The SEC's Fiscal Year 2027 Examination Priorities List Quantum Computing Under Regulation SCI: What the 23 October 2026 Sentence Means for Exchanges and Clearing Agencies
In the summer of 1998 the SEC did something unusual for a securities regulator. It required broker-dealers to file a form about their computers. Form BD-Y2K asked each firm about its preparations for the change of date at midnight on 31 December 1999, including how far its remediation and testing had progressed. The date change itself passed quietly. The form was an early case of market regulation treating a technology deadline as a question of investor protection.
The quantum transition has no single midnight, and the SEC has written no form for it. On 23 October 2026 it did take a smaller first step. The Division of Examinations' priorities for fiscal year 2027, the annual document that tells registrants where examiners will look, mention quantum computing, which neither of the two previous editions did.
What the SEC's fiscal year 2027 examination priorities say about quantum computing
The press release of 23 October 2026, numbered 2026-109, announces the twenty-page priorities document and quotes Chairman Paul S. Atkins on examinations as "one of the Commission's most important tools." Quantum computing appears once, on page 13, under the heading Regulation Systems Compliance and Integrity. The full sentence reads: "Examinations under Regulation SCI will focus on emerging trends, including SI, tokenization of securities, extended trading hours, and quantum computing." The next sentence adds that the Division will also review how SCI entities rely on cloud and other third-party vendors.
"SI" stands for super intelligence. The document uses the term throughout where earlier editions said artificial intelligence, following the vocabulary of Executive Order 14434 of 29 September 2026. That makes the quantum sentence a list of four technologies the Division sees changing how market infrastructure runs. Two of the four, tokenization and extended trading hours, describe new kinds of business. Quantum computing, like SI, describes a new kind of threat and capability that the existing systems must withstand.
The earlier editions give the change its measure. The fiscal 2026 priorities limited Regulation SCI examinations to incident-response procedures and the management of third-party vendor risk. The fiscal 2025 edition did not mention quantum computing either. A text search of all three documents finds the word "quantum" only in the new one.
What the press coverage reported, and what the document actually commits examiners to
Coverage on 23 October, much of it in crypto-market outlets, ran under headlines about the SEC targeting tokenization, AI and quantum computing. Bitcoin News wrote that the SEC is "putting tokenized securities, artificial intelligence, and quantum computing under heightened scrutiny," and added that the agency stopped short of mandating quantum-resistant safeguards, which is accurate. Cointelegraph's report, carried by TradingView, quoted the Regulation SCI sentence in full. The document goes further in limiting itself. Its first page states that it "represents the views of the staff," that the Commission "has neither approved nor disapproved its content," and that it "has no legal force or effect" and "creates no new or additional obligations for any person."
So the sentence creates no duty. It tells SCI entities what examiners plan to ask about during fiscal 2027, which runs from 1 October 2026 to 30 September 2027. For a compliance officer at an exchange, that is still useful to know. Examination priorities set the agenda of the document requests that arrive before an on-site visit, and a firm that has nothing to show on a published priority starts the examination at a disadvantage.
The sentence also has limits of scope that the headlines left out. It sits in the Regulation SCI section, so it reaches only SCI entities: the registered exchanges, registered clearing agencies, FINRA, the MSRB, the larger alternative trading systems, plan processors and certain exempt clearing agencies. The sections on investment advisers and broker-dealers do not mention quantum computing. Their cybersecurity paragraph speaks of ransomware, data loss, access controls and third-party providers, and the separate paragraph on emerging financial technology is about SI-generated phishing and deepfake voice and video.
Which Regulation SCI rules give an examiner a basis for quantum questions
Regulation SCI was adopted in November 2014, in the wake of market-system failures that included the three-hour halt of Nasdaq's securities information processor in August 2013. It replaced a voluntary program with binding rules. The central one, Rule 1001(a), requires each SCI entity to keep written policies and procedures reasonably designed to give its SCI systems, and for security purposes its indirect SCI systems, adequate "capacity, integrity, resiliency, availability, and security." Those policies must include "regular reviews and testing" to identify "vulnerabilities pertaining to internal and external threats."
Nothing in that text needs to change for quantum computing to fall within it. A clearing agency's settlement links, an exchange's member connections and the market-data feeds of a plan processor rely on public-key cryptography for authentication and key exchange, and the National Institute of Standards and Technology has said those algorithms will need replacing. NIST approved its first three post-quantum standards, FIPS 203, 204 and 205, on 13 August 2024, and its draft transition guidance, IR 8547, published for comment on 12 November 2024, proposes deprecating quantum-vulnerable public-key algorithms at the 112-bit security level after 2030 and disallowing quantum-vulnerable public-key algorithms after 2035. These are proposed NIST milestones for federal systems; they are not SEC deadlines. Rule 1001(a)(4) adds that policies are deemed reasonably designed when they follow "current SCI industry standards" issued by a US government body or a widely recognized organization. On the choice of algorithms, the NIST standards are the natural candidates for that role, although algorithm standards alone do not settle compliance with the rule's wider duties of review, testing and enforcement.
The cloud sentence that follows the quantum one matters as well. Much of an SCI entity's cryptography runs inside vendors' hardware security modules, certificate services and cloud key management. An examination that asks about quantum readiness would likely also ask which vendor controls which keys, and when that vendor plans to support the new algorithms.
Where the SEC sits among financial supervisors on quantum risk
Other supervisors have gone further. Quentir's Defense Monitor described how Hong Kong's banking sector put a readiness score on quantum preparedness, turning a distant concern into a measurable program for banks. In Europe, the Digital Operational Resilience Act has applied to financial entities since 17 January 2025, and its technical standard on ICT risk management, Commission Delegated Regulation (EU) 2024/1774, asks them to update their cryptographic technology as cryptanalysis develops. By comparison the SEC's sentence is a modest step. Among the last three editions of the priorities, it is still the first to put quantum computing in writing for the operators of US market infrastructure.
The timing is also notable. The same week, Iceberg Quantum published Pinnacle 1.2, a vendor estimate that lowers the hardware it says is needed to break RSA-2048, and Quentir's recent read of an AI-assisted quantum circuit for Bitcoin's secp256k1 curve showed how quickly the attack side of the ledger is being worked on in public. Tokenized securities, which share the quantum sentence, will often rely on the same elliptic-curve signatures. The paragraph's pairing of tokenization and quantum computing is, in practice, one question about the signatures that will secure tokenized assets over their lifetime.
Practical takeaway. The fiscal 2027 priorities create no post-quantum obligation, yet they give SEC examiners a published basis to ask an exchange, clearing agency or FINRA how quantum-vulnerable cryptography in its SCI systems, and in its vendors' systems, will be identified and replaced under the existing security and testing duties of Rule 1001(a).
How Quentir Reads It
The Division describes its own method in the same document: priorities say where examiners will look, and risk alerts later publish what they found. If quantum computing follows that path, the first public account of how SCI entities are preparing would draw on examinations conducted during fiscal 2027. Before any such alert, what SCI entities will see first are the document requests that open each examination.
For the people whose savings pass through these systems, the stakes are practical. Registered clearing agencies stand behind the settlement of nearly all broker-to-broker US equity trades, and the signatures and key exchanges that protect those flows have long lifetimes. Two different risks sit in those systems. Confidential data sent in 2027 under today's key exchange could be recorded and read later, if it is still sensitive once a capable quantum computer exists. Signing keys and certificates that authenticate members and messages stay in service for years, and they would need to be replaced before forgery with them becomes possible. That is the reasoning behind the NIST dates, and the reason a single sentence in an examination document carries more weight than its length suggests.
The open question is what examiners will count as enough. A cryptographic inventory, a vendor roadmap and a migration plan with dates would be natural evidence of preparation. Whether they are enough will depend on how each entity implements, tests and enforces them for its own systems and risks. Whether the Division will expect hybrid deployments in critical SCI systems ahead of the dates NIST has proposed is something the text leaves unsaid. Quentir's Signature Report No. 2, the PQC Migration Roadmap, sets out the finalized NIST standards, the EU and US regulatory calendar and a four-phase migration roadmap with dates, which an institution can use to answer that question in its own terms, with an internal-use license for the whole organization. A public test would come if the Division issues a risk alert that covers quantum readiness, and the fiscal 2028 priorities will show whether the sentence stayed, grew or disappeared.
Sources: US Securities and Exchange Commission, "SEC Announces Fiscal Year 2027 Examination Priorities," press release 2026-109, 23 October 2026; SEC Division of Examinations, Fiscal Year 2027 Examination Priorities, October 2026, p. 13 (Regulation SCI) and p. 12 (cybersecurity and emerging financial technology); SEC Division of Examinations, Fiscal Year 2026 Examination Priorities and Fiscal Year 2025 Examination Priorities; 17 C.F.R. § 242.1001 (Regulation SCI, Rule 1001(a)) and § 242.1000 (definitions), eCFR, read 24 October 2026; NIST, FIPS 203, 204 and 205 approval announcement, 13 August 2024; NIST, IR 8547 initial public draft, Transition to Post-Quantum Cryptography Standards, 12 November 2024; Bitcoin News and Cointelegraph via TradingView, 23 October 2026; Iceberg Quantum, Pinnacle 1.2 release notes, October 2026 (vendor estimate, not independently reproduced); Commission Delegated Regulation (EU) 2024/1774 (DORA ICT risk-management standard); Executive Order 14434, "Inaugurating the Era of Super Intelligence," 29 September 2026; SEC, Regulation Systems Compliance and Integrity, Release No. 34-73639, November 2014; SEC, Form BD-Y2K reporting requirement under Rule 17a-5, 1998.
Published intelligence, built to inform your own decisions. Published: October 24, 2026.