Blog | Mirrorweb

No More Room for “We’ll Get to It”

Written by Marissa Jambrone | 17 Jul 2025


If you’ve been in compliance for more than a minute, you know the SEC doesn’t broadcast priorities just to make noise. Reports like the FY26 Investor Advocate Objectives are signals. And in this case, the signal is clear: investor harm is driving regulatory attention, and communication oversight is under pressure to modernize. 

Whether your firm is preparing for an exam or trying to avoid becoming an enforcement case study, here’s what actually matters from the FY26 objectives and what you should be shoring up now.

1. Fraud Is Surging and It’s Off-Channel

The SEC’s Ombuds Office reported a 142% year-over-year increase in fraud complaints. Most of it isn’t coming through traditional routes. It’s off-channel. Texts. Messaging apps. Impersonation attempts through spoofed social accounts and personal mobile numbers. 

Firms are responding with complete texting bans or by using third-party texting apps. The result? Low adoption, low visibility, and high risk. Because, like it or not, your employees are still communicating with clients the way clients prefer to communicate.

What to do now:

Don’t ban – start capturing. Start recording messaging channels in native format, with full metadata and context. That means showing messages as they actually appeared on the device: emojis, edits, threads, timestamps. If you're not showing how it happened, you can’t defend it. 
 
Curious how firms are getting 100% adoption without changing advisor behavior? Learn how Trusted Contacts makes it possible.

2. Crypto Oversight Is Expanding Beyond the Usual Suspects

The SEC’s expanded Crypto Assets and Cyber Unit is investigating everything from custody to staking, but it's also asking sharper questions about how firms talk about these products. This includes suitability of discussions, internal training, and informal messages exchanged between representatives and clients. 

And when the question becomes “Is this a security?” - the evidence isn’t just in your policy manual - it’s in your advisors’ DMs, chats, and email.

What to do now:

If your firm touches crypto, even indirectly, treat those communications like high-risk material. Audit rep conversations across platforms. Capture everything in context. And be ready to explain what was said, when it occurred, and whether it aligns with your disclosures.

3. Disclosure Alone Isn’t Enough Anymore

The Investor Advocate is pushing hard on clarity and accessibility. Disclosure volume is up; investor understanding is not. The SEC wants to see evidence that what was disclosed was actually seen and understood, not just included somewhere in a 70-page PDF.

What to do now:

Track disclosures where they happen: in messaging threads, in one-off client follow-ups, in social interactions. Can you show that your reps properly disclosed product risks in-channel? Can you retrieve that evidence without triggering a 3-week export process? If not, that’s a gap.

4. Private Markets Are Drawing Regulatory Heat

Private credit. Real estate. PE exposure in retirement accounts. These are becoming flashpoints for examiners. Risks include opaque valuations, redemption limitations, and complex fee structures that are not well understood. 

Yet firms often rely on boilerplate documents or standardized disclosures even as advisors promote these offerings in casual client interactions.

What to do now:

If reps are pushing private market strategies, especially to retail or near-retirement clients, those conversations need to be supervised and preserved in full. That means capturing the interaction, not just the investment doc. If a client misunderstood a lockup period or liquidity constraint, you need to be able to show what was actually communicated.

5. Proof > Policy

This is the thread running through the entire FY26 report: The SEC doesn’t want to know what your policies say. It wants to see what actually happened. 

Firms that rely on outdated systems, or assumptions, are the ones struggling to produce that proof.

  • Are you flagging real risk, or just generating noise?
  • Can you explain why a message was escalated?
  • Can you show message content, context, and not just metadata?
  • Is your supervision reviewable in an exam?

We've seen firms get buried in lexicon flags that mean nothing. “Guarantee” triggered by a footer, or alerts from a spouse reminding someone to check Instagram. Meanwhile, high-risk messages fly under the radar.

What to do now:

Rethink your review process. Move away from volume-based alerting toward explainable, context-rich supervision. Implement systems with explainable AI that allow you to clearly display exactly what was said, who reviewed it, why it was (or wasn't) flagged, and what action was taken When you can show that, examiners stop digging. 

Curious how we help? Sentinel doesn’t just flag - it explains. If you’re worried about being asked “show your algorithm,” this is the rules‑driven, explainable AI engine that lets you answer with confidence.

Final Thought: Compliance as a Trust Anchor

The FY26 objectives don’t just reflect regulatory trends; they reflect investor pain points. Harmed investors are shaping policy, and the SEC is listening. That means your communications oversight strategy needs to reflect how modern interactions actually happen, not how your systems were built five years ago. 

The good news? Teams that plan now will avoid scrambling later.