SEC puts the RIA M&A boom under the microscope in 2026 exam priorities

Another booming year of M&A activity among RIAs has caught the attention of the Securities and Exchange Commission (SEC). The dealmaking was flagged under “business practices that may create additional risks and potential or actual conflicts of interest,” inside the SEC’s examination priorities list for 2026.

The priorities list from the SEC’s Division of Examinations noted “advisers that have merged or consolidated with, or been acquired by, existing advisory practices, which may result in accompanying operational and/or compliance complexities or new conflicts of interest,” under its areas that “may create additional risks.”

M&A consultant DeVoe & Company said last month that RIA merger and acquisitions reached 273 deals as of October 28, already surpassing the full-year activity record of 272 deals set in 2024. Dealmaking data for 2025 puts the RIA industry on pace to surpass the 300-deal mark for the first time as private equity-backed aggregator firms drive consolidation among RIAs.

“The SEC’s focus on advisory firms that have merged, consolidated, or been acquired reflects a clear reality: RIA consolidation is accelerating faster than operational and compliance infrastructures can keep pace,” Matthew Berkowitz, US wealth and asset management practice lead at RIA consultant Capco, told InvestmentNews. “PE-backed roll-ups, tuck-ins, and succession-driven deals have created larger, more complex organizations that often still run on fragmented systems, uneven supervision, and inconsistent client communication.”

Among the regulatory risk points M&A could bring to RIAs includes “integrations involving multiple custodians, tech stacks, and fee structures [that] increase the chance of billing, trading, or reporting errors.” The SEC’s inclusion of M&A in its priorities list serves as a “warning that firms cannot simply assume that the acquired practice was compliant, they must prove it,” said Kaitlyn Wulfken, director at compliance consulting firm CRC-Oyster.

“The SEC is signaling that RIA M&A is no longer just a business event; it’s a meaningful compliance risk,” Wulfken said. “The integration period is where examiners are finding the most significant gaps, from outdated ADV disclosures to billing errors and supervision lapses. Increasing consolidation, particularly PE-backed roll-ups and multi-state platforms, has created complex organizations with potentially uneven compliance maturity.” 

Other regulatory focuses in the SEC's examination priorities list included oversight of artificial intelligence and cybersecurity practices while shifting away from enforcement that target cryptocurrency. The SEC also mentioned the potential risk of "advisers utilizing third-parties to access clients’ accounts, where controls may be insufficient to protect client assets and data," which comes amid credential-sharing crackdowns from Schwab and Fidelity to prevent third-party fintechs such as Pontera from letting external advisors manage their client's 401(k) accounts.