Top 5 SEC Enforcement Developments for September 2026

Each month, we publish a roundup of the most important SEC enforcement developments, for busy in-house lawyers and compliance professionals. This month, we examine:

• An SEC subpoena enforcement action against a proxy advisory firm;
• A FINRA settlement with a member firm related to inaccurate information the firm allegedly sent customers relating to the cost basis of their investments, which caused tax reporting issues;
• A Canadian broker-dealer’s settlement of an SEC administrative action relating to its failure to enforce its own anti-money laundering policies and to file suspicious activity reports (SARs);
• A settlement between a broker-dealer operating an Alternative Trading System and the SEC, after the broker-dealer allegedly failed to remedy deficiencies identified in examination letters relating to required written policies and procedures; and
• A roundup of SEC insider trading actions, demonstrating a continued focus on countering trading based on material non-public information by non-traditional insider traders.

Before diving into these SEC actions, we first highlight the CLARITY Act, which would have been the first federal law establishing a legislative framework for the crypto industry. The bill would have settled the uncertainty regarding agency regulatory responsibility over crypto, giving the CFTC oversight over decentralized digital commodities, while maintaining SEC oversight of fundraising and investment contracts. The CLARITY Act failed to pass a procedural vote in the Senate on September 15, 2026, making it unlikely to be passed during the current Congress. For more information, please read our client alert.

1. SEC Files Subpoena Enforcement Action Against Proxy Advisor

On September 4, 2026, the SEC filed a rare subpoena enforcement action in the U.S. District Court for the Eastern District of Pennsylvania against Institutional Shareholder Services, Inc. (ISS). ISS is an SEC-registered investment adviser and provides institutional investors with proxy voting recommendations and vote execution services. The action seeks to compel ISS to produce client-specific proxy voting data, following what the SEC characterizes as ISS’s refusal to comply fully with requests from the SEC’s Division of Examinations and a subsequent administrative subpoena issued by the Division of Enforcement.

In March 2026, as part of the Trump administration’s effort to increase scrutiny of proxy advisors, the SEC began examining ISS’s compliance with federal securities laws and requested information concerning the voting recommendations provided to clients and the votes executed on their behalf. According to the SEC, ISS provided sample reports for three clients but refused to produce the requested data for all clients, asserting that doing so would be unduly burdensome and require the creation of new records.

On July 20, 2026, the SEC issued a formal order of investigation concerning potential violations of the Investment Advisers Act of 1940, including its antifraud and recordkeeping provisions. The following day, the SEC issued an administrative subpoena seeking three categories of documents, including approximately four years of proxy recommendations and voting data. The SEC states that ISS agreed to produce client-identification records and voting authorization agreements, but refused to provide client voting data unless anonymized.

The SEC’s memorandum of law in support of this subpoena enforcement action states that ISS subsequently raised confidentiality and First Amendment objections, arguing that disclosure of its clients’ voting strategies and decisions could cause competitive harm, could chill protected speech and association, and may constitute retaliation for its protected speech. The SEC disputes these arguments, claiming that client-specific information is necessary to assess whether ISS provided advice consistent with its fiduciary duties, properly disclosed conflicts of interest, and executed votes in accordance with client instructions. The SEC now seeks an order compelling ISS to comply with the subpoena but has not concluded that ISS violated federal securities laws.

The proceeding highlights increased federal scrutiny of proxy advisors and is likely to test the scope of the SEC’s examination and investigative authority, particularly where requests for confidential client information implicate First Amendment protections.

2. FINRA Fines Vanguard $950K for Account Reporting Issues

On September 22, 2026, Vanguard Marketing Corporation (“Vanguard”) submitted a letter of Acceptance, Waiver, and Consent (AWC) in relation to a FINRA disciplinary action, without admitting or denying FINRA’s findings. FINRA alleged that Vanguard provided customers with inaccurate information regarding the cost basis of their investments in account statements, trade confirmations, and Forms 1099 in violation of FINRA Rules 2210, 4511, and 2010. Vanguard agreed to accept a censure and fine of $950,000.

The AWC alleges that between 2012 and 2023, Vanguard communicated inaccurate cost basis information in account statements, trade confirmations, and Forms 1099, and failed to reasonably investigate customer complaints and other red flags that its account statements, trade confirmations, and Forms 1099 were misleading.

In determining the appropriate penalty, FINRA considered that Vanguard proactively identified the issue to FINRA staff, and the remedial actions taken by Vanguard, including implementing new controls, hiring additional personnel and management to oversee cost basis reporting functions, undertaking an extensive internal review for other potential cost basis issues, hiring an outside consultant, and voluntarily paying $1.9 million in remediation to customers whose tax filings were impacted.

The AWC underscores the costs of inadequate compliance programs and the importance of investigating customer complaints that may signal systemic reporting errors. It also illustrates that self-reporting and proactive remediation, including voluntary payments to affected customers, can mitigate the sanctions imposed.

3. SEC Settles Charges Against Broker-Dealer for AML Violations

On September 11, 2026, the SEC settled administrative proceedings against Haywood Securities (USA) Inc., a Canada-based broker-dealer registered with the SEC, for allegedly failing to file Suspicious Activity Reports (SARs) despite identifying indicators of potentially suspicious customer activity. Haywood agreed to pay a $750,000 civil penalty and accept a censure and cease-and-desist order, without admitting to the SEC’s factual findings.

According to the SEC’s order, between May 2021 and January 2026, Haywood failed to adequately implement its written anti-money laundering (AML) policies and procedures, resulting in failures to identify, investigate, and report suspicious transactions. The SEC alleged that Haywood failed to conduct required heightened monitoring of certain high-risk accounts, including those associated with suspected criminal activity, and did not adequately train registered representatives regarding SAR filing obligations.

The order also described Haywood’s failures to file SARs, as required by its AML policies, in situations where it noted potentially suspicious trading—such as customers transferring proceeds out of their accounts following the rapid liquidation of large stock positions in low-priced securities—and where it declined to open accounts due to identified red flags, including suspicious trading activities and prior regulatory and fraud-related actions against the individual attempting to open the account.

The SEC found that Haywood willfully violated Section 17(a) of the Securities Exchange Act of 1934 and Rule 17a-8 thereunder. In accepting the settlement, the SEC considered Haywood’s remedial efforts, including revisions to its AML policies, increased compliance staffing, and engagement of a third-party consultant.

The settlement underscores the SEC’s continued enforcement of broker-dealer AML obligations, including the importance of investigating red flags identified during account opening, monitoring high-risk customers, and complying with SAR filing obligations.

4. SEC Censures and Fines Broker-Dealer over Reg SCI Compliance

On September 22, 2026, the SEC determined to accept the offer of settlement of OTC Link LLC (“OTC”), pursuant to which OTC agreed to accept a cease-and-desist order, censure, and civil money penalty in the amount of $575,000, without admitting the findings therein. OTC is a registered broker-dealer that operates OTC Link ATS, an Alternative Trading System for over-the-counter securities.

The SEC alleges that between August 2016 and March 2025, OTC failed to establish, maintain, and enforce written policies and procedures pursuant to Regulation SCI, which requires entities that perform certain key securities market functions to establish technological and operational controls to maintain reliability and safety. The SEC asserted that OTC lacked policies and procedures pertaining to system security (e.g., account management and access control, network device security configuration management, and data loss prevention policies and procedures) and to vulnerability review and testing (e.g., application vulnerability management, testing, and remediation policies and procedures).

The SEC’s order accepting OTC’s settlement states that OTC was repeatedly examined by the SEC’s Division of Examinations and sent written deficiency letters highlighting these issues. According to the SEC, OTC failed to remediate the alleged violations, and subsequent examinations allegedly found previously identified deficiencies remained unaddressed. In deciding this penalty, the SEC considered OTC’s alleged long-term failure to create written policies and procedures, as required by Regulation SCI, and to address deficiencies identified during examination.

The case is a reminder that examination deficiency letters are not merely advisory and highlights the SEC’s willingness to bring enforcement actions where a firm repeatedly fails to remediate previously identified deficiencies, even when the underlying violations concern written policies and procedures rather than fraud.

5. Insider Trading Roundup

Finally, the SEC also took action in multiple insider trading cases, demonstrating its continued focus on insider trading by individuals outside the traditional ranks of corporate insiders, including former executives, spouses, friends, and downstream tippees, and its willingness to pursue cases regardless of the dollar amounts involved.

Ex-Funko Exec to Pay SEC $1M in Insider Trading Case

First, Jon Kipp, a former executive at Funko Inc., agreed to settle an insider trading complaint with the SEC for more than $1 million, consisting of disgorgement of $483,746.40, prejudgment interest of $105,516.93, and a civil penalty of $483,746.40. Kipp was accused of violating Section 10(b) of the Exchange Act and Exchange Act Rule 10b-5.

The SEC alleges in its complaint that Kipp, who retired in 2018 but remained close friends with Funko’s CEO, learned in July 2023 that the CEO was being placed on a mandatory paid sabbatical by the board and was planning to leave the company. Two days later, Kipp allegedly sold all of his shares of Funko, avoiding $483,000 in losses, as the share price dropped 19% after the CEO’s departure became public.

The case highlights that insider trading liability is not limited to current insiders but also extends to former executives who trade on confidential information learned through personal relationships with individuals in possession of material non-public information.

SEC Says Couple Leaked Info Ahead of $3.7B Cummins Deal

Second, the SEC settled with a former Cummins Inc. finance executive, Fan “Jocelyn” Yang, and her husband, Jing Tian, whom the SEC accused of disclosing details about Cummins’ $3.7 billion acquisition of Meritor before it became public to a chain of individuals who earned over $500,000 from the inside information. The SEC alleges that Yang and her husband traded on this confidential information, and Tian, with Yang’s knowledge, also tipped a close friend with the intent that the friend profit from the information. The friend then shared the information with his wife, who traded on it and tipped others. A total of four tippees agreed to pay disgorgement and civil penalties of approximately $850,000, and Yang and Tian agreed to pay civil penalties in amounts to be determined by the court.

The case highlights the SEC’s willingness to pursue not only the source of confidential deal information but also the downstream tippees who trade on it.

SEC Settles Insider Trading Complaint over $11,000 in Avoided Losses

Finally, in a demonstration that no insider trading case is too small to avoid scrutiny, the SEC settled a complaint on September 24, 2026 against Cheryl Kramer, who allegedly avoided $11,000 in losses by selling her shares in Sage Therapeutics Inc. (“Sage”) two months before the company publicly announced that the FDA had not approved its primary drug candidate for use for the treatment of major depressive disorder. Kramer was told about the decision by a senior employee of the company with access to information about the FDA’s review process on June 3 or 4, 2023, and Kramer sold her shares on June 5. After Sage announced the FDA’s denial on August 4, 2023, its stock fell 53%.

This case demonstrates that the SEC is committed to pursuing insider trading charges regardless of the size of the losses avoided, and that information shared informally by company employees can expose recipients to liability.