A new SEC chair rewrites the agenda, not the compliance calendar

The week

Paul Atkins was sworn in as chairman of the Securities and Exchange Commission on April 21, 2025. President Trump had nominated him on January 20, and the Senate confirmed him on April 9. The SEC is the federal agency that writes and enforces the rules for the US securities markets. Those rules cover the brokerage firms that execute trades for customers (broker-dealers) and the firms that manage money and give investment advice for a fee (investment advisers). Its chair sets the agenda: which new rules get written, which get dropped and where enforcement attention goes. In the third week of April 2025, Wall Street mostly wanted to know which rules he would stop enforcing.

Atkins was no stranger to the building. He had served on the SEC staff in the early 1990s, rising to chief of staff, and had been a commissioner from 2002 to 2008. After leaving, he sat on the congressional panel that oversaw the 2008 bank rescue program and founded Patomak Global Partners, a consulting firm that advised financial companies on regulatory risk. He arrived with an agenda widely described as lighter-touch. That meant less policymaking through enforcement, the practice of setting new expectations by bringing cases rather than by writing rules in advance. It meant a more accommodating approach to crypto assets. And it meant a fresh look at the proposals left by his predecessor, Gary Gensler, whose term had produced an unusually long list of draft rules.

Some of the shift had already begun. Gensler left on January 20, 2025, and Mark Uyeda, a sitting commissioner, led the agency as acting chairman for the next three months. On January 21, the SEC launched a crypto task force led by Commissioner Hester Peirce, with a stated aim of building a clear regulatory framework for crypto assets. On February 25, it extended the compliance dates for its Treasury clearing rule by a year, to December 31, 2026 for cash trades and June 30, 2027 for repurchase agreements. That rule concerns how trades in US government bonds are settled through a central clearinghouse.

Other adopted rules were pushed back in the same months. A February notice moved the compliance date for amended Form PF, the confidential report that private fund advisers file, from March 12 to June 12, 2025. A March notice gave fund groups until June 2026 or December 2026, depending on size, to comply with the amended fund names rule. On March 27, the commission voted to stop defending its 2024 climate disclosure rules, which were already stayed and under challenge in the Eighth Circuit. The day after Atkins took office, the Federal Register published a delay of new Form N-PORT reporting requirements for funds to November 2027.

Each of those changes had something in common. It came through a formal, published act: a commission vote, a Federal Register notice, a filing in court. None was a speech or a press interview.

But not everything was moving. Other adopted rules were still on their original schedules, and that is where the practical risk lay for firms tempted to relax. The most significant for registrants was the 2024 amendment to Regulation S-P, the SEC’s long-standing rule on protecting customers’ personal financial information. The commission had adopted the amendments on May 16, 2024, and they were published in the Federal Register on June 3, 2024.

The update applied to broker-dealers, funding portals, investment companies, registered investment advisers and transfer agents. It required each to have an incident response program, meaning written plans for what to do when data is breached. It also required them to notify affected customers when their sensitive information was exposed. The compliance dates were 18 months after publication for larger firms, December 3, 2025, and 24 months for smaller ones, June 3, 2026. As of April 2025, no notice had touched those dates.

The same package had begun life in March 2023 alongside two other cybersecurity proposals. One covered broker-dealers and other market entities. The other expanded Regulation SCI, the SEC’s rule on the technology systems of exchanges and other key market infrastructure. Only the Regulation S-P piece had been adopted. The other two were still proposals when Atkins arrived, as was a separate 2022 proposal on cybersecurity for advisers and funds.

So the headline said “deregulation.” The fine print said: check which rules are actually changing, and which are not.

A change of SEC leadership produces one headline: the pendulum is swinging. For chief compliance officers at broker-dealers and investment advisers, that headline is close to useless. It tells them the mood, not what to do on Monday morning.

What actually determines a chair’s power over a rule is the rule’s legal status. In April 2025 the SEC’s agenda fell into three distinct states. There were proposals not yet adopted. There were adopted rules whose compliance dates still lay ahead. And there were obligations already in force and enforced through examination. Each of the three calls for a different planning response, and every item on a firm’s regulatory inventory falls into exactly one of them.

The sections below take the three states in turn, after a short account of how a rule moves between them. They then apply the method to a single firm, price the cost of getting it wrong, and test it against the strongest objections.

How a federal rule is born, and how it can die

The life cycle of a rule is straightforward. Federal agencies like the SEC cannot simply announce new obligations. Under the Administrative Procedure Act, the law that governs agency rulemaking, they generally must publish a proposed rule, invite public comment, consider what they hear and then vote to adopt a final rule. The final rule usually includes a compliance date, often a year or more away, to give firms time to build systems, change contracts and train staff.

Rulemaking works like building a house. A proposal is an architect’s drawing: it can be redrawn, shelved or torn up with little cost to anyone. An adopted rule is a signed construction contract with a move-in date: changing it is possible, but requires formal paperwork that everyone can see. A rule already in force is the house itself: people live in it, and the building inspector, in this case the SEC’s examiners, keeps visiting.

A new chair’s influence is greatest at the drawing stage and smallest once the house is occupied.

Three dates that are easy to confuse

Much of the confusion in spring 2025 came from treating three different dates as one. The adoption date is when the commission votes. The effective date, usually 60 days after Federal Register publication, is when the rule becomes part of the Code of Federal Regulations. The compliance date is when firms must actually meet it.

For the Regulation S-P amendments, those were May 16, 2024, August 2, 2024, and December 3, 2025 or June 3, 2026. A rule can therefore be “in effect” for well over a year while nobody is yet required to comply. That gap is where a new chair has the most room to act on an adopted rule, and it is also where firms are most tempted to wait.

Why the commission’s structure matters

The SEC is a multi-member commission, not a single-head agency. Rules are adopted, extended and withdrawn by commission vote. A chair controls the agenda and the staff’s priorities, and with a majority behind him can move quickly. But every binding change still requires a recorded vote and a published release.

That gives compliance teams something concrete to watch. The commission posts its open meeting agendas in advance, and its regulatory flexibility agenda, published twice a year as part of the government-wide unified agenda, lists what it expects to propose or finalize. Neither changes anything on its own. Both tell a firm where formal action is likely to come next.

The other two exits: courts and Congress

Two other forces can end a rule. Courts can vacate it, as the Fifth Circuit did with the SEC’s private fund adviser rules in June 2024. Congress can disapprove a recently adopted rule under the Congressional Review Act, which allows a fast-track resolution of disapproval within a limited window after the rule is submitted.

Both are public and both take time. Litigation runs for months, and the outcome is uncertain until the decision is published. Neither is a reason to stop work on a rule before it happens. They are reasons to keep a line in the register that names the pending case or resolution, so the firm knows to check when it resolves.

Proposals: change is fast and cheap

A proposed rule creates no obligation. A new chair can let it sit, narrow it, re-propose it or withdraw it with a single commission vote. In April 2025 this category held several large items from the previous agenda. They included rules on conflicts from predictive data analytics and on cybersecurity risk management for advisers and funds. Others covered cybersecurity for broker-dealers and other market entities, an expanded Regulation SCI, outsourcing by investment advisers, and an expanded safeguarding rule for client assets.

Briefly, the predictive data analytics proposal targeted the algorithms that firms use to nudge customers toward products or actions, such as an app that highlights certain funds. The concern was that the software might favor the firm over the client. The adviser cybersecurity proposal would have required advisers and funds to adopt specific written cyber policies and report incidents to the SEC. The market-entity proposal, often called Rule 10, would have done something similar for broker-dealers, clearing agencies and exchanges. The outsourcing proposal would have required advisers to perform and document due diligence and monitoring of certain service providers. The safeguarding proposal would have expanded rules on how advisers hold and protect client assets.

The planning response is to stop spending on rule-specific build work while keeping the underlying risk managed. That distinction carries real weight. A firm that had begun designing a conflicts-testing process for its recommendation algorithms could pause the documentation the proposal would have required. It should not stop asking whether those algorithms favor the firm. Regulation Best Interest, which requires brokers to put a retail customer’s interest first when recommending investments, the fiduciary duty of advisers and the general anti-fraud provisions all reach conflicted recommendations without any new rule.

The same logic applies to cybersecurity. Withdrawing the adviser cyber proposal removed a specific set of written-policy and reporting requirements. It left in place the safeguards rule in Regulation S-P and the examiners’ long-standing interest in how firms protect client data. It also left Regulation S-ID, which requires identity theft programs that spot the warning signs of fraud in customer accounts. Budget should move away from the proposal’s paperwork, not away from the control environment.

Separating the build from the risk

The hard part is telling those two kinds of spending apart inside a project already under way. A useful test is to ask, for each workstream, whether it would still be needed if the proposal never existed. A policy template that mirrors the proposal’s section headings fails the test. A review of which vendors hold client data passes it, because Regulation S-P already required firms to protect that data.

Applying the test to the 2023 market-entity cyber proposal shows the method. The proposal would have required broker-dealers to file a new form describing significant cyber incidents and to publish a summary of their cyber risks. Building those filings could stop. The incident detection, escalation and recovery work behind them could not, because the amended Regulation S-P required an incident response program from the same firms on a fixed date.

The outsourcing proposal follows the same pattern. Its due diligence and monitoring requirements for advisers’ vendors went away with the proposal. The amended Regulation S-P separately required covered firms to oversee service providers that handle customer information. An adviser that dropped its vendor program along with the outsourcing proposal would have dropped work that an adopted rule still demanded.

Different firms, different exposure

The proposals did not touch every registrant the same way. Rule 10 and the Regulation SCI expansion mattered mostly to broker-dealers, clearing agencies, exchanges and alternative trading systems. The adviser cyber, outsourcing and safeguarding proposals mattered to SEC-registered advisers and funds. A dual registrant, with both a brokerage and an advisory arm, had projects running against both sets.

Smaller advisers registered with a state rather than the SEC were outside most of these proposals entirely. Their cybersecurity and privacy obligations come mainly from state securities regulators and, for customer information, from federal privacy rules administered outside the SEC. A firm that is not sure which regime governs which entity in its group should settle that question with counsel before sorting anything into columns.

Adopted rules: change requires a formal act

An adopted rule with a future compliance date is far harder to move. Changing it takes new rulemaking, a formal extension order, or a court decision. Each of those is public and leaves time to react. The Treasury clearing extension in February 2025 showed the mechanism working: the commission voted, published new dates, and firms re-planned. The 2024 vacatur of the private fund adviser rules was a reminder that courts are a third route. Absent one of those acts, the dates stand.

Regulation S-P was the item most firms needed to watch. It is the rule that says a financial firm must protect what it knows about its customers: account numbers, Social Security numbers, balances and the like. The 2024 amendments added teeth. They required a written incident response program, which is a rehearsed playbook for detecting a breach, containing it and recovering. They also required oversight of service providers, the outside companies that store or process customer data on the firm’s behalf.

Notice to affected individuals had to go out as soon as practicable, and no later than 30 days after the firm became aware of a breach. The trigger was sensitive customer information that was, or was reasonably likely to have been, accessed without authorization. A firm’s procedures had to require its service providers to notify it within 72 hours of becoming aware of a breach.

What the amendments asked for, piece by piece

The rule is easier to plan against when it is broken into its parts. Each part has a different owner and a different lead time.

• Incident response program. Written policies and procedures to detect, respond to and recover from unauthorized access to customer information. The owner is usually the chief information security officer, with compliance reviewing.
• Notification. A process to decide whether notice is required, and to send it within 30 days if so. A firm may skip notice only if a reasonable investigation shows the information has not been, and is not reasonably likely to be, used in a way that causes substantial harm or inconvenience. The firm must keep a record of that investigation and its conclusion.
• Service provider oversight. Due diligence and monitoring of vendors, including the 72-hour notice. A firm may let a vendor send notices on its behalf but stays responsible for them.
• Recordkeeping. Written records showing compliance with the safeguards and disposal rules, kept for the periods the SEC’s books and records rules set for each type of firm.
• Scope. Broader coverage of “customer information,” including information about customers of other financial institutions that the firm receives, and the extension of the safeguards rule to transfer agents.

There was also a narrow exception for law enforcement. A firm could delay notice if the Attorney General asked the SEC in writing, on the ground that notice would pose a substantial risk to national security or public safety. Few firms would ever use it, but the procedure should say who would receive such a request and how the clock would be handled.

Why the vendor clause set the timeline

The service provider requirement is why waiting was expensive. It cannot be met by the firm alone. Every relevant vendor contract has to carry the clause, and vendors negotiate on their own timelines. A mid-sized adviser might rely on a portfolio accounting system, a customer relationship management platform, a document storage service, a payroll provider and an email archive. Each is a separate contract, a separate legal team and a separate negotiation. Some vendors will sign a standard addendum in a week. Others will take months, or push back on the 72-hour window. That work cannot be compressed into the final quarter before a compliance date.

A good addendum covers more than the clock. It defines what counts as an incident and says what information the vendor must provide so the firm can decide whether notice is required. It commits the vendor to cooperate with the investigation and flows the obligation down to the vendor’s own subcontractors. Large vendors serving thousands of registrants tend to publish one standard addendum and resist edits. Smaller vendors may never have seen the request before. Both cases take time.

Where a vendor will not sign, the firm needs a fallback: a documented risk acceptance, compensating monitoring, or a plan to move the service. Each of those decisions needs a named approver and a date. An examiner reviewing the program will look for exactly that evidence.

Which firms counted as larger

The two compliance dates turned on size, and the size tests differed by type of firm. Broker-dealers and transfer agents counted as larger unless they met the SEC’s small-entity definitions. Registered investment advisers counted as larger at $1.5 billion or more in assets under management. Investment companies counted as larger when they were part of a fund group with net assets of $1 billion or more.

That produced some uneven calendars. A dual registrant whose broker-dealer was a larger entity but whose advisory arm fell under the threshold faced two dates for one program. Most such firms built to the earlier date for the whole group, because running two versions of the same incident response process invites confusion during a real breach.

A register that tracks legal status

A practical approach is a register entry for each adopted rule with four fields: compliance date, external dependencies, owner, and the formal action that would change the date. The owner checks the register when the commission meets. Until a formal act appears, the project runs on the published schedule. Counsel should confirm status at each milestone, because extensions sometimes arrive late and apply to only part of a rule.

There is a trade-off here. Running a project to a date that may later move can waste effort. In practice the waste is small. Incident response programs, vendor notice clauses and customer notification templates are useful under any rule set, and all 50 states have their own breach notification laws that already require much of the same work. The costlier error is the opposite one: a paused project restarting six months before a date that never moved.

Obligations in force: change comes through emphasis

Most of what registrants experience as SEC oversight comes from the Division of Examinations, applying rules that have been on the books for years. Examiners visit firms, request documents, interview staff and test whether the firm does what its policies say. The rules they apply include books and records requirements and Regulation S-ID. They also include the market access rule (which governs controls on firms that give customers access to trading venues), the marketing rule (which governs how advisers advertise performance and testimonials) and custody.

A new chair can redirect enforcement priorities and soften the tone of exam letters. He cannot suspend the rules themselves without rulemaking.

How an examination actually runs

An SEC examination usually begins with a document request letter. It asks for policies, logs, testing results, committee minutes, vendor lists and samples of communications, often covering a period of a year or more before the request. Staff then interview the people named in the policies and test whether what happened matches what was written.

At the end, the firm may receive a deficiency letter. The firm responds in writing, describing what it has fixed. Serious matters can be referred to the Division of Enforcement. Each step produces a record that the next exam team will read.

That look-back period matters for planning. Evidence has to exist at the time the control runs. A firm cannot reconstruct a year of surveillance reviews the week before examiners arrive, and examiners are practiced at spotting documents created after the fact.

Reading the priorities letter

The division’s annual examination priorities are the best signal of where attention will fall. They are worth reading closely each year for what is added and what is dropped. A shift in emphasis is real, but it changes the probability of scrutiny, not the standard. Deficiency letters, the written findings examiners send when they find problems, still arrive. They remain on the firm’s record and still surface in later exams, in client due diligence and in acquirers’ reviews. A pension fund choosing a manager, or a buyer pricing an acquisition, will ask to see them.

Broker-dealers have a second examiner

Broker-dealers also answer to FINRA, the self-regulatory organization that examines member firms and writes its own rules on supervision, communications and business continuity. FINRA’s leadership does not change when the SEC chair does. Its annual regulatory oversight report sets out its own areas of focus, and its examiners apply its rules on their own cycle.

For a broker-dealer, a lighter-touch SEC therefore changes less than the headlines suggest. Much of the day-to-day supervisory testing that FINRA examines, such as review of customer communications and branch inspections, is unaffected by any change in the commission’s agenda.

The second-order cost of easing off

The temptation in a lighter-touch period is to trim compliance staff or defer testing. The second-order cost shows up later. Exam cycles are long, and a deficiency found in 2027 may concern conduct from 2025. Policies that were written but not followed are the most common finding, and they are cheap to avoid. Firms should keep evidence of testing, surveillance reviews and annual compliance program reviews on the same cadence regardless of who chairs the commission.

Advisers have a specific obligation here. The compliance rule under the Investment Advisers Act requires an SEC-registered adviser to review its policies and procedures at least annually for adequacy and effectiveness. Funds have a parallel requirement. Skipping or thinning that review is itself a deficiency, separate from any problem it would have found.

One firm, three columns

Take a hypothetical wealth management firm with a broker-dealer arm and an advisory arm, a few hundred employees and a modest compliance team. In spring 2025, the chief compliance officer lays the firm’s regulatory projects out on a single page with three columns.

Column one, proposals. The team had started drafting documentation for the predictive analytics proposal and scoping the adviser cyber proposal. The officer pauses both build efforts and redeploys two analysts. But she keeps a quarterly review of the firm’s fund-recommendation tool, asking whether it steers clients toward higher-fee products, because Regulation Best Interest and fiduciary duty already cover that question. She also keeps the incident-detection work that had been started for the cyber proposal, because it feeds directly into the Regulation S-P program.

Column two, adopted rules. Regulation S-P belongs here. The firm counts as a larger entity, so the officer works back from a December 2025 date. She lists every vendor that touches customer data, ranks them by sensitivity, and sends the 72-hour notification addendum to the top tier in May. She updates the incident response plan, writes customer notice templates and schedules a tabletop exercise, a rehearsal in which staff walk through a simulated breach. A note on the register says the date can move only by a commission vote, an extension order or a court ruling.

Column three, rules in force. Nothing changes in the testing calendar. The firm still reviews marketing materials before they go out, still tests its identity theft red flags program and still completes its annual compliance review on schedule.

The board receives the same one-page view each quarter. When the commission acts, items move between columns. When it does not, the plan holds. The officer has not had to guess what the new chair will do, only to read what he has formally done.

The work plan behind column two

Working back from December 3, 2025 gives roughly seven months. A realistic sequence runs in four phases, each with its own evidence.

1. May and June: inventory and gap analysis. Map where sensitive customer information lives, which systems and vendors touch it, and which parts of the existing incident plan already meet the amended rule. Evidence: the data map and a written gap list.
2. June to September: vendor contracts. Send addenda to the highest-risk vendors first, track responses weekly and escalate holdouts. Evidence: a tracker showing each vendor’s status and any risk acceptances.
3. August to October: procedures and templates. Rewrite the incident response procedures, define who decides whether notice is required, draft notice letters and set up the records of each determination. Evidence: approved procedures and templates.
4. October and November: rehearsal and sign-off. Run a tabletop that includes a vendor breach and a decision about whether to notify, fix what it exposes, and report readiness to the board. Evidence: the exercise report and the board minute.

The sequence puts vendor work early for a reason. It is the only phase whose duration the firm does not control.

Roles and the cost of coordination

The project crosses at least four functions. Compliance owns the interpretation and the register. Information security owns detection and response. Legal or procurement owns the vendor contracts. Client service owns the mechanics of sending notices and answering the calls that follow. A firm of a few hundred people may have one or two people in each of those roles.

The most common friction point is the notice decision. Someone has to be named to decide, within days, whether an incident meets the threshold, and someone else has to be able to challenge that decision. Writing that down before a breach is far cheaper than arguing about it during one.

The bill for guessing wrong

Regulatory planning can sound like a back-office exercise. It touches the things boards care about most.

Cost. Building to a proposal that is later withdrawn wastes money. Pausing an adopted rule that never moves creates a far larger bill: rushed vendor negotiations, overtime, outside counsel and consultants at peak rates.

Customers. Breach notification exists because people whose data is stolen need to act quickly, by freezing credit or watching accounts. A firm that cannot tell clients promptly will hear about it from them, loudly.

Reputation and deal value. Exam findings follow a firm. They appear in requests for proposals, institutional due diligence and acquisition reviews, often years after the fact.

Staff. Cutting compliance teams in a lull and rehiring when the pendulum swings back is expensive and erodes the institutional knowledge that makes a program work.

Why the two errors are not symmetrical

The two ways of guessing wrong have very different shapes. Overbuilding for a proposal that dies wastes the hours already spent, and the loss stops there. Underbuilding for an adopted rule that holds creates a deadline problem, a vendor problem and an exam problem at once.

The second error is also correlated across the industry. If many firms bet on the same reprieve and lose, they all return to the same vendors, consultants and law firms in the same quarter. Prices rise and response times stretch for everyone. A firm that moved early avoids that queue entirely.

Who bears the cost

The burden falls unevenly. Large broker-dealers and asset managers have in-house privacy counsel, vendor management teams and security operations centers. For them, the amended rule was mostly a matter of mapping existing processes to new wording.

Smaller advisers and introducing brokers often rely on a handful of outsourced providers for almost everything. For them, the vendor addendum work was the bulk of the project, and they had little negotiating weight with large technology providers. They also got six more months, which helped, but only if they used the time.

Habits that separate the stronger firms

Strong firms tend to share a few habits. They keep one regulatory register, sorted by legal status rather than by topic or by rumor. They separate the cost of documentation for a specific rule from the cost of managing the underlying risk, and protect the second. They start vendor work early because it depends on other people’s calendars. And they treat examination readiness as a constant, not a function of who holds the chairman’s office.

Weaker firms tend to make the opposite errors:

• Reading political signals as legal changes, and pausing projects on adopted rules because a new chair “probably” will not enforce them.
• Abandoning the risk along with the proposal, for example dropping algorithm conflict reviews entirely once the analytics proposal is shelved.
• Leaving vendor contracts to the last quarter, when every firm in the industry is asking the same vendors for the same clause.
• Letting testing lapse, forgetting that an exam in two years will look back at what happened this year.

The strongest objections

The method has critics, and their best arguments deserve an answer.

The first objection is that adopted rules did move in 2025, often. Treasury clearing, Form PF, fund names and Form N-PORT all received extensions in the first months of the year. A firm that bet on a delay was not being irrational. The answer is that each extension arrived as a published act, and several arrived late. A firm cannot plan vendor negotiations around an extension it has not yet seen, and the cost of being wrong in the other direction is much higher.

The second objection is that compliance budgets are finite, and money spent early on a rule that might change is money not spent on something else. That is a fair point for rule-specific paperwork. It is a weak one for incident response and vendor oversight, which reduce real losses whether or not any rule requires them. A firm that is breached through a vendor will pay for the investigation either way.

The third objection is that a softer exam tone lowers the price of a deficiency. Perhaps, for a time. But deficiency letters are permanent, exam programs outlast chairs, and institutional clients read findings without regard to who was chair when they were written.

Taken together, the three categories give compliance leaders a planning method that does not require predicting politics. Sort the inventory by legal status. Cut build spending on proposals, hold adopted dates until a formal change is published, and keep exam readiness steady. Then revisit the sort whenever the commission votes.

Reading the signals without guessing

A new chair’s words still deserve attention. Speeches, interviews and statements are useful early warnings of where the agenda is heading. The discipline is to treat them as forecasts rather than as changes to the law: a reason to check plans, not to cancel work.

In practice, that means separating two kinds of information. The first kind is signal: a speech criticizing a proposal, a news report that a rule is under review, an industry group’s confident prediction. Signal is worth logging, and it may justify slowing discretionary spending on a proposal. The second kind is formal action: a commission vote, a published withdrawal, an extension order or a court judgment. Only formal action changes a date or removes an obligation.

A firm’s register can carry both. Next to each item, a short note records the latest signal, while the status column changes only when formal action appears. That habit protects against two opposite errors. One is over-reacting to every rumor and stopping useful work. The other is under-reacting to genuine change and continuing to spend on a rule that has already gone.

Staff statements and FAQs

Between signal and formal action lies a third category: staff statements, frequently asked questions and no-action letters. These do not change the rule, and the commission itself is not bound by them. They can still change how examiners read it, for example by clarifying what counts as “sensitive customer information” or how a firm may document a decision not to notify.

The register should record them against the rule they interpret and flag them for counsel. A firm that relies on staff guidance should keep a copy of the version it relied on, with the date, because such guidance can be withdrawn or revised.

Talking to the business

The register also helps with internal communication. Business leaders hear the same headlines as compliance does, and they will reasonably ask whether a project can be cut. A compliance officer can point to the register and say “that one is still an adopted rule with a fixed date, and here is the only thing that would change it.” That is a far easier conversation than offering an opinion about the political mood.

The same view works for the board. Directors do not need the detail of each rule. They need to see which obligations are fixed, which are uncertain and what the firm is spending on each, so they can judge whether management is reacting to law or to news.

Finally, signals cut both ways. A lighter-touch chair today may be followed by a stricter one later, and rules withdrawn now can return as new proposals. Keeping the underlying controls healthy means the firm is ready either way.

What the register should be able to answer

1. Do we have a single list of every SEC rule that affects us, sorted into proposals, adopted rules with future dates, and rules already in force?
2. For each adopted rule, what is the compliance date, who owns it and what formal act would change that date?
3. Which of our vendors handle customer data, and how many have signed a clause to tell us about a breach within 72 hours?
4. When we paused work on a withdrawn proposal, how do we know we kept managing the underlying risk?
5. Has any testing or surveillance review slipped in the last year, and could we show an examiner the evidence today?

A register that answers those five questions also answers the board’s usual one, which is whether the firm is spending in the right places. It shows the hours moved off withdrawn proposals, the hours put into fixed dates, and the testing that continued regardless.

A new chair does rewrite the agenda. He does not rewrite the compliance calendar on his own. The firms that keep those two ideas apart spend less and face fewer surprises when the examiners arrive.

With hindsight

The sorting held up. On June 12, 2025, the SEC withdrew 14 pending proposals from the previous agenda, and the notice appeared in the Federal Register on June 17. The list included the predictive data analytics, adviser cybersecurity, market-entity cybersecurity, Regulation SCI, outsourcing and safeguarding proposals, along with Regulation Best Execution and several market-structure items. The commission said it did not intend to finalize any of them, and that any future action in those areas would need a new proposal, which means starting the whole public process from scratch. Attention shifted to crypto market structure and to easing disclosure burdens.

For firms that had already paused build work on those proposals while keeping the underlying risks under review, the withdrawal was a non-event. Their budgets had moved months earlier, and their algorithm and data-protection controls were still running under rules already in force.

Adopted rules, by contrast, moved only through formal acts, and many did move. The Form PF compliance date was pushed again, from June 12 to October 1, 2025, then to October 1, 2026, and then to July 1, 2027. The Federal Register notice of the June 2025 extension appeared on June 16, four days after the date it replaced. The daily reserve computation requirement for broker-dealers moved to June 30, 2026, and the amended order execution disclosure rule, Rule 605, moved to August 1, 2026.

That record cuts both ways. It confirms that betting on an extension was not foolish in 2025. It also shows how late some reprieves came, and that each one applied to a specific rule. A firm could not have planned its vendor negotiations around them.

The Regulation S-P amendments were not extended. Larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. There was no last-minute reprieve for those who had bet on one.

The two-date structure meant that by mid-2026 every covered institution, from the largest broker-dealer to a small adviser, was operating under the amended rule. From then on, any incident touching sensitive customer information carried a 30-day notice clock and a written record of the decision, whatever the political mood in Washington.

The examiners followed through as well. The Division of Examinations’ fiscal 2026 priorities, published on November 17, 2025, named compliance with the 2024 amendments to Regulation S-P as a focus, alongside Regulation S-ID and cybersecurity. The rule that some had hoped would be shelved became a named item on the inspection checklist.

Firms that kept their vendor notification clauses and incident response programs moving through 2025 met those dates without strain. Those that read the new chair as a general reprieve found that the exam program had not read it that way. They faced the expensive version of the project: compressed vendor negotiations and hurried rehearsals in the final months.

The climate disclosure rules showed how slow removal can be, even for an adopted rule the commission no longer supported. The SEC stopped defending them in March 2025, but it did not propose to rescind them until a notice published in June 2026, more than a year later. For all that time the rules stayed on the books, paused but not removed.

The withdrawn topics did not stay withdrawn forever either. In early October 2026 the commission published a new proposal on adviser and fund custody, including rules for holding crypto assets. Safeguarding of client assets was back on the agenda, through exactly the fresh proposal the June 2025 notice had said would be needed.

The method outlasts this particular chair. Political direction shapes what agencies propose and where they look. It changes binding obligations only through visible, formal steps. A planning method built on legal status rather than headlines works under any administration, and it turns a change of leadership from a source of anxiety into a routine update to a spreadsheet.