Ask NostroAskSubscribe

SEC exam division releases fiscal 2027 priorities, citing RIA conflicts and cyber risks

For the cco of a bank-owned broker-dealer

The SEC's Division of Examinations released its fiscal 2027 examination priorities on Friday, according to InvestmentNews, which dated its article Oct. 23, 2026.1

InvestmentNews described the list as the division's annual priority list, and the document states it is a staff statement with no legal force or effect that creates no new or additional obligations for any person.12 InvestmentNews reported the list came about three weeks earlier than last year's, which was delayed by a federal government shutdown.1

On cybersecurity, the division said bad actors increasingly use super intelligence (SI) to automate attacks, and examiners will review how firms prepare for SI-generated phishing and deepfake voice and video used in social engineering, according to InvestmentNews.1

Examiners will also review governance, data loss prevention, access controls and incident response, including ransomware response, and will check Regulation S-ID programs for account takeovers and stolen credentials, InvestmentNews reported.1

For firms' own use of SI, the division will review monitoring policies in four areas: fraud detection, back-office work, AML and Reg BI compliance, and trading, according to InvestmentNews.1

Wealth Management reported the report uses "super intelligence" for AI, following a presidential order on the term; for Regulation S-P, ACA Group's Robert Baker said examiners will now test whether firms maintain incident response, customer notification and service provider oversight policies.4

Why it matters

The exam language changes little for a bank-owned broker-dealer, but documented testing of controls against deepfake and phishing attacks, and documented review of the firm's own SI tools, will give examiners something to check. This is interpretation; the sources do not say what evidence examiners will request.

From the brief

Our take. Examiners will ask how you stop SI-built phishing and deepfake callers, then ask how your own SI runs AML and Reg BI checks. Same technology, two exam questions; have test results for both before the letter arrives.

Action. Information security: Run a deepfake-voice callback test on client money-movement requests and file the results for the SEC exam.

What our records say

The SEC has no AI-specific rule in force.1 Bank securities arms are instead held to existing rules: Regulation Best Interest, the Advisers Act fiduciary duty, the Marketing Rule, antifraud provisions, and supervision and recordkeeping requirements, all of which the SEC applies to AI use.2

  1. SEC: how it regulates AI in banking (part 1)
  2. SEC: Does the SEC have an AI rule that applies to a bank's broker-dealer or adviser?

From our records

Sources

  1. ReportSEC’s 2027 exam priorities put RIA conflicts and cyber risks in focus - InvestmentNews Investmentnews
  2. Primary sourcehttps://www.sec.gov/files/2027-exam-priorities.pdf SEC
  3. Primary sourcehttps://www.sec.gov/files/observations-ia-obligations-related-economic-conflicts-interest-060926.pdf SEC
  4. Also reported bySEC 2027 Priorities Target AI Oversight Gaps Wealthmanagement