FINRA Keeps Cyber-Enabled Fraud in the 2026 Compliance Spotlight

FINRA’s 2026 Annual Regulatory Oversight Report keeps cybersecurity and cyber-enabled fraud squarely in view for broker-dealers and other member firms. FINRA identifies cybersecurity incidents as events that can create customer information exposure, financial loss, reputational damage, and operational failures.¹

That framing matters for IT leaders because the cybersecurity program is part of the firm’s supervisory and continuity posture. FINRA points to rules and regulations that may be implicated, including Regulation S-P, Regulation S-ID, FINRA Rule 3110, FINRA Rule 4370, and Exchange Act books-and-records rules.¹

The operational risk is broader than ransomware

Ransomware remains a concern, but the report also calls attention to account takeovers, insider threats, network intrusions, and cyber-enabled fraud.¹ For financial firms, these scenarios often begin with identity compromise or social engineering and end with customer harm, unauthorized transactions, data exposure, or operational disruption.

That means controls need to be layered:

• MFA and conditional access
• privileged access review
• phishing-resistant training
• endpoint detection
• suspicious login monitoring
• customer account change controls
• incident escalation to compliance and supervision

Why evidence matters

In a regulated financial environment, a security alert is not just a technical artifact. It may become evidence for an internal review, exam response, insurance claim, customer communication, or board report.

IT teams should make sure incident tickets record the facts that compliance will need later: affected systems, users, data types, timestamps, containment steps, vendor involvement, root cause, and remediation.

Datapath perspective

The firms that make the strongest progress treat cyber-enabled fraud as an operating model problem. They align IT, compliance, supervision, operations, and client-facing teams around the same escalation thresholds.

For example, a suspicious mailbox rule in Microsoft 365 may look like a minor email-security issue. In a financial firm, it could also indicate attempted invoice fraud, unauthorized customer communication, credential theft, or account takeover preparation.

What to do next

Run a cyber-enabled fraud scenario with IT and compliance together. Use a compromised advisor mailbox or fake client distribution request as the trigger. Track whether the team can identify affected data, pause risky activity, preserve logs, notify the right leaders, and document the final disposition.

That exercise will expose whether the firm’s cybersecurity program is connected to its real compliance obligations.

Footnotes

1. FINRA, “Cybersecurity and Cyber-Enabled Fraud - 2026 Annual Regulatory Oversight Report” ↩ ↩² ↩³