What You Need to Know
FINRA published its 2026 Annual Regulatory Oversight Report on December 9, 2025 — and it remains the operative benchmark against which examiners are measuring your cybersecurity program today. The timing matters: FINRA has also announced a dedicated Financial Crimes and Cybersecurity Conference in August 2026, a signal that cyber risk is not a background priority but an active enforcement focus. Examiners are in the field now, and the Report is the roadmap they are using.
This guidance does not create new rules on its own. But FINRA has been explicit that examiners will treat the 2026 Annual Regulatory Oversight Report — and related guidance — as the benchmark against which your compliance program is measured. If the Report flags a practice as 'effective' and your firm cannot demonstrate it, expect a deficiency letter.
The Regulatory Frame: Rules Already on the Books
Before diving into what FINRA wants to see, it helps to map the guidance to the rules it enforces. FINRA's cybersecurity supervision framework hangs on several existing provisions: Regulation S-P Rule 30 (the Safeguards Rule), which requires written administrative, technical, and physical safeguards to protect customer records and information; Regulation S-ID, which requires firms maintaining covered accounts to implement a written Identity Theft Prevention Program; FINRA Rule 3110, which requires a supervisory system reasonably designed to oversee all firm activities including technology and vendor-supported functions; and FINRA Rule 4370, which mandates a written Business Continuity Plan that must account for technology outages and vendor failures.
For dual-registered RIAs, layer on the Reg S-P amendments that became effective August 2, 2024. The compliance deadlines were tiered by entity size, running from the date of Federal Register publication on June 3, 2024. Larger RIAs — those with $1.5 billion or more in regulatory assets under management — were required to comply by December 3, 2025. Smaller entities had until June 3, 2026. Both deadlines have now passed. If your firm has not yet implemented the amended Reg S-P program — including a written incident response plan and 30-day customer breach notification procedures — you are out of compliance today.
The Threat Landscape FINRA Is Watching
FINRA's guidance is not abstract. The regulator has catalogued the specific attack vectors its examiners are seeing across member firms. The list includes ransomware and extortion events, system breaches involving unauthorized access to confidential firm and customer data, social engineering schemes (phishing, smishing, and quishing), new account fraud, account takeovers, imposter sites, and insider threats. GenAI has added a new dimension: FINRA is actively monitoring threats including deepfake audio and video, AI-generated fraudulent documents, polymorphic malware, and 'cybercrime-as-a-service' tools that allow non-technical criminals to launch sophisticated attacks. Relationship investment scams — often initiated via text or social media — are a particular supervisory concern.
FINRA's view is that these threats are not isolated incidents. Examiners are also focusing on systemic concentration risk: many firms rely on the same small set of technology vendors, which means a single vendor compromise can cascade across the industry. FINRA noted more frequent cyber incidents and outages at vendors and stressed the importance of firms understanding where those concentrations exist in their own supply chains.
The Vendor Risk Gap Is the Biggest Exam Risk
The single area generating the most exam findings right now is third-party vendor risk. FINRA's supervisory expectation is straightforward: firms must maintain a supervisory system reasonably designed to oversee activities performed by vendors, including technology, AML monitoring, cybersecurity functions, and key back-office operations. That is FINRA Rule 3110 applied to your vendor relationships — not just your employees.
What FINRA is finding in exams is that many firms cannot demonstrate they have met this standard. The effective practices the regulator has identified include: conducting initial and ongoing due diligence on third-party vendors supporting mission-critical systems; assessing how third-party vendors use GenAI in their products or services; maintaining an inventory of all vendor-provided services, hardware, software, and systems in use; keeping a separate inventory of the data types that vendors access or store; assessing the potential impact of a cybersecurity incident or outage at each critical vendor; and monitoring vendors on an ongoing basis for vulnerabilities or data breaches. Contracts matter too — FINRA expects firms to have contractual limits on how vendor tools may consume and use firm and customer data, and to confirm that firm data is returned or destroyed upon contract termination.
GenAI in Your Firm: The Recordkeeping Angle
If your firm has deployed any GenAI tools — for summarization, client communication drafting, research synthesis, or anything else — FINRA expects your supervisory framework to cover them. The 2026 Regulatory Oversight Report introduced a dedicated GenAI section for the first time, listed as 'GenAI: Continuing and Emerging Trends' and marked new for 2026, and examiners will be asking about it. Specifically, FINRA expects firms to address GenAI use cases and model risks; ensure that AI-generated or AI-assisted communications remain fair and balanced under FINRA Rule 2210; capture AI-enabled communications within the firm's books and records under applicable Exchange Act recordkeeping rules; and include GenAI considerations in technology change management. If your written supervisory procedures (WSPs) do not mention GenAI, that is a gap worth closing before your next exam cycle.
What the FINRA UBS Fine Signals
Also in August 2026, FINRA fined UBS Financial Services Inc. $20 million for anti-money laundering violations, finding that UBS Financial again failed to establish and implement an AML compliance program reasonably expected to detect and cause the reporting of suspicious transactions involving foreign currency wires. AML enforcement and cybersecurity supervision are increasingly intersecting: FINRA expects cyber and IT staff to coordinate with AML staff on cybersecurity concerns and to report suspicious activity through appropriate channels, including filing SARs following cyber events where appropriate. The UBS action is a reminder that siloed compliance functions — where cybersecurity sits separately from AML with no formal coordination protocol — create exam and enforcement exposure on both fronts.
FINRA CORE: A Tool You Should Be Using
In 2025, FINRA launched its Cyber & Operational REsilience (CORE) program as a component of its FINRA Forward initiative. CORE identifies, assesses, and shares cyber and technology risk intelligence directly with potentially affected member firms, delivering actionable insights and mitigation tactics. If your firm has not engaged with CORE — including reporting your critical vendors to FINRA so it can provide targeted alerts — consider doing so. FINRA has also indicated it expects firms to keep it apprised of changes in critical vendors. That is an informal but meaningful expectation — it reflects how integrated FINRA's supervision model has become since it unified Member Supervision, Market Oversight, and Enforcement into a single Regulatory Operations function.
What to Do Now: A Practical Checklist
Use this as a gap-analysis frame before your next internal review or mock exam. First, confirm Reg S-P amendment compliance. Both the December 3, 2025 deadline for larger entities and the June 3, 2026 deadline for smaller entities have now passed. Verify that your incident response program is documented, your 30-day customer notification procedure is written and tested, and your vendor management program requires vendors to notify your firm of breaches within 72 hours. Second, build or update your vendor inventory. Document every third-party provider that touches firm systems or customer data, including what data they hold, whether they use GenAI in their products, and what your contract says about data protection, breach notification, and termination obligations. Third, run a vendor-incident scenario in your next BCP test. FINRA Rule 4370 requires a written BCP; consider whether your most recent test actually modeled a critical vendor outage or compromise, not just an internal system failure. Fourth, review your WSPs for GenAI gaps. If your firm is using any AI-assisted tools, consider adding a section to your WSPs that addresses use cases, communication review, recordkeeping, and change management. Fifth, document AML-cybersecurity coordination. Consider adding a written protocol to your AML program describing how your cyber and IT teams communicate with your AML function when a cyber event may involve suspicious activity, and under what circumstances a SAR should be filed. Sixth, engage with FINRA CORE. Report your critical vendors to FINRA so that your firm receives targeted threat intelligence alerts when those vendors are affected by vulnerabilities or incidents.