On Friday, October 23, 2026, the SEC’s Division of Examinations published its priorities for fiscal year 2027. The report covers more than 34,000 registrants, from investment advisers and broker-dealers to transfer agents and funding portals. Two changes stand out for finance and security leaders. The report now uses the term “super intelligence,” or SI, where earlier years said artificial intelligence. And examiners say they will check how firms prepare for SI-generated phishing and “synthetic or deepfake voice and video used for social engineering.”
The priorities do not create new rules. They tell registrants where examiners will look first. For a CFO or CISO at an adviser, a broker-dealer, or a vendor that sells to them, that makes the document a useful checklist to run before an examiner does.
What the report says
The SEC’s press release lists eight areas of focus. Among them are investment advisers’ fiduciary duties and conflicts, retail products that are complex or illiquid, private funds and private credit, broker-dealer financial responsibility and anti-money laundering compliance, and “operational resiliency, cybersecurity, and protection of customer information.” Another is “emerging technologies, including super intelligence.”
The cyber and technology language sits in section VII of the full report, “Risk Areas Impacting Various Market Participants.” Three parts matter most.
- Cybersecurity. Examiners will review “governance practices, data loss prevention, access controls, account management, and the response and recovery protocols for cyber-related incidents, including ransomware attacks.” They will also assess risk from “registrants’ increased use of third-party service providers and shared technologies.”
- Emerging financial technology. The report says threat actors are using SI “to automate and accelerate cyberattacks, making those attacks more efficient and harder to detect.” Examiners will check firms’ preparation for those attacks. They will also review policies for monitoring SI used in fraud detection, back-office work, AML and Regulation Best Interest compliance, and trading.
- Regulation S-P and Regulation S-ID. Under the amended Regulation S-P, staff will evaluate response programs for unauthorized access to customer information, “including customer notification procedures and oversight of service providers.” Under Regulation S-ID, examiners will focus on red flags for identity theft, “particularly during customer account takeovers and fraudulent transfers,” and on whether firms update their programs for risks “related to SI and stolen credentials.”
For firms covered by Regulation SCI, the report adds that examiners will review reliance on “cloud and other third-party vendors,” including how those firms identify vendor systems that count as SCI systems.
The leadership letter at the front of the report also says the Division is using SI in its own work, to support analysis and workflow “while supplementing, but not replacing, staff judgment.”
What changed in the wording
The shift from “AI” to “super intelligence” is a change of label, not of rule. The report says firms must keep complying with “existing, technology-neutral obligations.” What is new is how specific the threat language is. Deepfake voice and video are named. Account takeover and stolen credentials are named. Vendor oversight shows up in three places: the cybersecurity section, the S-P section and the SCI section.
That matches what security teams already see. A voice that sounds like the CFO is not proof the CFO approved a wire. Our guide, Stop using a voice as approval, covers the control that answers it.
What it means for CFOs/CISOs
If you work at an SEC registrant, assume an examiner will ask three questions. Can you show a written process for verifying payment and account-change requests that does not depend on recognizing a voice or face? Can you show who your service providers are, what customer data they hold, and how they would tell you about a breach? And can you list the SI tools in use across the firm and who reviews what they produce?
For a CFO, the payment-verification question is the one with direct money at stake. A callback rule to a number already on file, plus a second approver for changes to bank details, costs little and is easy to show. For a CISO, the vendor question is the bigger lift, because the answer lives in contracts, not in the security stack.
If you sell software or services to advisers or brokers, expect these questions to move into your security questionnaires over the coming months. Your customers will need evidence from you to answer their examiners.
What to do this week
- Map the bullets to controls. Take the cybersecurity, SI and S-P/S-ID paragraphs from section VII and list, next to each, the policy or control that answers it and its owner. Gaps go on a risk exception register with an expiry date.
- Write down payment verification. If the callback and second-approver rule is a habit rather than a written procedure, write it down this week.
- Inventory SI tools and agents. List each tool, who owns it, what it can read and change, and who reviews its output. The AI agent inventory does this in a browser.
- Check service-provider notice terms. For vendors that hold customer information, confirm the contract says how fast they must tell you about unauthorized access. Note the gaps for the next renewal.
Vendor gaps at renewal. Service-provider notice terms are easiest to fix at renewal. The Renewal Audit reviews up to 25 software renewals for a fixed $199 and returns a written report in 5 business days. If you would rather run it yourself, the Renewal & Risk Operator Pack ($29) has spreadsheet versions of the renewal scorecard and the risk exception register.
What to watch next
Watch for risk alerts from the Division of Examinations during the year; the report says priorities may shift with market events and new technology. Watch for the first examination deficiency letters that cite SI-related phishing or deepfake controls. And watch your inbound vendor questionnaires: if customers start asking about deepfake verification and SI monitoring, this report is why.
Sources
- SEC press release 2026-109, “SEC Announces Fiscal Year 2027 Examination Priorities,” October 23, 2026
- SEC Division of Examinations, “Examination Priorities: Fiscal Year 2027” (PDF), section VII, “Risk Areas Impacting Various Market Participants,” and the message from the leadership team
Related: The SEC clock starts at material and Security and vulnerabilities.