What do the SEC's FY2027 exam priorities say about Reg S-P?

What do the FY2027 exam priorities say about Regulation S-P?

They say examiners will test whether your program under the Regulation S-P amendments works in practice. The SEC's Division of Examinations released its Fiscal Year 2027 Examination Priorities on October 23, 2026, and the Regulation S-ID and S-P section says examinations will focus on whether firms have "developed, implemented, and maintained reasonably designed policies" covering administrative, technical, and physical safeguards for customer information.

The same section says staff will evaluate response program policies and procedures for unauthorized access to or use of customer information, "including customer notification procedures and oversight of service providers." Examiners will also review how firms address operational risk, including technology risks, as part of safeguarding customer information.

For a CCO, the practical reading is short: the amended rule is no longer new, so the exam question has moved from "did you adopt it" to "show me it running."

Why do the Regulation S-P amendments matter more in this exam cycle?

Because every covered firm is now past its compliance date. Under the SEC's small entity compliance guide, larger entities had to comply with the 2024 amendments by December 3, 2025, and smaller entities by June 3, 2026. FY2027 is the first exam cycle in which every RIA, broker-dealer, and dual-registered firm in scope has had the full rule in force.

That changes what an examiner can reasonably expect. A policy adopted in May 2026 with no training records, no vendor follow-up, and no test of the notification process reads very differently in an exam than it did a year ago.

Which parts of the rule are examiners most likely to test?

The priorities name three: the safeguards themselves, the incident response program, and service provider oversight. Each maps to a specific paragraph of 17 CFR 248.30.

• Safeguards (248.30(a)(1) and (a)(2)): written policies and procedures that address administrative, technical, and physical safeguards for customer information.
• Incident response (248.30(a)(3)): a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.
• Customer notification (248.30(a)(4)): notice to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, as soon as practicable but not later than 30 days after the firm becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, unless the firm determines notice is not required under the rule's standard.
• Service providers (248.30(a)(5)): policies and procedures to oversee service providers, including a requirement that they notify the firm as soon as possible, but no later than 72 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system they maintain.

The priorities document repeats the words "customer notification procedures" and "oversight of service providers," which is a strong hint about where request letters will go.

What does the SEC mean by "super intelligence"?

It is the term the Division uses this year for advanced AI. The FY2027 document says "registrants are increasingly incorporating super intelligence (SI) into their businesses," and the cybersecurity section says threat actors are using SI to automate and accelerate cyberattacks.

The Division says it will look at how firms are preparing for SI-related threats, including SI-generated phishing and synthetic or deepfake voice and video used for social engineering. It will also review policies for monitoring SI, including its use in fraud prevention and detection.

This matters for Reg S-P because the most likely path to unauthorized access at a small firm is still a person being tricked. A deepfake voice call that talks an operations associate into resetting a client's credentials is a customer information incident, and the response program has to handle it.

How does Regulation S-ID fit in?

The priorities pair the two rules in one section. For Regulation S-ID, the Division says it will focus on how firms identify, detect, and respond to red flags, "particularly during customer account takeovers and fraudulent transfers." It also says firms should be updating their Identity Theft Prevention Program for emerging risks such as those related to SI and stolen credentials.

In practice, the two programs share the same evidence. The alert that flags a suspicious change of address under S-ID is often the same event that starts an incident assessment under S-P. Examiners will notice if the two documents describe different processes for the same event.

What else in the cybersecurity section touches customer information?

The cybersecurity section says examinations will review governance practices, data loss prevention, access controls, account management, and response and recovery protocols for cyber-related incidents, including ransomware attacks. It also says the Division will assess risks from registrants' increased use of third-party service providers and shared technologies.

None of that is new language for compliance teams, but read together with the Reg S-P section it describes a single exam conversation: who can reach client data, how you would know if someone shouldn't have, what you would do in the first 30 days, and which vendors are part of that story.

What should a CCO do this quarter?

Start with the evidence an examiner would ask to see, then close the gaps that evidence exposes. The rule does not prescribe a checklist, so treat the list below as a starting point to adapt to your firm's size and business.

• Pull your written incident response program and walk one realistic scenario through it, such as a deepfake voice call that leads to a credential reset. Record who decided what, and when.
• Confirm your customer notification procedure names who makes the "notice or no notice" decision and where that decision is documented.
• List every service provider that maintains a customer information system and confirm each contract or written arrangement addresses the 72-hour notice. Follow up in writing where it does not.
• Match your Reg S-ID red flags to your Reg S-P response steps so the two programs describe the same handoff.
• Check that the records the rule requires are being kept. Advisers should look at Rule 204-2(a)(25); broker-dealers should look at the parallel Rule 17a-4 provision. Our guide to Reg S-P recordkeeping under Rule 204-2 lists the records and retention periods.
• Brief staff on SI-driven social engineering, and keep the attendance record.

Are the published priorities the only things examiners will look at?

No. The Division says its priorities are not an exhaustive list and that exams can address other areas as risks emerge. Treat the Reg S-P section as the minimum to prepare for.

For a broader view, see our reading of the full FY2027 priorities for RIAs, what examiners have asked for under Reg S-P, and how to update vendor contracts for the 72-hour service provider notice.

How s90 helps

s90 works with RIAs, broker-dealers, and dual-registered firms in Los Angeles and Orange County to keep Reg S-P evidence current: incident response testing, service provider tracking, and the technical safeguards examiners ask about. Our agreements include 72-hour breach notification and 24-hour evidence production, so our part of your service provider oversight is already in writing. If you want a second set of eyes on your program before your next exam, we're happy to talk.