Dechert Cyber Bits

SEC Highlights Cyber and Emerging Technologies as 2027 Exam Priorities

On October 23, 2026, the Securities and Exchange Commission (“SEC”) Division of Examinations (“EXAMS”) announced its annual Examination Priorities for 2027. The priorities identify areas EXAMS believes present risks to investors or the broader market, and were created based on developments in the market, concerns among investors, and emerging trends, among other considerations.

Notably, among others, EXAMS identified the following areas of focus:

• Cybersecurity, information security, and operational resiliency, with a focus on safeguarding customer information. EXAMS noted that it will “review firms’ policies and procedures regarding governance practices, data loss prevention, access controls, account management” and incident response, with a particular emphasis on “risks associated with registrants’ [] use of third-party service providers.”
• Emerging technologies, including the use of super intelligence (“SI”) in business operations, fraud prevention, and investment services. EXAMS specifically called out increased risks posed by threat actors’ use of SI to automate cyberattacks, and the sophisticated use of deepfakes and synthetic voice and video to execute social engineering campaigns.
• Compliance with Regulation S-ID and Regulation S-P. EXAMS will focus on whether firms have developed and implemented policies and procedures to comply with Regulation S-P, and will evaluate incident response programs. EXAMS will also look at “whether firms are updating their Identity Theft Prevention Program[s] to address emerging risks,” including those related to SI.

Takeaway: The SEC has routinely highlighted cybersecurity as an annual examination priority. Given the risks posed by threat actors’ use of AI (what the SEC calls SI), and the fact that 2027 will be the first full year that all SEC-registered advisers and investment companies will be required to comply with the SEC’s amendments to Regulation S-P, we anticipate that EXAMS will be taking a closer look at firms’ actual practices, and will not be satisfied by policies and procedures that say the right thing but which are not implemented, monitored and routinely tested in practice.

UK Financial Regulator Issues AI Guidance

The UK financial services regulator, the Financial Conduct Authority (“FCA”), has published new guidance on AI deployment for financial services firms.

The guidance addresses the FCA’s expectations for deploying AI in a way that complies with certain existing general duties of financial firms, in particular: (a) the “Consumer Duty” that applies in relation to regulated activities in connection with products and services offered to retail customers; (b) FCA rules on governance and accountability; and (c) operational resilience requirements.

The guidance includes examples of good practice and poor practice based on the FCA’s industry engagement and supervisory work, as well as learnings from the FCA’s ‘AI Lab’ initiative (which included an NVIDIA-backed sandbox program). The FCA adopts a flexible and risk-based approach in its guidance, using the examples to show what strong compliance can look like without establishing prescriptive requirements. The FCA also indicates that it has differing expectations depending on a firm’s size and activities.

Takeaway: As well as providing a useful resource for financial firms, the guidance highlights the divergence between the UK’s and the EU’s approaches to regulating AI and technology in the financial services sector. Since Brexit, the EU has passed significant AI-specific legislation in the form of the EU AI Act, as well as financial sector-specific legislation targeting IT resilience in the form of the Digital Operational Resilience Act. The UK has not passed AI-specific legislation and UK regulators, such as the FCA and Information Commissioner’s Office, are utilizing existing rules and powers to regulate AI.

FTC Brings Case Against Corporate and Individual Defendants Alleging Government Impersonation 

On October 22, 2026, the Federal Trade Commission (“FTC”) filed a Complaint for Permanent Injunction, Monetary Judgment, and Other Relief (the “Complaint”) against GovAssist LLC (“GovAssist”), Entry LLC (“Entry”), and their sole member, Scott Zuckerman (“Zuckerman”)(collectively, the “Defendants”) for alleged violations of consumer protection laws arising out of the Defendants’ passport and travel-related services. The Complaint alleges, among other things, that the Defendants: (i) impersonated government entities; (ii) misrepresented their passport services; (iii) posted fake consumer reviews; and (iv) deceived customers into providing bank account and routing number information. The Complaint alleges violations of Section 5 of the FTC Act, the FTC’s Impersonation Rule, and Section 521 of the Gramm-Leach-Bliley Act (“GLBA”).

Specifically, the FTC alleges that, since at least October 2023, Defendants ran Google search ads designed to appear alongside or above the government’s own results when people searched for information about applying for new passports, and that the ads falsely led consumers to believe they were dealing with the federal government. Once on the Defendants’ sites, the FTC alleged customers were quoted deceptive prices, presented with false expedited delivery timelines, and subjected to bait-and-switch tactics. Like the ads, the FTC said the websites were allegedly designed to make customers think they were interacting with a government agency. At the time of the allegations, Zuckerman was subject to a 2021 order entered in a prior, unrelated FTC case. The FTC is seeking a permanent injunction, monetary relief, and other remedies.

Takeaway: The FTC is aggressively targeting what it has alleged is an intentional deceptive business operation involving federal government impersonation. Notably, the FTC has again brought allegations under Section 521 of the GLBA in reliance on its expanded interpretation that Section 521 applies to companies (whether or not they are financial institutions) that make false or deceptive statements to induce an individual to provide financial account or payment information. We expect to continue to see the FTC use Section 521 as a mechanism to seek consumer redress.

Dechert Tidbits 

Federal Task Force Takes on AI Safety

A government task force, led by Director of National Intelligence Jay Clayton, will work with the Department of Justice and Federal Trade Commission to identify safety standards for AI developers. The other members of the Task Force include Scott Kupor (Director, Office of Personnel Management), Andrew Ferguson (Chairman, Federal Trade Commission), and Emil Michael (Defense Undersecretary for Research and Engineering). During its 120-day term, the Task Force will identify AI-related risks and coordinate safety-related enforcement, among other responsibilities.

Statement from the European Data Protection Board Addresses Smart Glasses

In a recent statement, the European Data Protection Board (“EDPB”) weighed in on the debate surrounding smart glasses. The statement highlights concerns with the covert processing of personal data that is associated with smart glasses. The EDPB also indicates that the GDPR exemption for purely personal or household activity will be narrowly construed.