The SEC's AI-Washing Docket Is Moving Again: What Fintech Vendors Must Fix

The SEC brought no AI-focused actions in the first half of 2026, as DLA Piper’s October 8 alert notes. Since late August, three actions arrived in under six weeks, from WhatsApp investment scams that sold trading bots which never existed to a settled fraud case against a genuine AI startup.

The scams prove only that AI washing sells. “AI” is the bait of choice for overseas fraud rings. The case fintech and SaaS executives should study is GenesisAI; it holds nothing exotic. The SEC applied ordinary antifraud rules to ordinary fundraising collateral: revenue projections, a valuation, a partnership count, a waitlist. Every one of those was a representation.

For founders, CFOs, and compliance leads at mid-market fintech and SaaS companies that sell AI features or raise capital on them, here is what the docket shows and the worklist to run this quarter.

What landed between August and September

On September 29, the SEC charged two sets of entities in the Southern District of New York with operating what it calls “investment confidence scams,” likely run by people overseas, taking at least $15 million from hundreds of retail investors. The scams are pending complaints, not findings.

Per the complaint, Cryptoaiml Ltd. and its Cryptoaiml Capital Foundation ran WhatsApp groups where operators posed as investment professionals, issued purported AI-generated trading signals or tips claiming to produce large profits, and moved victims onto a fake platform: no trading took place, and withdrawals stayed frozen until people paid advance fees. The SEC says the scheme took in more than $12.5 million, propped up with a falsified Form D screenshot and false claims of SEC certification.

The companion TSAI Pro Ltd. and TSAI Capital Foundation complaint promised guaranteed profits from renting bots programmed with artificial intelligence, again with a phony SEC certificate. Per the complaint, there were no AI trading bots. That scheme took in more than $2.8 million.

Two details still matter to marketers of genuine AI. Per DLA Piper, the press release does not emphasize AI: the false claims sit in the complaints, the hook that pulled money in. DLA Piper’s summary of the complaint says Cryptoaiml advertised a claimed 98 percent accuracy rate. The claim did the work.

Zoe Financial: conflicts, not AI washing

A fourth September action is adjacent but not an AI-washing case. On September 28, the SEC announced settled charges against Zoe Financial, whose platform uses an algorithm to match prospective clients with third-party advisers. Per the order, salespeople often recommended advisers beyond what the algorithm produced, and the algorithm ignored whether an adviser used Zoe Wealth, where Zoe had a financial interest. The conflict was not adequately disclosed in Zoe’s Form ADV brochure until December 2024. Zoe agreed to a $450,000 penalty, a censure, and a cease-and-desist order for willfully violating Section 206(2) of the Advisers Act.

Sheldon Pollock, Associate Director of the SEC’s New York Regional Office: “Advisers must live up to those disclosure obligations in all aspects of their advisory services, including when they offer a new technology or new feature to their clients.”

Adding a matching model, scoring engine, or agent does not reset disclosure duties; they attach to the new feature. In Zoe’s case the algorithm was not the failure point: the human override around it was.

GenesisAI: the settled case honest startups should study

GenesisAI Corp. built a marketplace for AI models and raised more than $5.3 million from over 4,000 retail investors between December 2019 and December 2024, through crowdfunding offerings on Wefunder, Netcapital, and StartEngine. On August 26, the SEC settled fraud charges against the company and founder Archil Cheishvili.

The alleged misstatements read like ordinary early-stage fundraising. A December 2019 email projected $1 million in 2020 revenue and $8 million in 2021; offering documents later claimed $250 million by 2024, projections the SEC says had no reasonable basis for a marketplace still in beta until May 2022. Stated valuations climbed from $7.5 million to $47 million, then $89 million, then $204 million by mid-2022. Investors were told of as many as 25 partnerships and a waitlist; registered users never became paying clients. Per the SEC’s complaint as quoted by DLA Piper, the marketplace “was never commercially viable.”

The SEC charged the misrepresentations as negligent rather than knowing: intent is not a precondition for the claim. The settlement was modest: $50,000 in disgorgement, $9,184.53 in prejudgment interest, a $50,000 penalty, plus permanent injunctions. The company announced in January 2025 that it was halting product development and the founder stepped down. Late-round investors face near-total losses on illiquid crowdfunding securities.

Nobody alleged the AI was fake the way the September scams were; the lesson is the shape of the case, not the dollars. The problem was unsupported statements in investor-facing material, and crowdfunding pages, offering documents, and founder emails all count.

The honest docket count: private suits and exams, not a crackdown

Resist the wave narrative. The current SEC leadership has been lighter on AI claims than the March 2024 era, when the agency fined two registered advisers, Delphia and Global Predictions, a combined $400,000 for claiming machine-learning capabilities they did not have (Advisers Act Rel. Nos. 6573 and 6574, both settled March 18, 2024), and warned public issuers about AI misstatements.

The April 2026 enforcement report under Chair Paul Atkins mentions AI once; Presto Automation, the one AI-claims case against a public company Quartz identifies, settled in January 2025 without a fine. The Cyber and Emerging Technologies Unit, created in February 2025 with roughly thirty fraud specialists, prioritizes fraud committed using AI: a caseload profile like the September scams, not marketing polish at operating companies.

What fills the gap is private litigation and exams. DLA Piper counts AI-related securities class actions rising every year, with plaintiffs focused on risk disclosures, revenue and demand claims, and technology-capability statements. Cornerstone Research, as reported by Quartz, counts 16 federal class actions filed over AI claims in 2025 alone. The AI Lawsuit Tracker lists 12 AI-washing and securities actions, seven still active or pending. For registered advisers, the fiscal 2026 exam priorities direct examiners to check whether firms’ “representations and disclosures fairly reflect operations and controls” on AI, per a Baker Tilly summary cited by Quartz.

For an operating SaaS company, the exam door is narrow, the private-suit door wide, and your marketing copy is the exhibit list. The docket is selective: it punishes the plainly false faster than the promotional, and lands hardest where claims drift from what the product does.

A claims-control worklist for this quarter

DLA Piper’s recommendations map onto work a mid-market team can run without new tooling: update the AI governance framework, keep documentation supporting statements about AI systems, test those systems regularly, and strengthen review procedures for statements about technology. Here is the concrete version practitioners have documented since the 2024 adviser cases.

Build a claim ledger, not a screenshot folder. Screenshots prove what was published, not that it was true. For each material claim, whether or not the word AI appears, record what the audience saw and where, what a reasonable reader would take it to mean, who owns the evidence, which deployed system and version performs it, the period the evidence covers, the material limits and the human role, and who approved it and when it expires.

Treat vendor copy as an input, not proof. Before a claim from a vendor deck reaches your website or an investor deck, establish which component actually performs the claimed function, whether it is enabled in your deployed configuration, what data reaches it, whether a human or a rules engine makes the final call, and what testing stands behind any performance number. Warranties and audit rights support the diligence; they do not replace product evidence. Keep the vendor statement, your validation, the gaps, and the approval in one record: the same discipline the bank TPRM guidance overhaul pushes into vendor management.

Set change triggers so claims do not rot. Claims decay through drift, not intent: a model gets swapped, a vendor changes architecture, human review expands, a test fails, a customer complains the description no longer matches experience. Route those events back to the claim owner; correct or pull the copy quickly and record what changed and why.

Reconcile. Registered advisers: the Marketing Rule requires a reasonable basis for substantiating material factual statements if the Commission asks. For everyone else, filings, technical documentation, and sales material should tell the same story. That is the documentation muscle examiners test around model risk; the generative AI gap that governance still has to fill is what our SR 26-2 analysis covers.

What management should do next

Name an owner for AI claims (CCO, GC, or a fractional CISO working with both); unowned claims are how drift survives. Build the ledger for the twenty statements that carry real load: homepage, investor deck, app-store copy, due-diligence answers. Then walk one live claim end to end and find where the process breaks before a regulator, plaintiff, or customer does.

Our AI Governance Policy Template ships the claim-ledger fields above inside a complete policy scaffold, and the NIST SP 1353 quick-start shows how AI tooling can speed framework mapping once your inventory is real. For a second set of eyes on the review pipeline, contact NTD Consulting. We build this into AI governance and fintech cybersecurity engagements for mid-market teams.

Ron Moore runs NTD Consulting, which provides fractional CISO and cybersecurity advisory services to mid-market SaaS, fintech, and digital-asset companies.