A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. For broker-dealers and advisers, what mattered was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and examinations kept running.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
Paul Atkins was sworn in as chairman of the Securities and Exchange Commission on April 21, 2025, after the Senate confirmed him earlier that month. A former SEC commissioner, he arrived with an agenda widely described as lighter-touch: less policymaking through enforcement, a more accommodating approach to crypto assets, and a fresh look at proposals left by his predecessor, Gary Gensler. Under acting chairman Mark Uyeda, the commission had already launched a crypto task force in January and, in February, extended the compliance dates for its Treasury clearing rule. Meanwhile, other adopted rules were still on their original schedules. The most significant for registrants was the 2024 amendment to Regulation S-P. It required incident response programs and customer breach notification, with compliance dates in December 2025 for larger firms and June 2026 for smaller ones.
A change of SEC leadership produces one headline: the pendulum is swinging. For chief compliance officers at broker-dealers and investment advisers, that headline is close to useless. A chair’s power over a rule depends on the rule’s legal status, and in April 2025 the SEC’s agenda sat in three distinct states. There were proposals not yet adopted, adopted rules whose compliance dates still lay ahead, and obligations already in force and enforced through examination. Each of the three calls for a different planning response, and every item on a firm’s regulatory inventory falls into exactly one of them.
Proposals: change is fast and cheap
A proposed rule creates no obligation. A new chair can let it sit, narrow it, re-propose it or withdraw it with a single commission vote. In April 2025 this category held several large items from the previous agenda. They included rules on conflicts from predictive data analytics, cybersecurity risk management for advisers and funds, and an expanded safeguarding rule for client assets.
The planning response is to stop spending on rule-specific build work while keeping the underlying risk managed. That distinction matters in practice. A firm that had begun designing a conflicts-testing process for its recommendation algorithms could pause the documentation the proposal would have required. It should not stop asking whether those algorithms favor the firm. Regulation Best Interest, the fiduciary duty of advisers and the general anti-fraud provisions all reach conflicted recommendations without any new rule.
The same logic applies to cybersecurity. Withdrawing the adviser cyber proposal removed a specific set of written-policy and reporting requirements. It left in place the safeguards rule in Regulation S-P, Regulation S-ID identity theft programs, and the examiners’ long-standing interest in how firms protect client data. Budget should move away from the proposal’s paperwork, not away from the control environment.
Adopted rules: change requires a formal act
An adopted rule with a future compliance date is far harder to move. Changing it takes new rulemaking, a formal extension order, or a court decision. Each of those is public and leaves time to react. The Treasury clearing extension in February 2025 showed the mechanism working: the commission voted, published new dates, and firms re-planned. In 2024 the Fifth Circuit had vacated the SEC’s private fund adviser rules, a reminder that courts are a third route. Absent one of those acts, the dates stand.
Regulation S-P was the item most firms needed to watch. The amendments required a written incident response program and oversight of service providers. They also required notice to affected individuals no later than 30 days after becoming aware that sensitive customer information was, or was reasonably likely to have been, accessed without authorization. Service providers had to notify the firm within 72 hours of becoming aware of a breach. That last requirement is why waiting was expensive. It cannot be met by the firm alone. Every relevant vendor contract has to carry the clause, and vendors negotiate on their own timelines.
A practical approach is a register entry for each adopted rule with four fields: compliance date, external dependencies, owner, and the formal action that would change the date. The owner checks the register when the commission meets. Until a formal act appears, the project runs on the published schedule. Counsel should confirm status at each milestone, because extensions sometimes arrive late and apply to only part of a rule.
There is a trade-off here. Running a project to a date that may later move can waste effort. In practice the waste is small. Incident response programs, vendor notice clauses and customer notification templates are useful under any rule set, and state breach laws already require much of the same work. The costlier error is the opposite one: a paused project restarting six months before a date that never moved.
Obligations in force: change comes through emphasis
Most of what registrants experience as SEC oversight comes from the Division of Examinations, applying rules that have been on the books for years. Those include books and records requirements, Regulation S-ID, the market access rule, the marketing rule and custody. A new chair can redirect enforcement priorities and soften the tone of exam letters. He cannot suspend the rules themselves without rulemaking.
The division’s annual examination priorities are the best signal of where attention will fall. They are worth reading closely each year for what is added and what is dropped. A shift in emphasis is real, but it changes the probability of scrutiny, not the standard. Deficiency letters still arrive. They still sit on the firm’s record and still surface in later exams, in client due diligence and in acquirers’ reviews.
The temptation in a lighter-touch period is to trim compliance staff or defer testing. The second-order cost shows up later. Exam cycles are long, and a deficiency found in 2027 may concern conduct from 2025. Policies that were written but not followed are the most common finding, and they are cheap to avoid. Firms should keep evidence of testing, surveillance reviews and annual compliance program reviews on the same cadence regardless of who chairs the commission.
Taken together, the three categories give compliance leaders a planning method that does not require predicting politics. Sort the inventory by legal status. Cut build spending on proposals, hold adopted dates until a formal change is published, and keep exam readiness steady. Then revisit the sort whenever the commission votes.
With hindsight
The sorting held up. On June 12, 2025, the SEC withdrew 14 pending proposals from the previous agenda, including the predictive data analytics, adviser cybersecurity and safeguarding proposals. It said any future action in those areas would need a new proposal. Attention shifted to crypto market structure and to easing disclosure burdens.
Adopted rules moved only through formal acts. The Regulation S-P amendments were not extended: larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. The Division of Examinations’ fiscal 2026 priorities, published in November 2025, named compliance with the amended Regulation S-P as a focus, alongside Regulation S-ID and cybersecurity. Firms that kept their vendor notification clauses and incident response programs moving through 2025 met those dates without strain. Those that read the new chair as a general reprieve found that the exam program had not read it that way.