SEC 2027 Exam Priorities: 'Super Intelligence,' Cybersecurity, and What Fintech Firms Must Prove

The SEC 2027 exam priorities landed on Oct. 23, 2026, when the Division of Examinations published its Fiscal Year 2027 report (press release 2026-109). The document tells examiners where a risk-based program will focus across “more than 34,000 registrants,” including investment advisers, broker-dealers, clearing agencies, transfer agents and funding portals. If you operate a registered fintech or digital-assets business, parts of it are effectively written to you.

Two structural facts make this year different from a routine refresh: it is the first full examination year written under the super intelligence vocabulary that entered federal usage by executive order in the fall, and the first full cycle after the amended Regulation S-P compliance dates. It also names AI-enabled attack methods in the examiners’ own words.

The better read for a CISO or COO is as a work order: each named item points to controls, artifacts and evidence examiners expect produced on request. This article works through that list for fintech and crypto registrants.

A staff statement, with document requests attached

The PDF’s p. 2 disclaimer is direct: “This statement, like all staff statements, has no legal force or effect: it does not alter or amend applicable law, and it creates no new or additional obligations for any person.” The Commission “has neither approved nor disapproved its content.”

That is not the whole story. The priorities “reflect practices, products, and services that the Division believes present heightened risks to investors or to the integrity of the U.S. capital markets” (printed p. 5), risk assessments feed exam targeting, and named items become the next risk alerts. The release also notes the priorities are “not an exhaustive list of the matters that examiners will review during FY 2027” and expects firms to maintain “strong, risk-based compliance programs tailored to their businesses” regardless. SEC Chairman Paul S. Atkins, in the release: “Examinations provide critical insight into emerging risks, evolving business practices, and market developments across our financial system.”

The practical translation: a named exam priority is a document request filed in advance; build the artifacts before an engagement letter exists.

Super intelligence is now examiner vocabulary

The vocabulary change traces to Executive Order 14434, signed Sept. 29, 2026, published in the Federal Register on Oct. 2, 2026, and directing executive agencies to use super intelligence, or SI, in place of AI. The FY 2027 priorities are the first full exam cycle written in that vocabulary, a terminology direction rather than a capability finding: nothing in the order says the technology improved, and the obligations stay technology-neutral. Banking already has its counterpart; we covered the OCC’s super intelligence examiner framework earlier this month.

The priorities’ own statement (printed p. 2):

“Registrants are increasingly incorporating super intelligence (SI) into their businesses. For example, they are using generative SI tools to support research, drafting, coding, and client communications, as well as advisory and portfolio management functions, and compliance monitoring and surveillance.”

The load-bearing sentence follows: as those capabilities grow, the Division is working to understand “whether firms continue to comply with existing, technology-neutral obligations” (printed p. 2). SI did not rewrite anyone’s obligations; it changed what examiners pull to see firms meeting them. “The markets we oversee continue to evolve rapidly, and the examination program must evolve with them,” said Keith Cassidy, the division’s director, in the release.

The attack-side items are now named exam material

Section VII.A.2 (printed p. 12) is where this document departs from a routine refresh:

“Registrants are increasingly using super intelligence (SI) in core business operations and systems, including investment analysis, customer management, and code development. Threat actors are using SI to automate and accelerate cyberattacks, making those attacks more efficient and harder to detect.”

Examiners will focus on “assessment and preparation for potential threats from SI-related cyberattacks that may affect their businesses or customers, such as SI-generated phishing messaging and synthetic or deepfake voice and video used for social engineering.”

This naming converts AI-era social engineering into an exam item with a controls trail. Phishing-era training handled attachments; the deepfake-era equivalents are operational: callback verification before payment or credential changes, executive-impersonation drills that assume a cloned voice, tabletop exercises with at least one synthetic-media scenario, and records that the controls ran.

The item then turns the lens around: the Division “will also prioritize examinations of policies and procedures relating to monitoring SI, including its use in fraud prevention and detection, back-office operations, compliance with AML and Reg BI obligations, and trading functions” (printed p. 12). Two directions, one exam: your defense against SI-assisted attacks, and the SI inside your own operations. In practice the internal-use policy usually exists; the attack-readiness evidence usually does not, and this document just moved that half onto the exam-prep checklist.

The perennial cyber list has not moved, and that is the point

The core cyber item (printed p. 12) reads like a checklist for firms that took prior years seriously. Examiners will review “governance practices, data loss prevention, access controls, account management, and the response and recovery protocols for cyber-related incidents, including ransomware attacks”, and assess risks associated with registrants’ “increased use of third-party service providers and shared technologies, including the effectiveness of risk management in these areas.” None of it is new: these are the predictable requests where findings come from, and preparation is assembly of things that should already exist.

The newer wrinkle is automated tools. For firms using automated investment tools, trading algorithms and alternative data, the priorities set a three-part review: “(1) representations are fair and accurate; (2) operations and controls are consistent with disclosures made to investors; and (3) algorithms lead to advice or recommendations consistent with investors’ investment profiles or stated strategies” (printed p. 12). Parts 1 and 2 are the AI-washing question asked quietly; we covered in October what that enforcement looked like. Part 3 is an operations audit of the model: documented testing that outputs track investor profiles and strategies.

Reg S-P and S-ID enter their first full amended-rule cycle

The amended Regulation S-P focus is direct: staff “will evaluate response program policies and procedures for unauthorized access to or use of customer information, including customer notification procedures and oversight of service providers” (printed p. 12). Transfer agents should expect review of amended-S-P compliance “including the Safeguards Rule, the Disposal Rule, and the requirement to establish incident response programs”; funding portals get the same subject as a discretionary item (printed p. 11).

S-ID carries the AI-era update. Examiners will look at red-flag programs “particularly during customer account takeovers and fraudulent transfers” and assess “whether firms are updating their Identity Theft Prevention Program to address emerging risks, such as those related to SI and stolen credentials” (printed p. 13).

Timing matters. WilmerHale’s alert (Oct. 26, 2026) puts the amended S-P compliance dates at Dec. 3, 2025 for larger entities and June 3, 2026 for smaller ones, making FY 2027 the first full examination cycle after both. Firms that treated the amendment as a 2025 policy project now meet examiners asking to see the program operating. The rehearsal is what firms skip; it also separates a document from a demonstrated control.

SCI quietly becomes the emerging-technology lane

Regulation SCI applies to a narrow slice of market infrastructure; most fintechs will never carry an SCI exam. Two spillovers still make printed p. 13 worth a read.

First, vendor-side. The Division will review “reliance on cloud and other third-party vendors, particularly how those entities manage vendor risks and identify vendor systems that qualify as SCI systems or indirect SCI systems” (printed p. 13). If you sell hosting, analytics or software into that market, the classification questions arrive from your customers; someone in your firm must answer them.

Second, direction of travel. SCI examinations will focus on “emerging trends, including SI, tokenization of securities, extended trading hours, and quantum computing” (printed p. 13). Tokenization and quantum are the two with direct fintech consequences: the post-quantum deadlines we covered in October sit inside the trend examiners name, and the vendor intensity reads like the bank TPRM guidance overhaul from September: deeper classification, more provable oversight of whoever operates the systems.

Where crypto went

The priorities PDF does not use the word crypto. A checkable property, and it tracks WilmerHale’s observation that digital assets are no longer identified as a separate examination priority. Debevoise’s alert reads that silence as heightened AML and foreign-account scrutiny. Both are law-firm readings rather than SEC statements, hence the attribution here.

The SEC text points elsewhere: the release lists “Treasury clearing reforms, tokenization, and related developments” among evolving market-infrastructure risks, and clearing-agency exams put tokenization among the high-risk areas alongside “risk management of defaults, recovery and wind-down, securities lending, operations” (printed p. 10). Digital assets, parsed this way, sit inside market-structure exams rather than owning a line item.

Two cautions. Absence of a named priority is not absence of examination: the list is explicitly not exhaustive, and digital-assets registrants remain inside the population the S-P, S-ID, AML and vendor items cover. Tokenization in clearing-agency exams is an operations signal, not an endorsement: the exam questions will be controls-shaped.

What to stage before the document request

Assembled from the named items, the artifact list:

• Regulation S-P response program: written procedures for unauthorized access to customer information, standing notification language with owners, the service-provider oversight file (contracts, notice terms, assurance reports, tracked remediation) and one rehearsal against a realistic scenario.
• Regulation S-ID: an Identity Theft Prevention Program updated for SI-era red flags and stolen credentials, with the update reflected in detection rules and training, not only the document.
• SI inventory and monitoring: SI use by function with owners and monitoring controls across fraud, AML, Reg BI and trading. The AI inventory paired with a shadow-AI roadmap is the base artifact, and agentic uses raise the governance questions we tracked in September.
• Attack-side readiness: callback verification before payments and credential changes, executive-impersonation drills, and tabletop evidence that includes a synthetic-media scenario.
• Third-party and shared technologies: a service-provider inventory with classification and reliance documentation; for firms selling into market infrastructure, answers on which systems qualify as SCI or indirect SCI systems.
• Automated tools: reconciliations between representations, operations, controls and disclosures, plus evidence algorithm outputs track investor profiles and strategies.
• Perennial cyber core: governance records, data loss prevention, access controls, account management and an exercised ransomware runbook, the most predictable requests on any exam list.

Two notes from the document. The leadership message (printed p. 1) records that “earlier this month” the Division published “The SEC Exam Handbook: A Practical Guide on Process and Engagement,” which covers each exam stage and belongs in front of whoever sits across from examiners. The release says the Division may adjust focus areas during the year; treat named items as direction, not a guarantee for any single exam.

The honest summary of FY 2027 for a fintech CISO: the exam value sits in outputs, not policies. A notification sent on time, a callback that stopped a payment, a vendor classified before the outage. Produce that evidence on request and the cycle is considerably shorter than reconstructing it afterward.