The U.S. Securities and Exchange Commission brought 348 enforcement actions in fiscal 2026 and ordered just under $1.1 billion in monetary relief, a 24% drop in case volume from the prior year.
The SEC published the figures Tuesday for the year that ended Sept. 30. The total breaks down into 235 standalone actions, 113 follow-on administrative proceedings and 13 trading suspensions tied to suspected manipulation of Asia-based issuers. Standalone cases fell from 303 the year before, and from 431 in fiscal 2024.
Monetary relief came to $1.095 billion, split between $752 million in disgorgement and prejudgment interest and $343 million in civil penalties. A court in a separate non-SEC action treated $235 million of the disgorgement as already satisfied, leaving $860 million the agency can claim as its own, against $2.7 billion on the same basis in fiscal 2025.
The one number that moved up was distributions. The SEC returned about $731 million to more than 250,000 harmed investors, close to triple the prior year’s $262 million.
SEC Chairman Paul S. Atkins said case counts and dollar figures are “not the only or most telling measures” of the program. Enforcement Director David Woodcock said the division spent the year reviewing its investigative docket and is concentrating on consequential misconduct.
For compliance teams tracking cyber enforcement, the thin part of the record is the relevant part. The agency’s own announcement named a single cybersecurity matter: a settled order against M Holdings Securities over deficient policies for protecting customer information under Regulation S-P and the identity theft red flags rule, Regulation S-ID. The firm paid a $325,000 penalty. No enforcement action over a public company’s cybersecurity incident disclosure appears in the release.
That absence follows the direction the commission has taken since Atkins arrived. A federal judge gutted the commission’s 2023 case against SolarWinds and chief information security officer Timothy Brown in July 2024, and the SEC walked away from what was left through a joint stipulation in November 2025, inside the fiscal year it just reported. Registrants still owe the four-business-day clock in Item 1.05 of Form 8-K for material incidents, and the rule remains on the books. The odds of being charged over the wording of a disclosure are what changed.
Broker-dealers and advisers get less relief than issuers. Regulation S-P amendments requiring written incident response programs and 30-day customer notification took effect for larger firms in December 2025 and for smaller ones in June 2026. The M Holdings order shows that pipeline still runs.
Two other details in the report will interest security leaders. The SEC took in roughly 26,000 whistleblower tips and paid more than $158 million to 65 people, which keeps internal reporting a live risk for companies sitting on bad security news. And the agency has dropped the term artificial intelligence from its own vocabulary. The release instead describes a new Office of Super Intelligence and Analytics, says the office runs “SI-enabled anomaly detection” and blockchain analysis, and lists “SI-enabled manipulation schemes” among the threats the division is built to chase. The phrase “artificial intelligence” appears nowhere in the document.
Independent tallies run slightly below the SEC’s. The D&O Diary counted 308 total actions and 232 standalone cases for fiscal 2026, which it called the lowest since at least fiscal 2018, and found the work bunched into the second half of the year: 163 actions, after a first half of 69.
