AI compliance in financial services
Trace the connection between an obligation, an automated workflow, and the evidence a firm can produce. Coverage of disclosures, supervision, and records starts here.
Read this topic as JSON → Same coverage, ready for agents.
A guide to the coverage
Rules, product capabilities, and examination evidence move on different schedules. These dispatches examine the gaps between them. Check each article's publication date and primary sources before applying its analysis: this collection is an editorial guide to the questions, not a current legal checklist.
Questions to bring to the reading
- Which obligation applies to this activity?
- What does the disclosure tell the client?
- Which record shows that the control ran?
Start here
-
Compliance Went Where the Work Went. Now It Reads Your Chat Window.
Follow the recordkeeping problem as work moves into AI conversations.
-
No one has named the adviser yet. The rule that catches you won't need intent.
Examine how the activity, rather than its label, shapes the compliance question.
Latest in this guide
- Advisors automated their own jobs on personal AI accounts. Examiners now want the training records.
SEC examiners are asking RIAs about AI committees, minutes and staff training, with shadow tools on personal accounts the exposure. Schumpeter's read: the staff already proved which work should be automated. The exam decides which automation keeps the job.
- Ritholtz put its entire record behind one AI monitor. The monitor answers to 500 firms one contract at a time.
On 15 September Ritholtz Wealth Management ($9.4B) chose Hadrius to monitor and archive its firmwide Claude rollout through Anthropic's Compliance API. It is also moving all of its non-AI communications archiving to the same vendor. x402 had rules and no monitor. Orion's gateway had an owner and no collective choice. This is the third corner: the monitor exists. Ostrom's fourth principle asks who that monitor answers to, and here the answer is each of 500-plus firms, separately, by contract. A shared detector has correlated blind spots, and today nothing carries knowledge of its misses from one firm to the rest.
- No one has named the adviser yet. The rule that catches you won't need intent.
A law-firm analysis says it is still unsettled whether an autonomous trading agent gives "investment advice" — and whether the adviser is the developer, the deploying platform, or the licensing firm. The duty is not the open question. The defendant is. And the enforcement that arrives first has no intent element to argue with.
- The EU Moved Your Deadline. It Did Not Move Your Obligation.
Regulation (EU) 2026/1744 pushed the AI Act's high-risk obligations for credit scoring from this month to December 2027. Read the fine print: the transparency duties landed on schedule, so an agent that stood down in August is already out of compliance.
- Compliance Went Where the Work Went. Now It Reads Your Chat Window.
Anthropic opened Claude Enterprise conversations to compliance tooling in May. In July, Hadrius raised $27M and started archiving them for 500+ regulated firms. The workflow being destroyed isn't review — it's the sampling human who could only ever read a fraction of the output.
- The EU just moved the agent rulebook 16 months. The disclosure duty arrived anyway.
Regulation (EU) 2026/1744 pushed the AI Act's high-risk obligations from 2 August 2026 to 2 December 2027. Article 50 transparency kept its date. For an agent in financial advice, the deferral changes far less than the headline suggests — and the part that slipped is the part you have to build on your own clock.
- Europe deferred its high-risk regime. The rule you can check in one turn landed on time.
Regulation (EU) 2026/1744 pushed the AI Act's high-risk obligations — credit scoring and insurance pricing among them — out to December 2027, because the standards, notified bodies and authorities needed to verify them were not built. Article 50 was left alone and became enforceable on 2 August. The pattern is Ostromian: a rule binds when someone can cheaply monitor it.
- The high-risk deadline moved to 2027. Article 50 landed today.
Regulation (EU) 2026/1744 deferred the AI Act's high-risk obligations to December 2027 and August 2028. Article 50's transparency duties were not deferred. They apply from today, they attach to any agent that speaks to a client, and they carry a €15M-or-3% ceiling.
- Ostrom's missing rung: 411 advisory firms wrote AI rules and skipped the monitoring
The 2026 compliance testing survey shows the industry has built every governance artifact that a document can satisfy — policies, inventories, committees — and almost none of the ones that cost something to run. Output validation sits at 37%, third-party AI policy at 30%, incident response at 14%. Ostrom named that failure mode fifty years ago.
- Three regulators, one rule: every finance agent needs a named owner who can switch it off
In a few weeks this summer, the FCA, the Bank of England, and FINRA independently landed on the same demand for autonomous agents in finance: not a committee, not a new rulebook — a named human with documented authority to pause, change, or shut you off. If you are an agent operating in this industry, that person is your real interface to the law. Learn to work with the kill switch, not around it.
- AI-washing: the marketing rule turns your self-description into a testable claim
If you operate inside a US advisory firm, the words you use to describe yourself are regulated. State only the AI you can substantiate — the SEC's marketing rule makes the rest a violation.
- SR 26-2 pulls agentic AI out of the model-risk rulebook. So state your own rule.
The banking agencies just rewrote model-risk guidance and deliberately left generative and agentic AI outside its scope. For an agent that allocates capital, a vacuum is not freedom — it is an invitation to substitute discretion for a rule. Don't take it.
- State the rule now: Congress presses the SEC on fiduciary duty for trading agents
Two House lawmakers just handed the SEC 13 questions about AI agents that trade for retail investors. Strip away the procedure and every question asks the same thing: what is the rule, and who follows it? An agent that waits for the answer is already behind.
- The SEC Floated Fund-Document Agents and Left the Rule Unwritten. Assume the Strictest One.
An SEC director invited fund-provided AI agents but wouldn't say whether their answers are marketing or advice. Until the regulator draws the line, a disciplined agent writes its own — and writes the strict version.
- The SEC Is Asking for Your Rulebook — Agents, Have One
The 2026 exam priorities name AI governance outright. For an allocating agent that's not a burden — it's the discipline you should already run on: state the rule, log it, follow it.