SEC FY2027 Exam Priorities: Deepfakes Are a Named Cyber Exam Item

The SEC Will Examine Your Defenses Against Deepfakes

The SEC's Division of Examinations will test whether investment advisers, broker-dealers, and other registrants have prepared for AI-enabled cyberattacks, according to the Fiscal Year 2027 examination priorities announced on October 23, 2026 in Press Release 2026-109. As Law360 reported, the Commission plans to scrutinize how financial firms guard against these attacks. The priorities reach the Division's more than 34,000 registrants.

The SEC's FY2027 priorities document does not say "artificial intelligence" in this passage. It says "super intelligence," or SI, and it directs examiners to registrants' assessment of and preparation for SI-related cyberattacks, such as SI-generated phishing messages and synthetic or deepfake voice and video used for social engineering.

What the Priorities Are, and What They Are Not

The priorities are an annual staff report that guides risk-based examinations. They are not a rule, not a proposed rule, and not an enforcement action, and they do not allege that any firm violated the law. No new compliance deadline or penalty comes with them.

That distinction cuts both ways. There is no new rule to comply with, which means examiners will measure your deepfake readiness against obligations you already carry. Troutman's analysis also stresses that the priorities are not an exhaustive list of what examiners may review.

WilmerHale notes that neither SI nor cybersecurity is a new exam priority and that FY2027 largely builds on FY2026.

Why the Synthetic Voice Problem Lands on Operations

For an AI-forward adviser or fintech, the instinct is to treat AI governance as a question about models you build or buy. The SEC's framing here is different. It is about AI that attackers use against you.

The distinction that matters

Using AI is a governance question. It concerns disclosure, supervision, and how your own tools make decisions.

Being attacked with AI is a controls question. It concerns whether a convincing cloned voice of your CEO, or a flawless phishing email, can move client money or extract client data.

The second category is where the priorities point examiners. The Division said in the FY2027 priorities document that it will review policies and procedures on governance, data loss prevention, access controls, account management, and incident response and recovery, and will assess risks from increased use of third-party service providers and shared technologies.

Troutman reports that Regulation S-P safeguards and incident-response requirements and Regulation S-ID are examination targets, with particular attention to account takeovers, fraudulent transfers, and stolen credentials. Those are precisely the outcomes a deepfake call is designed to produce.

What Your Leadership Team Should Decide This Quarter

The work here is assigning owners and producing evidence an examiner can read.

Decisions and owners

• Test your verification chain against a cloned voice. If a phone or video request from a senior executive can change wire instructions without an out-of-band callback, that is the gap to close first.
• Name deepfakes in your written procedures. Policies that describe phishing generically may not show that the firm assessed SI-generated attacks specifically.
• Map Reg S-P and Reg S-ID to the attack. Confirm your incident-response program and identity-theft red flags cover deepfake-enabled account takeovers and fraudulent transfers.
• Pull vendors into scope. Ask your custodians, administrators, and help-desk providers how they authenticate callers.
• Document the assessment. Keep a written record of how the firm evaluated SI-generated phishing and deepfake voice and video risk, and which controls it changed as a result, so an examiner can read it.

Ask your chief compliance officer to report on each item to the board or management committee before your next annual review.