FINRA 2026: GenAI, Crypto, Cyber Compliance Unveiled

Quick Summary

• The 2026 Annual Regulatory Oversight Report from FINRA, as analyzed by Sidley Austin LLP, lands early and hard: nearly 90 pages that reset the bar on how broker-dealers must govern cybersecurity, GenAI, data privacy, and vendor risk in an environment of tightening SEC rules and escalating cyber-enabled fraud.
• FINRA explicitly treats cybersecurity as a core operational and compliance risk, detailing attacker tradecraft from ransomware and deepfake-enabled fraud to small-cap manipulation and cryptoasset abuse, and tying all of it to concrete expectations for controls, surveillance, and governance.
• Third-party and technology risk management move to the center: FINRA now expects mature supervision over outsourced IT, cybersecurity, AML and GenAI usage, including identity and access management, logging, resiliency, and cloud governance that can withstand cross-firm outages and regulatory scrutiny.
• CISOs and risk leaders at broker-dealers should use the 2026 Report as a de facto control baseline: integrate GenAI governance with Reg S-P obligations, harden data protection and training, industrialize vendor due diligence, and align crypto, AML, and surveillance programs with the expanded expectations before they show up in an exam or enforcement action.

FINRA’s 2026 Report: Cyber, GenAI and Crypto Move From Edge Cases to Exam Basics

FINRA did something subtle but important on December 9, 2025: it pulled its 2026 Annual Regulatory Oversight Report forward in the calendar, explicitly “in response to feedback from member firms.” For broker-dealers, that’s code for: you have no excuse to be surprised when these topics show up in your next exam.

The report, as reported here in Sidley Austin LLP’s analysis, runs nearly 90 pages and is framed as guidance — but FINRA also makes clear this is how it interprets its rules and how it will assess compliance. The core message in the takeaways is blunt:

• New technologies bring new risks, and governance and supervision must keep pace.
• Cybersecurity must be prioritized.
• AML testing and customer due diligence stay in the crosshairs.
• Manipulative trading, vendor management, communications and sales, and best execution remain evergreen exam topics.
• Key FINRA rules apply even when an activity doesn’t “look” like a traditional security — including crypto.
• Firms must keep up with evolving financial management and reporting rules for new asset types, particularly crypto.

The most notable shift: GenAI and digital assets are no longer sidebars; they are integrated into core expectations across surveillance, customer protection, AML, and technology governance.

On GenAI, FINRA now expects firms to:

• Assess regulatory compliance obligations before deploying GenAI.
• Establish governance frameworks to supervise GenAI usage.
• Implement controls to address hallucinations, bias, cybersecurity risks, and threat-actor use of AI.
• Maintain ongoing human monitoring of model outputs.
• Develop oversight for autonomous AI agents, including tracking actions and restricting access.

For crypto, FINRA pointedly diverges from the SEC’s latest examination priorities by keeping digital assets as an explicit examination focus. It reiterates expectations around:

• Due diligence on unregistered offerings of cryptoassets, including registration exemptions, risk factors, conflicts, initial development teams, token supply, tokenomics, and cybersecurity risks to underlying blockchain protocols.
• Risk-based, on-chain fraud and AML reviews for any acceptance, trading, or transfers of cryptoassets, backed by documented procedures.
• Clear customer disclosures on differences between brokerage accounts and affiliated crypto accounts — especially around Securities Investor Protection Corporation coverage, regulatory oversight, supervision, and complaint avenues.

For CISOs and compliance leaders, this is effectively a public checklist of what “reasonable” looks like now for regulatory-aligned cybersecurity programs in the broker-dealer world.

The Threat Model FINRA is Actually Regulating Against

Under Financial Crimes Prevention, FINRA drops the marketing gloss and describes the threat landscape it sees in real exams and incidents. Cybersecurity is framed as both an operational and compliance risk, tightly coupled to SEC Regulation S-P amendments that now mandate policies to detect, respond to, and recover from unauthorized access to customer data.

FINRA lists the attack vectors it expects firms to be ready for:

• Ransomware and extortion attacks compromising firm systems and holding data for ransom.
• Data breaches leaking confidential firm and customer information.
• Social engineering via phishing, smishing, and increasingly QR-code “quishing.”
• New account fraud and account takeovers based on stolen or falsified identity data.
• Imposter sites and social accounts spoofing firms or regulators to steal funds or credentials.
• Insider threats where employees misuse legitimate access.
• GenAI-enabled fraud, from deepfakes and fake IDs to polymorphic malware and other AI-driven cybercrimes.

On the anti-money-laundering side, FINRA expects risk-based compliance programs that not only detect internal AML red flags but proactively address external fraud attempts against customers. That includes training associated persons and clients on how scams work and having defined response plans for when customers are victimized.

Supervisory procedures (WSPs) must clearly delegate AML responsibilities to the business units or individuals best positioned to see suspicious behavior. Independent AML testing and periodic evaluation of alerts and exception reports are not optional; they are table stakes.

Market manipulation remains another “evergreen” obsession. FINRA highlights deficiencies in surveillance for spoofing, layering, wash trades, prearranged trades, marking the close, small-cap fraud, front-running, and non-bona-fide trading. The issues are familiar to most security operations leaders because they rhyme with SIEM and UEBA failures:

• Surveillance systems not capable of detecting the full set of schemes.
• Controls and thresholds not tailored to specific securities, accounts, or evolving business models.
• No periodic reassessment of parameters as markets or customers change.
• Failure to correlate activity across time, accounts, and alerts for broader patterns.
• Understaffed or undertrained teams delaying or mis-handling alert reviews, with poor documentation.

On the operations side, FINRA sharpens its focus on vendor management. It expects supervisory systems — backed by WSPs — capable of overseeing outsourced activities in line with securities laws, FINRA rules, and Regulation S-P. This is not abstract: FINRA notes a rise in cyberattacks and outages at third-party providers that ripple across multiple firms because of highly concentrated vendor dependencies.

The expected practices are concrete:

• Thorough initial and ongoing due diligence on vendors, especially those handling IT, cybersecurity, and AML.
• Assessment of vendors’ GenAI usage and confirmation that contracts protect sensitive data and enforce adequate data-protection controls.
• Maintaining inventories of vendor systems, software versions, and all firm data accessed or stored.
• Assessing and monitoring the impact of vendor cyber incidents, including fourth-party risk.
• Implementing vendor risk management policies, risk assessments, contingency plans, and incident-response testing that explicitly include vendors.
• Secure contract termination: return or destruction of data, timely revocation of access, and validation of clean separation.

Technology management expectations go deeper still: firms should have governance with clear accountability and documented processes for change, incident, and problem management in WSPs; regular technology risk assessments; AI/LLM model-risk frameworks; least-privilege access with multifactor authentication and comprehensive access reviews; encrypted off-network backups with tested restores; controlled branch-office infrastructure; standardized configuration management; deliberate cloud adoption; log collection and retention aligned to regulatory and business needs; and real IT resiliency testing for both firm and vendor systems.

Against this backdrop, the usual broker-dealer issues — CAT reporting, best execution and Rule 606 disclosures, fixed income pricing, extended hours, net capital, OCC capital charges, liquidity risk management, and customer asset protection under Rules 15c3-1 and 15c3-3 — now interlock with cyber in very practical ways. Misreported counterparties, incomplete liquidity data, or weak reserve computations don’t just create prudential risk; they signal weak data governance, which is precisely what attackers and regulators both home in on.

What CISOs Should Change Now: From “Security Program” to Reg-Driven Control Fabric

For CISOs and security leaders at broker-dealers, the 2026 FINRA Report is not just a compliance memo; it’s an architecture brief. The exam program is converging on four control pillars that need to be explicitly designed and evidenced.

1. Treat customer data as a regulated critical asset

• Map all customer data flows against Regulation S-P obligations and FINRA expectations, including incident detection, response, and recovery. This is the starting point for serious data protection in the financial sector.
• Align DLP, access controls, logging, and backup/restore testing with that map. If you can’t prove where customer data resides, who touches it, and how you recover it, assume it will show up on the exam findings list.
• Make sure insider risk and social engineering defenses (phishing, smishing, quishing) are integrated with incident response and AML escalation paths.

2. Industrialize vendor and GenAI governance

• Elevate third-party risk into the same governance forum that owns market, liquidity, and operational risk. Vendor outages and breaches are now systemic events in FINRA’s worldview.
• Standardize vendor intake: security questionnaires that explicitly cover GenAI usage, data residency, subprocessor chains, and incident-reporting SLAs, backed by contractual teeth.
• Build a real-time inventory of vendor dependencies and criticality mapping to business services. Tie this to your IT resiliency testing and your business continuity plans.
• For internal and vendor-hosted GenAI/LLM use, implement a lightweight but real model risk framework: approved use cases, prohibited inputs (e.g., PII, nonpublic information), human-in-the-loop review, and logging of model outputs that affect customers or markets.

3. Fuse AML, fraud, and cyber into a single detection fabric

• Consolidate signals from transaction surveillance, login anomalies, device fingerprints, and identity proofing into joint investigations for account takeover, new account fraud, and GenAI-enabled scams.
• Update WSPs so AML responsibilities are explicitly tied to cyber and fraud telemetry — not just to trade surveillance alerts.
• For cryptoassets, treat on-chain analytics as first-class AML tooling, integrated into case management with clear documentation standards and escalation flows.

4. Rebuild training around real attacker tradecraft

• FINRA’s list of attack vectors is your syllabus. Stop running generic awareness and start scenario-based training on ransomware playbooks, deepfake-enabled executive fraud, QR-code quishing, and imposter-site scams.
• Align staff and customer training with how scams actually unfold in your channels. Update materials at least annually; FINRA will notice stale content, and attackers already have.
• Use this moment to overhaul outdated approaches; modern data security training should look like red-team debriefs, not HR modules.

The useful insight buried in FINRA’s 2026 Report is this: the regulator is quietly codifying what “good” looks like for integrated cyber, fraud, AML, and technology risk. If you’re still running them as parallel programs, you’re already behind. Use this report as your blueprint for a single control fabric that treats GenAI, crypto, third-party risk, and classical broker-dealer obligations as one system — because that’s exactly how your next exam, and your next attacker, will view your firm.