A voicemail from your CEO authorizing an urgent wire. A video call with a familiar client asking to change account instructions. Neither is real, and both are now squarely on the Securities and Exchange Commission’s radar. In its Fiscal Year 2027 Examination Priorities, released October 23, 2026, the SEC’s Division of Examinations signaled that it will test whether firms are prepared for cyberattacks powered by artificial intelligence, including AI-generated phishing and synthetic or “deepfake” voice and video used for social engineering.

What the SEC Said

The Division releases its priorities each year to tell investment advisers, broker-dealers, and other registrants what examiners will look for. Many FY 2026 priorities carry over, but emerging financial technology is a notable new emphasis. The reasoning is direct: registrants increasingly embed advanced AI in investment analysis, customer management, and code development, while threat actors use the same tools to make attacks more efficient and harder to detect. (The Division calls it “super intelligence,” or “SI”; we use the more familiar “AI.”)

In a press release announcing the FY 2027 Examination Priorities, Division Director Keith Cassidy emphasized that the SEC's examination program is designed to evolve with changing markets, allowing the agency to identify emerging risks and anticipate areas of investor vulnerability. The Division will continue directing examination resources where they can have the greatest impact while remaining responsive to innovation and market change.

Three Areas of Focus

First, threat preparedness. The Division will continue its review of governance, data loss prevention, access controls, account management, incident response (including ransomware), and third-party risk. Now, examiners will also assess how firms identify and prepare for AI-enabled attacks that could affect their businesses or customers.

Second, how firms monitor their own AI. The Division will prioritize examining policies and procedures for monitoring AI used in fraud prevention and detection, back-office operations, AML and Regulation Best Interest compliance, and trading functions.

Third, AI-driven advice. The Division will prioritize firms offering automated investment advisory services, recommendations, and related tools, and remains focused on firms using trading algorithms or platforms and alternative data sources. If your business model fits that description, expect to be near the top of the list. Examiners will ask whether representations are fair and accurate, whether operations and controls match investor disclosures, and whether algorithms produce advice consistent with investors’ profiles or stated strategies. In other words, overstating or fabricating the role of AI in your product or service (also known as “AI-washing”) is an exam issue, not just a marketing one.

The Identity Theft Connection

These priorities do not stand alone. Under amended Regulation S-P, examiners will evaluate safeguards for customer information, incident response programs, customer notification procedures, and service provider oversight. Under Regulation S-ID, they will focus on red flags tied to account takeovers and fraudulent transfers, and on whether firms are updating Identity Theft Prevention Programs to address emerging risks such as AI and stolen credentials. A deepfake that defeats a call-back procedure is, at bottom, an identity theft problem.

Market Infrastructure Is Not Exempt

The same themes extend to exchanges, clearing agencies, and other Regulation Systems Compliance and Integrity (SCI) entities. Under Regulation SCI, examiners will focus on emerging trends, including AI, tokenization of securities, extended trading hours, and quantum computing. They will also review SCI entities’ reliance on cloud and other third-party vendors, including how those entities manage vendor risk and identify vendor systems that qualify as SCI or indirect SCI systems. For market infrastructure, the message is the same: technology risk is vendor risk.

Practical Implications

The Division stresses that firms must continue to comply with existing, technology-neutral obligations. The SEC does not need a new AI rule to cite a deficiency, and a deficiency letter can become the starting point for an enforcement referral. Firms should consider:

• Stress-testing verification protocols. Wire, account-change, and password-reset procedures that rely on recognizing a voice or face should be revisited.
• Updating written policies. Cybersecurity, Regulation S-P, and Identity Theft Prevention Program documents should expressly address AI-enabled social engineering.
• Inventorying AI use. Know where AI touches compliance, trading, surveillance, and client communications, and who is monitoring it.
• Reconciling disclosures with reality. Marketing statements, Form ADV, and Form CRS descriptions of AI capabilities should match how the tools actually work.
• Revisiting vendor oversight. Third-party and shared technologies are an explicit focus, and a firm’s risk often lives in its vendors’ systems.
• Training people. The most sophisticated deepfake still needs a human to act on it.

Bottom Line

The SEC has told the industry what it will be looking for. Firms that treat these priorities as a roadmap, and document their preparedness now, will be far better positioned when examiners arrive. We are closely tracking the Division’s FY 2027 examination program and advising clients on exam readiness and related enforcement risk. Please reach out if you would like to discuss how these priorities may affect your organization.