What the SEC's FY2027 Exam Priorities Mean for Your RIA's Cybersecurity
Updated: 7 days ago
Short answer: In its FY2027 examination priorities (released October 23, 2026), the SEC's Division of Examinations said it will check whether advisers can actually run their amended Regulation S-P incident response program, notify clients, and oversee service providers. It also named Regulation S-ID account takeover controls and AI-driven phishing and deepfakes as focus areas. Advisers should have written procedures, evidence they were tested, and current vendor terms ready before an examiner asks.
What the SEC released
On October 23, 2026, the SEC announced its Division of Examinations' fiscal year 2027 priorities (press release 2026-109). The release lists operational resiliency, cybersecurity and the protection of customer information as a key focus area, alongside emerging technology and advisers' fiduciary duties.
The Division also noted (October 23, 2026) that the list is not exhaustive and that it may shift its focus during the year as risks change. Treat the priorities as the minimum an examiner will look at, not the full list.
The sections below cover the parts that touch an RIA's technology and data. Each point is tied to the date the SEC published it.
Regulation S-P in practice: incident response
The FY2027 priorities (released October 23, 2026) say examiners will review whether firms have reasonably designed policies and procedures covering administrative, technical and physical safeguards for customer information, as Regulation S-P requires.
Under the amended rule, the SEC said staff will evaluate the firm's response program for unauthorized access to or use of customer information. In plain terms, an examiner wants to see:
A written incident response plan that names who does what, including who contacts outside counsel and who brings in forensics.
How the firm detects unauthorized access, contains it, and decides whether customer information was involved.
Records showing the plan was reviewed and tested, such as a tabletop exercise with notes.
A plan that sits in a folder and has never been walked through is the most common gap we see.
Client notification procedures
The same FY2027 section (October 23, 2026) calls out customer notification procedures by name. That means the SEC wants to see how your firm decides that notice is required, who drafts it, who approves it, and how it is delivered within the amended rule's deadline.
Practical steps:
Keep a notification template your counsel has reviewed.
Document how you determine whether sensitive customer information was, or was reasonably likely to be, accessed or used without authorization.
Keep an up-to-date client contact list you can reach outside of your normal email system, in case that system is the one affected.
If you operate in Texas or Colorado, state breach notice rules can apply at the same time. Our Texas RIA privacy guide and Colorado RIA privacy guide cover how those overlap, and our post on Texas breach notice deadlines explains the state side.
Service-provider oversight
In its FY2027 priorities (released October 23, 2026), the SEC said examiners will review oversight of service providers as part of the Regulation S-P response program. The cybersecurity section of the same document adds that the Division will assess risks from firms' increased use of third-party service providers and shared technologies, and how well firms manage those risks.
For most RIAs, service providers include your IT provider, custodian portals, CRM, financial planning software, document storage and email platform. Examiners will want to see:
A current list of the providers that store or can access customer information.
Contract language or written terms requiring the provider to notify you quickly if they have a breach that affects your clients' information.
Some evidence of due diligence, such as a security questionnaire or review notes.
The FY2027 document (October 23, 2026) also says the Division will look at advisers that use third parties to access client accounts, where existing controls may not be enough to protect client assets and data.
If you want to know what examiners typically ask about your IT provider, see what SEC examiners ask your IT provider.
For day-to-day document controls examiners may ask about next, see what Copilot can see and ShareFile vs SharePoint for client portals.
Regulation S-ID and account takeover
The FY2027 priorities (released October 23, 2026) say examiners will review Regulation S-ID policies and procedures, focusing on how firms identify, detect and respond to red flags of identity theft, particularly during customer account takeovers and fraudulent transfers. The SEC added that it will assess whether firms are updating their Identity Theft Prevention Program for emerging risks, such as AI and stolen credentials.
What that looks like day to day:
Call-back verification on a known number before any change to wire instructions, addresses or account contacts.
Phishing-resistant sign-in for staff, so a stolen password alone can't open an account. Our guide to phishing-resistant login for wealth firms explains the options.
A documented review of your Identity Theft Prevention Program that mentions current threats, not just the threats from when it was first written.
For the wire side of account takeover, see how wealth firms stop wire fraud.
AI phishing and deepfakes
This is the newest item. In its FY2027 priorities (released October 23, 2026), the SEC said threat actors are using advanced AI (the document calls it "super intelligence") to automate and accelerate attacks, making them harder to detect. Examiners will look at how firms assess and prepare for these threats, naming AI-generated phishing messages and synthetic or deepfake voice and video used for social engineering.
How to prepare:
Update staff training to include realistic AI-written emails and voice calls that sound like a client or a partner. See our post on phishing training for RIA staff.
Set a rule that no money movement or account change is approved on voice or video alone.
Watch for newer tricks that bypass multifactor sign-in, such as device code phishing and QR code phishing.
If your firm uses AI tools, document which tools are approved and what client data they may touch. The SEC also said (October 23, 2026) that it is paying closer attention to how firms use AI in research, client communications and operations.
What to prepare before your next exam
Based on the FY2027 priorities (released October 23, 2026), a sensible prep list for an RIA is:
Written incident response plan under amended Reg S-P, with named roles and a dated tabletop exercise.
Client notification procedure and a counsel-reviewed template.
Service-provider inventory with breach notice terms and due diligence notes.
Updated Identity Theft Prevention Program that addresses account takeover, stolen credentials and AI.
Training records that include AI phishing and deepfake scenarios.
Access controls and account management evidence: who has access to what, and how access is removed when staff leave.
Backup and recovery evidence, since the SEC (October 23, 2026) listed response and recovery from incidents such as ransomware as part of its cybersecurity review. Our business continuity page covers what that involves.
How 24uNet helps
We work with SEC-registered advisers on the technology side of Reg S-P and Reg S-ID: incident response plans and tabletop exercises, Microsoft 365 account takeover defense, vendor reviews and staff training. Learn more about our cybersecurity for financial services, or request a network security review.
Frequently asked questions
When did the SEC release the FY2027 examination priorities?
The SEC's Division of Examinations released its fiscal year 2027 priorities on October 23, 2026, in press release 2026-109.
Does the FY2027 list mention Regulation S-P?
Yes. The FY2027 priorities (October 23, 2026) say examiners will evaluate response programs for unauthorized access to customer information, including client notification procedures and service-provider oversight, under the amended rule.
What does the SEC say about Regulation S-ID?
The FY2027 priorities (October 23, 2026) focus on red flags of identity theft during account takeovers and fraudulent transfers, and whether firms are updating their Identity Theft Prevention Program for AI and stolen credentials.
Is AI phishing really an exam topic now?
Yes. In the FY2027 priorities (October 23, 2026), the SEC named AI-generated phishing and deepfake voice and video as threats it expects firms to assess and prepare for.
Do I need a separate plan for my vendors?
Not a separate plan, but your incident response program should cover how you oversee service providers and how they notify you of a breach. The FY2027 priorities (October 23, 2026) list service-provider oversight as part of the Reg S-P review.
Is this list everything examiners will review?
No. The SEC stated (October 23, 2026) that the priorities are not exhaustive and may change during the year.
Source: SEC press release 2026-109 and "Examination Priorities: Fiscal Year 2027," SEC Division of Examinations, October 23, 2026. This post is general information, not legal advice.
Comments