SEC puts tokenization in 2027 examination priorities

The US Securities and Exchange Commission has put tokenization into its fiscal 2027 examination priorities, identifying it as a focus for clearing agencies and regulated market systems. The agenda, announced on October 23, places the technology alongside checks on operational resilience, customer information and the controls used by financial firms.

The SEC says its examination programme covers more than 34,000 registrants, including investment advisers, funds, broker-dealers and market infrastructure providers. The priorities describe where staff expect to concentrate their attention. They do not themselves introduce a tokenization rule or approve a digital-asset product.

Where tokenization enters the checks

In the clearing-agency section, the report says examiners will review policies, procedures and controls, with attention to higher-risk activities. Tokenization appears with default management, securities lending, operations, recovery and winding down.

For covered clearing agencies, the programme includes compliance with existing standards governing financial risk, operational risk and governance. Staff will also assess whether an agency has taken corrective action promptly after earlier examination findings. The document connects the next round of reviews to outstanding problems, not only to newly introduced technology.

Another stated priority is compliance with new rules concerning expanded Treasury clearing, clearing-agency governance and recovery or orderly wind-down plans. The report also names straight-through processing by central matching service providers. These are areas selected for examination; the priorities document does not replace the underlying rules or set a new common commencement date for them.

Tokenization of securities also appears in the section on Regulation Systems Compliance and Integrity, known as Regulation SCI. Other identified trends include extended trading hours and quantum computing. Examiners will review reliance on cloud providers and other outside vendors, including how entities manage those risks and identify vendor systems falling within the SCI framework.

The transfer-agent programme separately addresses emerging technology used to perform transfer-agent functions. It retains checks on processing transfers, maintaining records, safeguarding funds and securities, and making filings with the SEC. This brings technology use into the same review as the routine handling and protection of financial records.

Customer information remains in scope

Across different types of market participants, cybersecurity remains a priority. Reviews will cover governance, data-loss prevention, access controls and account management, as well as response and recovery arrangements for incidents such as ransomware attacks. Staff will also assess risks arising from shared technology and increased use of third-party service providers.

Under Regulation S-P, examiners will look at the administrative, technical and physical safeguards used to protect customer information. The report identifies incident-response policies for unauthorised access or use, customer-notification procedures and oversight of service providers. Transfer agents and funding portals also appear in its discussion of checks under the amended regulation.

The Regulation S-ID work will examine how firms identify, detect and respond to warning signs of identity theft, particularly account takeovers and fraudulent transfers. Staff will consider whether prevention programmes are being updated for emerging risks, including stolen credentials.

For automated investment tools and trading algorithms, the report sets out another practical line of inquiry: whether firms describe their services fairly and accurately, whether operations match investor disclosures, and whether algorithmic recommendations fit investor profiles or stated strategies. The programme also covers how firms monitor advanced technology used in trading, compliance and fraud detection.

An examination agenda, not new law

The division says its priorities draw on earlier examinations, market events and discussions with investors, regulated firms, industry groups and other regulators. The list is not exhaustive. Staff can devote resources to other areas and change their focus as new products, risks or investor concerns emerge during the year.

Its leadership message also describes closer coordination with other authorities. An enhanced agreement with the Commodity Futures Trading Commission provides for coordinated examination planning and opportunities for joint or aligned examinations. A separate agreement with the National Futures Association supports coordination where responsibilities overlap; work with FINRA and foreign regulators continues as well.

The report carries an express limitation: it represents examination staff views, has no legal force and creates no additional obligations. The Commission has neither approved nor disapproved its contents. For readers following crypto policy, the concrete development is the published supervisory agenda for tokenization and related systems, not a new exemption from securities law.

This report is an original summary of the SEC Division of Examinations’ FY2027 priorities and its October 23 announcement. SEC information is used under its website redistribution policy. No SEC endorsement is implied.