger. The Super Micro indictment raises the question of when a company's knowledge of employee export-control conduct becomes a material disclosure obligation—and whether the SEC will treat the adequacy of trade-compliance programs as a financial reporting matter going forward; no settled standard exists (→ DOJ export indictment triggers new probe of Super Micro’s controls).
• Whistleblower "voluntary" disclosure: media-first vs. regulator-first. The Fixler/DWS denial creates a direct tension between the SEC's narrow "voluntary" reading and the practical reality that journalism often precedes regulatory filings; whether courts or Congress will correct the standard is unresolved, and the rule currently penalizes the most historically effective disclosure channel .
• Crypto safe harbors: staff guidance vs. durable rules. The DeFi broker-dealer exemption expires in 2031 and carries no formal rulemaking weight; the Howey classification framework is interpretive, not regulatory; until Congress passes the CLARITY Act or the SEC promulgates final rules, the entire crypto compliance architecture rests on reversible staff positions (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• DeFi safe harbor boundary conditions. The Covered User Interface exemption's prohibition on custody, order routing, and investment advice is clear in the abstract but untested against real-world hybrid platforms; firms operating near those boundaries—particularly those with any fee-sharing, routing optimization, or advisory-adjacent features—face unresolved classification risk (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• Reg S-P smaller-entity compliance: examination readiness. The June 3, 2026 deadline is days away for entities that may not have completed incident response plan updates, vendor contract revisions, or breach notification procedures; the SEC's stated intent to begin examinations immediately after the deadline compresses the remediation window to near zero .
• Semiannual reporting: market perception vs. compliance relief. The optional 10-S framework eliminates three quarterly filings but creates a six-month information gap that institutional investors and analysts may price into valuations; whether the market perception cost outweighs the compliance benefit is a client-specific judgment with no established answer pending the comment period closing July 6, 2026 .

What to watch.

• Sripetch v. SEC decision—expected by end of the Supreme Court's current term—will either preserve or materially constrain the SEC's disgorgement remedy across all enforcement contexts .
• Reg S-P June 3, 2026 deadline for smaller entities—enforcement referrals from the Division of Examinations will be the first concrete test of how aggressively the new enforcement leadership pursues cybersecurity compliance failures .
• SEC public comment period on the Covered User Interface broker-dealer safe harbor—industry submissions will reveal where the boundary conditions are contested and may prompt staff clarification before the five-year clock runs (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• Super Micro independent investigation findings—scope of management knowledge, adequacy of trade-compliance program, and whether the SEC review produces a formal enforcement action or restatement demand (→ DOJ export indictment triggers new probe of Super Micro’s controls).
• Qualified client threshold effective date of June 29, 2026—advisers that have not updated subscription documents and investor agreements face immediate exposure to rescission claims and enforcement action .
• CLARITY Act and GENIUS Act legislative progress—passage or failure will determine whether the current staff-guidance crypto framework becomes durable or collapses on a future administration change .