The regulatory landscape governing private fund managers and 506(c) issuers shifted significantly at the close of 2025 and into early 2026. The Financial Industry Regulatory Authority (FINRA) released its 2026 Annual Regulatory Oversight Report in December 2025—earlier than usual, in direct response to member firm feedback—and followed it with a flurry of proposed rule changes that directly affect how fund managers communicate with investors, market their offerings, and manage their compliance programs. For sponsors operating under Regulation D Rule 506(c), where general solicitation and advertising are permitted, staying current with FINRA's evolving requirements is not optional—it is an operational necessity.

Rule 506(c) of the Securities Act of 1933, implemented in 2013 pursuant to the Jumpstart Our Business Startups (JOBS) Act, allows issuers—including private equity funds, real estate syndications, venture capital funds, and hedge funds—to engage in general solicitation and advertising for their offerings. However, this privilege comes with a strict requirement: all purchasers must be verified as accredited investors through independent, reasonable means. Because 506(c) sponsors that use placement agents or broker-dealers are subject to FINRA's rules, understanding FINRA's current and evolving guidance is critical to maintaining compliant, effective capital-raising operations.

This article provides a comprehensive breakdown of the most significant FINRA developments in 2025–2026 that fund managers need to understand, including the 2026 Regulatory Oversight Report findings, the landmark proposed amendments to Rule 2210 governing communications with the public, new cybersecurity and artificial intelligence (AI) guidance, updated private placement compliance expectations, and the proposed overhaul of outside activity rules. Each section includes actionable compliance guidance and specific obligations relevant to 506(c) sponsors and their associated broker-dealer partners.

Overview: FINRA's 2026 Annual Regulatory Oversight Report

On December 9, 2025, FINRA published its 2026 Annual Regulatory Oversight Report—a nearly 90-page document that serves as FINRA's primary vehicle for communicating examination priorities, enforcement observations, and compliance expectations to member firms. For fund managers who work with broker-dealer placement agents or distribution partners, this report is an essential compliance roadmap.

FINRA explicitly noted that it released the 2026 Report earlier than previous years in direct response to member firm feedback requesting more lead time to implement compliance improvements. The report is not merely descriptive; FINRA considers its oversight reports to be guidance that firms should actively review to assess how FINRA interprets its own rules and applies them during examinations.

The 2026 Report is organized into four primary sections: Firm Operations, Financial Crimes Prevention, Communications and Sales, and Market Integrity. Private fund managers and 506(c) sponsors will find the most directly applicable guidance in the Communications and Sales section, specifically its subsections on Communications with the Public, Private Placements, and Regulation Best Interest (Reg BI).

Key Themes Across the 2026 Report

Several recurring themes appear throughout the 2026 Report that fund managers should internalize as compliance priorities for the year ahead:

• Emerging technology risks require updated governance frameworks. Generative AI (GenAI) receives its own dedicated section for the first time in 2026, signaling FINRA's serious concern about AI adoption outpacing compliance oversight.
• Cybersecurity remains a top operational priority. FINRA identified ransomware, phishing, identity-based fraud, and GenAI-enabled deepfakes as active threats targeting broker-dealers and their customers.
• Evergreen compliance topics persist. Anti-money laundering (AML), best execution, vendor management, and communications standards remain perennial examination focus areas. FINRA's message: these never go away.
• Private placement due diligence failures continue. FINRA found that some broker-dealers have failed to conduct adequate due diligence before recommending private placements, including insufficient research on issuers with limited operating histories—a frequent characteristic of emerging fund managers.
• Social media supervision is a growing concern. FINRA identified significant deficiencies in how firms supervise social media influencers acting on their behalf, a particularly relevant issue for 506(c) sponsors using digital marketing channels.

FINRA's Proposed Rule 2210 Amendments: The Projected Performance Revolution

The most consequential regulatory development of early 2026 for private fund managers is FINRA's proposed amendments to Rule 2210 (Communications with the Public), filed with the SEC on February 10, 2026 as SR-FINRA-2026-004. If adopted, these amendments would fundamentally change how fund managers and their placement agent broker-dealers can present performance information to prospective investors.

The Current Prohibition Under Rule 2210

Under existing FINRA Rule 2210(d)(1)(F), broker-dealer communications are generally prohibited from including projections of performance or targeted returns. The rule states that communications may not "predict or project performance, imply that past performance will recur or make any exaggerated or unwarranted claim, opinion or forecast." Only four narrow exceptions exist under current rules: hypothetical illustrations of mathematical principles, interactive investment analysis tools, price targets in research reports, and certain projections concerning security futures and options.

This prohibition has created significant friction for private fund managers who work with registered broker-dealer placement agents. Investment advisers operating under the SEC's Investment Adviser Marketing Rule (Rule 206(4)-1) are permitted to present hypothetical performance, including projected performance and targeted returns, subject to conditions. But when those same fund materials flow through a broker-dealer distribution channel, Rule 2210's prohibition has historically blocked their use—creating a compliance mismatch that disadvantaged 506(c) sponsors using placement agents.

What the Proposed Amendments Would Allow

FINRA's 2026 proposal would create a conditional exception to the general prohibition, allowing broker-dealer members to include projected performance or targeted returns in communications, provided three conditions are satisfied:

1. Audience appropriateness: The member must adopt and implement written policies and procedures reasonably designed to ensure the communication is relevant to the likely financial situation and investment objectives of the intended audience. Critically, the proposed amendments explicitly state that projected performance or targeted returns may not be directed to a mass audience or intended for general circulation.
2. Reasonable basis for projections: The member must have a reasonable basis for the criteria used and the assumptions made in calculating the projected performance or targeted return, and must retain written records supporting that basis.
3. Mandatory disclosures: The member must provide sufficient information to enable the intended audience to assess the projection or targeted return and the risks to achieving those results, including a clear explanation of why actual performance may differ from projections.

According to the SEC's published notice of FINRA's proposal, the SEC has until April 13, 2026 to approve, disapprove, or institute proceedings on the proposed amendments, with potential extensions of up to 90 days. If approved, FINRA will announce the implementation date via regulatory notice.

What This Means for 506(c) Fund Managers

The practical implications for private fund managers operating under Rule 506(c) are substantial. Currently, fund managers who prepare Private Placement Memoranda (PPMs) and marketing materials compliant with the Investment Adviser Marketing Rule often find those same materials restricted when placement agents attempt to distribute them. As Ropes & Gray noted in their analysis, this proposal would be "a particularly welcome development for broker-dealers that market private funds, as well as for private fund sponsors that market their funds through placement agents and other registered broker-dealers."

However, the proposed amendments are not without important caveats for 506(c) sponsors to understand:

• The FINRA proposal is intentionally narrower than the Marketing Rule. It covers projected performance and targeted returns but does not extend to model performance or back-tested performance—categories that are addressed separately under the Marketing Rule's "hypothetical performance" framework.
• Mass audience distribution remains prohibited. This means projected returns cannot be included in broad digital advertising campaigns targeting general audiences, even under 506(c)'s general solicitation framework.
• Due diligence documentation requirements are real. Broker-dealers must document a reasonable basis for each projection, which places compliance obligations on placement agent partners that fund managers need to anticipate and support.

Private Placement Compliance: What FINRA Found in 2025 Examinations

The 2025 FINRA Annual Regulatory Oversight Report's Private Placements section identified specific deficiencies observed during examinations of broker-dealers involved in distributing private offerings. These findings—which inform the 2026 compliance expectations—have direct implications for fund managers working through registered placement agents.

Due Diligence Deficiencies

FINRA found that some firms failed to conduct reasonable due diligence prior to recommending private placements to retail investors. The most frequently cited failure involved insufficient research on an issuer's business, particularly in instances where there is a limited or nonexistent operating history. For emerging fund managers raising their first or second fund under Rule 506(c), this is a direct compliance concern: your placement agent must conduct and document meaningful diligence on your fund's investment strategy, management team credentials, and offering structure before distributing materials to any retail investor.

FINRA also identified deficiencies in the review of offering materials, including cases where broker-dealers failed to verify that Private Placement Memoranda were consistent with the terms described in subscription agreements and other transaction documents. Fund managers should ensure that all offering documents are internally consistent and that their placement agents have a formal document review process.

Suitability and Reg BI Concerns in Private Placements

Under Regulation Best Interest (Reg BI), broker-dealers are required to act in the best interest of retail customers when recommending securities, including private placement interests. The 2026 Report emphasizes that Reg BI obligations fully apply to private placement recommendations. FINRA's examination findings identified cases where firms failed to appropriately train associated persons on the features of complex or risky products—which many private funds qualify as—and failed to implement system enhancements to maintain clear records for Reg BI-related documents.

For 506(c) sponsors, this has a practical implication: the fund's marketing materials and investor onboarding documentation should be designed with Reg BI in mind, providing clear, balanced disclosures about risks, liquidity constraints, fees, and conflicts of interest. While Reg BI applies to the broker-dealer, not the issuer directly, the quality and completeness of the issuer's materials directly affects the broker-dealer's ability to satisfy its Reg BI obligations.

Social Media and Influencer Supervision Failures

In the 2026 Report, FINRA introduced significant new guidance on social media influencers and mobile applications. FINRA observed that firms demonstrated inadequate supervision of social media influencers by: failing to review and approve influencers' firm-related static content before posting; not supervising influencer communications in interactive forums—such as comment sections, live streams, and direct messages—to the same standard as firm communications; and failing to retain retail communications posted by influencers on the firm's behalf.

For 506(c) sponsors who engage any third-party content creators, brand ambassadors, or influencers to promote their offering—even indirectly—this guidance has important implications. If a registered broker-dealer is involved in the offering, that firm's supervision obligations may extend to influencer-generated content related to the fund. Fund managers should consult with legal counsel and their placement agent's compliance team before engaging any influencer marketing strategies.

Cybersecurity and Generative AI: FINRA's New Compliance Frontier

The 2026 FINRA Report dedicates substantial attention to cybersecurity and, for the first time, introduces a dedicated section on Generative Artificial Intelligence (GenAI). These developments are relevant not only to broker-dealers but to any fund manager whose investor data, communications, or operational systems interact with a registered member firm's infrastructure.

Cybersecurity Threats Identified in 2026

FINRA identified several active cybersecurity threat categories targeting both broker-dealers and their customers during 2025 examinations:

• Ransomware and extortion attacks that compromise firm systems and hold critical data hostage
• Data breaches exposing confidential firm and investor information
• Social engineering attacks including phishing, SMS-based "smishing," and QR-code "quishing" campaigns that capture credentials from firm personnel
• New account fraud and account takeovers executed through stolen or falsified investor identity information—a particularly relevant risk in online investor onboarding workflows used by 506(c) sponsors
• Imposter sites and social accounts spoofing legitimate firms or regulators to defraud investors
• GenAI-enabled fraud, with threat actors using AI to produce deepfakes, synthetic fake IDs, polymorphic malware, and other tools that enable highly sophisticated cybercrimes targeting fund managers and their investors

FINRA's specific guidance for firms includes implementing multi-factor authentication (MFA) for all system access including email, establishing monitoring processes for social media accounts impersonating firm personnel, and maintaining written procedures for responding to imposter domains. Fund managers who collect investor personal and financial information through online portals or intake forms should apply these cybersecurity practices to their own systems, even if not directly regulated by FINRA.

GenAI: FINRA's New 2026 Focus Area

The introduction of a dedicated GenAI section in the 2026 Report signals that FINRA views artificial intelligence adoption as a systemic compliance risk that has outpaced firms' governance frameworks. FINRA's concerns center on several areas:

• Supervision of AI-generated communications: Firms using AI tools to draft investor communications, marketing materials, or chatbot responses must establish supervision frameworks that apply the same standards as human-generated communications under Rule 2210.
• Third-party AI vendor risk: Firms relying on external AI tools for compliance, suitability analysis, or investor interaction are responsible for their third-party vendors' outputs. FINRA expects firms to conduct ongoing oversight of AI vendors as part of their third-party risk management programs.
• AML and fraud detection: FINRA encourages firms to leverage AI in their anti-money laundering programs while also warning that threat actors are using AI to evade detection systems. Compliance teams should coordinate between cybersecurity personnel and AML personnel to address AI-enabled fraud threats.

For 506(c) fund managers, the practical compliance implication is clear: any AI tools used in investor communications, lead qualification, document generation, or marketing must be subject to documented supervision policies. Sponsors that use AI-powered CRM systems, chatbots, or automated email sequences in their investor outreach should review their practices against FINRA's evolving AI guidance—even if not directly regulated by FINRA—because their broker-dealer distribution partners will be held to these standards.

FINRA Rule 3290: The Proposed Overhaul of Outside Activities Requirements

On January 14, 2026, FINRA filed with the SEC a proposed rule change to adopt an entirely new FINRA Rule 3290 (Outside Activities Requirements), effectively overhauling the existing framework governing associated persons' outside business activities (OBAs) and private securities transactions (PSTs). This proposal is directly relevant to fund managers who have relationships with registered representatives or who employ personnel who are dually registered.

Background: The Current OBA Framework

Under existing FINRA rules, registered representatives are required to provide written notice to their member firm before engaging in outside business activities. For private securities transactions—which include participating in private placements like 506(c) offerings—the requirements are more stringent: the representative must receive written approval from the member firm, which then records and supervises the transaction. This framework has historically created compliance complexity for fund managers who engage registered reps as placement agents or investor relations professionals.

What Proposed Rule 3290 Would Change

According to Ropes & Gray's analysis of the proposal, the new rule is intended to reduce unnecessary compliance burdens and simplify requirements, while maintaining meaningful oversight of activities that present genuine conflicts of interest or investor protection concerns. The proposed rule was preceded by FINRA Regulatory Notice 25-05 (March 14, 2025), in which FINRA requested comment on simplifying outside activity requirements.

Key anticipated changes under the proposed framework include clearer categorical distinctions between activities that require pre-approval versus those that require only notification, updated definitions that better reflect modern working arrangements (including registered reps who simultaneously hold roles at affiliated investment advisers), and streamlined recordkeeping obligations for member firms supervising outside activities.

Fund managers who engage registered representatives—particularly those acting as dual-registrants or who maintain relationships at broker-dealer platforms—should monitor the Rule 3290 proposal closely. Changes to the OBA/PST framework could materially affect how placement agent agreements are structured, what disclosure obligations arise for fund distribution, and what supervisory obligations are triggered when registered reps participate in 506(c) capital-raising activities.

AML Compliance Updates: FINRA's Heightened 2026 Focus

Anti-money laundering compliance received expanded guidance in the 2026 Report, with FINRA identifying specific new failure modes observed in 2025 examinations. Under FINRA Rule 3310 (Anti-Money Laundering Compliance Program), member firms are required to maintain written AML programs that include policies, procedures, and internal controls reasonably designed to detect and report suspicious activity.

Key AML Deficiencies Identified by FINRA

FINRA's 2026 findings identified four categories of AML deficiencies that fund managers working with broker-dealer partners should be aware of:

• Under-resourced AML programs: Insufficient staffing and resources, particularly following material business expansions or when new threats emerge. Rapidly growing placement agent firms may be especially vulnerable to this failure mode.
• Surveillance and investigation failures: Inadequate systems for detecting suspicious transaction patterns, including deficiencies in alert and exception report testing that fail to identify the activity the systems were designed to flag.
• Escalation failures across functions: Failure to establish effective mechanisms to escalate red flags detected outside the formal AML program—for example, cybersecurity incidents or account takeovers that may require a Suspicious Activity Report (SAR) filing.
• Deficient customer due diligence processes: Incomplete Know Your Customer (KYC) data collection, particularly for beneficial ownership identification. For 506(c) sponsors onboarding institutional investors or entities, ensuring that full beneficial ownership documentation is collected is both an AML requirement for broker-dealer partners and a best practice for the fund manager.

FINRA's new effective practices guidance on AML programs includes clearly defining AML responsibilities across individuals and business units, providing ongoing tailored training aligned to specific firm risks, and coordinating AML personnel with cybersecurity teams to identify AI-enabled financial crime. Fund managers should request confirmation from their broker-dealer placement agents that these practices are in place and documented.

FinCEN Anti-Money Laundering Rule: Important Update for RIAs

Separately, fund managers who are SEC-registered investment advisers should be aware that FinCEN has postponed the effective date of its rule requiring SEC-registered investment advisers and exempt reporting advisers (ERAs) to adopt formal AML programs. According to the Kirkland & Ellis 2026 key dates guide, FinCEN has pushed the compliance deadline for this RIA-specific AML rule to January 1, 2028, and is also revisiting the scope of which entities are required to file. Fund managers should continue monitoring FinCEN guidance on this rule, as the final framework will establish direct AML obligations on investment advisers independent of FINRA's broker-dealer requirements.

Key Filing and Compliance Deadlines for Fund Managers in 2026

Beyond FINRA's substantive rule updates, fund managers operating 506(c) offerings must track a series of specific filing deadlines and compliance implementation dates in 2026. The following summary covers the most material obligations, drawn from Day Pitney's 2026 compliance calendar and Kirkland & Ellis's annual compliance guide.

Form ADV and Form PF

Form ADV annual updates and Form PF filings are submitted through FINRA's Investment Adviser Registration Depository (IARD) system, which accepts filings on weekends. The SEC and CFTC have delayed the compliance date for amended Form PF until October 1, 2026, during which time agencies are conducting a substantive review of the form. Fund managers who have not yet updated their Form ADV to reflect current business activities, fee structures, and material risks should do so promptly.

Regulation S-P Safeguards Rule: Smaller Entities Compliance Date

The SEC's amended Regulation S-P (Safeguards Rule) established a tiered compliance timeline. Larger RIAs with $1.5 billion or more in AUM were required to comply by December 3, 2025. Smaller RIAs—those with less than $1.5 billion in AUM—have a compliance deadline of June 3, 2026. The amended rule requires firms to implement written incident response programs, establish investor notice obligations for certain covered data incidents, and maintain oversight procedures for service providers including contractual notification provisions. Fund managers in the smaller entity tier who have not yet implemented compliant Reg S-P programs must do so before the June 2026 deadline.

FINRA IARD Annual Renewal

FINRA, as the IARD operator, collects and distributes annual renewal fees to the appropriate state jurisdictions for broker-dealer registrations and notice filings. Fund managers should confirm with their placement agent broker-dealers that annual IARD renewal has been completed and that all state registrations and notice filing statuses remain active. Non-compliance with state notice filing requirements under blue sky laws can create offering deficiencies that require remediation, even for federally exempt 506(c) offerings.

Accredited Investor Status Representations

As part of annual compliance reviews, 506(c) fund managers and their broker-dealer partners should obtain updated representations from investors regarding their accredited investor status under FINRA's new-issues rules. This is particularly important for ongoing offerings with multiple closes and for investors who may be approaching the anniversary of their initial verification date. The March 2025 SEC guidance on 506(c) verification established new minimum investment amount safe harbors, which may simplify the re-verification process for certain categories of investors.

What 506(c) Fund Managers Must Do Right Now: A Practical Compliance Checklist

Translating FINRA's 2026 regulatory guidance into concrete compliance actions requires fund managers to approach their obligations from multiple angles: their own internal governance, their broker-dealer partnerships, their investor documentation practices, and their technology and marketing operations. The following prioritized checklist consolidates the most actionable compliance steps for 506(c) sponsors in 2026.

Immediate Actions (Q1–Q2 2026)

• Review the 2026 FINRA Annual Regulatory Oversight Report in full. Prioritize the Private Placements, Communications with the Public, and Financial Crimes Prevention sections. Distribute relevant findings to your compliance counsel and placement agent partners.
• Audit your placement agent's Rule 2210 and Reg BI compliance programs. Request documentation confirming that your broker-dealer partner has updated their compliance program to reflect 2026 FINRA guidance, including private placement due diligence processes and Reg BI documentation standards.
• Implement or update multi-factor authentication (MFA) on all investor-facing platforms. This includes your investor portal, CRM, email systems, and any intake forms collecting investor personal and financial information.
• Audit all marketing materials for consistency with Rule 2210. Confirm that no materials distributed through broker-dealer channels contain projected performance or targeted returns that would violate current Rule 2210 prohibitions, pending the proposed amendment's adoption.
• Complete Regulation S-P incident response program documentation (if not already done) before the June 3, 2026 compliance deadline for smaller RIAs.

Medium-Term Actions (Q2–Q3 2026)

• Prepare performance projection materials for potential Rule 2210 amendment adoption. Work with counsel to identify which projected performance metrics you may want to use in broker-dealer distribution channels if the amendment is adopted, and document the reasonable basis for each projection now.
• Establish a GenAI use policy for investor communications. If your firm uses any AI-powered tools for drafting communications, qualifying leads, or generating marketing content, create written policies governing their use and establishing supervision and review procedures.
• Review and update investor accredited status verification documentation. Confirm that existing investors' verification documentation remains current and aligns with the SEC's March 2025 guidance on minimum investment amount safe harbors where applicable.
• Monitor FINRA Rule 3290 (Outside Activities) for adoption. If your offering involves registered representatives acting in dual capacities, assess how the proposed framework may change your placement agent agreements.