SEC exam priorities drop AI for super intelligence and target deepfake phishing

The SEC's new exam list says super intelligence, not AI

The US Securities and Exchange Commission has published its examination priorities for the 2027 fiscal year, and the term artificial intelligence is gone from it. The 20-page report from the Division of Examinations, released on 23 October, refers to the technology as super intelligence, abbreviated SI. That abbreviation appears 11 times in the FY2027 report. Neither AI nor artificial intelligence appears at all. Last year's edition used AI throughout.

The change follows Executive Order 14434, which tells federal agencies to use the new name. We have already seen it rewrite State Department style rules and reach into Treasury's proposed outbound investment rules. The SEC is an independent agency, but its staff have now adopted the same wording in one of the most closely read documents in US financial compliance.

The substance matters more than the label. Under the new name, examiners will spend the next year looking at how investment advisers, broker-dealers and other registrants use the technology, and at how well they defend themselves and their customers against attackers who use it.

Where super intelligence shows up in the report

The report's introduction says registrants are increasingly building SI into their businesses. Its examples include generative SI tools for research, drafting, coding and client communications, as well as advisory and portfolio management, compliance monitoring and surveillance. As those tools become more embedded, the division says it is "intensifying its efforts to understand how the technologies influence outcomes" and whether firms still comply with existing obligations, which it calls technology-neutral.

In other words, the SEC is not writing new SI rules here. It is telling firms that fiduciary duty, best interest obligations, anti-money laundering rules and recordkeeping still apply when software does part of the work.

The division will also prioritize examinations of firms' policies and procedures for monitoring SI, including its use in fraud prevention and detection, back-office operations, compliance with anti-money laundering and Regulation Best Interest obligations, and trading. Under Regulation SCI, which covers the systems of exchanges and other key market infrastructure, examiners will look at emerging trends that the report lists as SI, the tokenization of securities, extended trading hours and quantum computing.

Deepfake voices and SI-written phishing

The sharpest new language is about attackers. In its section on emerging financial technology, the report says threat actors are using SI "to automate and accelerate cyberattacks, making those attacks more efficient and harder to detect." Examiners will check how firms have assessed and prepared for SI-related attacks that could hit them or their customers, naming "SI-generated phishing messaging and synthetic or deepfake voice and video used for social engineering."

That is more specific than last year. The FY2026 report said the division would look at how firms prepare for attacks associated with AI and polymorphic malware, which can change its code to avoid detection. The new wording moves the focus to the human side of fraud: a cloned voice on a call to a branch, or a convincing email that asks an adviser to move a client's money.

Identity theft rules get a matching update. Under Regulation S-ID, examiners will look at how firms respond to red flags during account takeovers and fraudulent transfers, and whether their identity theft prevention programmes have been updated for emerging risks, "such as those related to SI and stolen credentials." Under the amended Regulation S-P, whose compliance date has now passed, examiners will move from checking preparations to testing incident response, customer notification and oversight of service providers.

That ties in with a problem banks are already dealing with. This week Wells Fargo rewrote its online banking terms so that anything an AI agent does with a customer's login counts as the customer's own instruction, while big US banks block outside agents. The SEC report does not mention agents by name, but its focus on stolen credentials and account takeovers covers the same ground.

The AI-washing line is gone

One sentence from last year did not survive. The FY2026 report said the division would "review for accuracy registrant representations regarding their AI capabilities or AI." That was the SEC's examination version of a crackdown on AI washing, where firms overstate how much they use the technology to attract clients. The SEC brought enforcement cases on that theme in 2024.

The FY2027 report has no matching sentence about SI claims. What remains is a general test for automated investment tools and trading algorithms. Examiners will check whether (1) representations are fair and accurate, (2) operations and controls match what firms tell investors, and (3) algorithms produce advice consistent with investors' profiles or stated strategies. The division says it will prioritize firms offering automated advisory services and recommendations.

The general test still catches a firm that exaggerates what its software does. But the absence of a named AI-washing check fits the current SEC's lighter-touch approach to new technology, which Chairman Paul Atkins has favoured since taking over in 2025.

Everything else on the list

Super intelligence is one of eight focus areas in the SEC's announcement, and most of the report is about familiar issues. The others are investment advisers' fiduciary duties and conflicts of interest, retail investor protection around complex and illiquid products, private funds and private credit, broker-dealer financial responsibility and anti-money laundering, operational resilience and cybersecurity, market infrastructure changes such as Treasury clearing reforms and tokenization, and oversight of self-regulatory organizations.

The division oversees more than 34,000 registrants. "Examinations are one of the Commission's most important tools for promoting compliance with the federal securities laws and helping protect investors," Atkins said in the release. Keith Cassidy, the division's director, said the markets "continue to evolve rapidly, and the examination program must evolve with them."

The list arrived earlier than usual. InvestmentNews noted that it came out a little over three weeks earlier in the calendar than last year's, which was delayed by a federal government shutdown. The report itself says it represents the views of the division's staff and is not a rule or a statement of the Commission.

The SEC will use SI on its own examinations

The report also describes the division's own plans. It says there is a sustained effort to integrate SI "responsibly" into examinations and risk assessment, as part of a modernization project that aims to automate manual and duplicated steps. The division wants SI-supported tools to help spot patterns and risks across complex datasets, "supplementing, but not replacing, staff judgment."

That matches what other financial watchdogs are doing. The Financial Stability Board's sound practices for banks also stress that people stay accountable when firms hand work to models. For registrants, the practical message is that an examiner may soon be using the same kind of tool to read their records.

What compliance teams are taking from it

Compliance consultants quoted by WealthManagement.com focused on how widely the technology now spreads through a firm. Lori Weston, head of compliance at STP Investment Services, said oversight has to reach beyond approved vendors, because AI is "continually embedded" in third-party software. She said chief compliance officers should also review staff who use personal AI accounts for business, which raises recordkeeping and Regulation S-P issues.

Robert Baker of ACA Group said examiners are changing how they approach Regulation S-P now that its compliance date has passed, and will look at whether firms have actually implemented incident response, customer notification and service provider oversight.

The name change may cause small headaches of its own. Firms that write "AI" in their policies will need to map that onto the SEC's "SI" when responding to document requests, and the term has not been adopted outside US government. When the US pushed for it at the IMF, the IMF's steering committee settled on neither term. For now, the SEC's examiners are asking the same questions about the technology as before, under a different name, with more attention on deepfakes and phishing.