Compliance Officers Worry AI Demand Is Outpacing Regulators

During a FINRA conference dominated by AI-related discussions, Robinhood General Counsel Dan Gallagher suggested it could be safer for investors to use AI tools within a brokerage firm’s “walled garden” rather than from third-party sources.

Advancements and interest in artificial intelligence are moving so quickly that compliance officers worry the demand “is going to force regulators to come around as opposed to getting ahead of it.”

During a discussion at the Financial Industry Regulatory Authority’s annual conference in Washington, D.C., Dan Gallagher, the chief legal, compliance and corporate affairs officer of Robinhood Markets (and a FINRA Board of Governors member), said customers’ use of generative AI tools in investment decisions could run afoul of a host of securities regulations.

However, as of yet, regulators haven’t caught up, Gallagher warned, particularly on how firms can build their own AI-supported tools that clients can use to make investment decisions.

“I’m not saying FINRA says no or the SEC says no, but if you read the rules, it’s mildly incongruous,” Gallagher said. “So we’ve got to get past that and get past that quickly, because sending American investors off into third-party sources to get investment advice to do the things they want to do in their brokerage app on the website is not good policy.”

The conversation with Gallagher and other compliance leaders came at the end of a regulatory-focused conference dominated by conversations about AI, including the benefits and challenges it poses for firms’ compliance departments. 

Many firms are already deploying their own AI assistants for advisors, and Anthropic announced earlier this year that it had expanded Claude “plug-ins” for wealth managers, investment bankers, equity research and private equity firms. But Gallagher warned that clients are looking to AI to tell them what to do (and, in some cases, do it for them), and building (or bringing) such tools into firms could conflict with SEC rules, including Regulation Best Interest and Regulation S-P. 

Nevertheless, Gallagher said it could be preferable for those AI-assisted trades to be done within the firm, raising the question of whether it’s preferable for those kinds of AI-powered suggestions (and trades) to come from inside the house.

“Why have them go do it with a third party when you can build it internally in a walled garden that’s more protected, where there’s better data, and quite frankly, where it’s not scraping Reddit for what it’s going to recommend to you? It’s actually using your own data,” Gallagher said. “But right now, we sit here, and Claude can do it and I can’t, on its face.”

For FINRA, the main challenge is determining where regulatory intervention may be needed, and where AI compliance can rely upon existing rules, according to Executive Vice President and Chief of Staff Nathaniel Stankard. He said regulators and industry alike were in a “transition” phase after the shock of ChatGPT and similar models hitting the general populace.

“From a regulatory standpoint, you want to say, ‘All right, let’s not stymie innovation. Let’s take our time, let’s learn what the users are,’” Stankard said.  “And now we’re hitting a level of maturation and expansion where I think that, from a regulatory perspective, we want to understand where it’s actually productive to engage where we need to, whether it’s to protect investors or protect funds.”

According to Wendy Lanton, a chief operations and compliance officer for the N.Y.-based Herold & Lantern Investments, AI compliance is particularly challenging for smaller firms. 

Lanton (who is also a small-firm representative on FINRA’s Board of Governors) said the technology requirements for effective oversight can make it harder to find the most effective solution.

“I find that there might be many solutions out there, and as a small firm, you can’t build it yourself. You need a vendor,” she said. “And so you say, ‘okay, well this vendor has this, and this vendor has that.’ Now, I’ve got 10 vendors: A, I can’t afford it, and B, I can’t manage the relationships.”

In recent months, Anthropic has limited the release of its agentic AI system, Claude Mythos, to a few dozen organizations, claiming it is too powerful for general public use and could pinpoint defects in long-running computer systems. Shortly after the Mythos news, chief Anthropic competitor OpenAI followed with the planned release of an agentic system with similar strengths to Mythos (though OpenAI planned a larger release).

In an earlier session at the conference, Jeffrey Tricoli, Charles Schwab’s chief information security officer and managing director, said the “core mission” of these frontier models was to “find an exploit” in existing systems and “put that exploit to use.” 

Tricoli stressed that “proper guardrails” were essential for the industry, as new agents inevitably end up in the hands of firms (and cybercriminals looking to target those firms).

“What you don’t want to happen is you put something in place, it gives you an outcome you’re looking for, but then it goes beyond, and then potentially, it starts with time to degrade or give you results that aren’t favorable,” he said.

Data “triage” is at the heart of the AI-related fixes firms should commit to, according to Tricoli, because if firms don’t know and understand what kind of data is exposed, it can’t be protected. Firms will be at a disadvantage if they can’t understand, “at a moment’s notice,” where specific data is located throughout their tech environment, he warned. 

“Those are all going to be challenges that we’re going to have to start thinking through a lot more quickly,” he said. “Because it’s going to happen very fast.”

Patrick Donachie

Senior Reporter, Wealth Management