FINRA member firms (“Members”), and the enterprise organizations in which many sit, are moving rapidly to deploy firm-approved artificial intelligence tools for use by their employees. As adoption accelerates, the available tools (and employees’ ability and willingness to use them) will increase dramatically.
The vast majority of employees will properly utilize AI technology, just as they have prior technologies. Policies and procedures will be written and followed, and hopefully customer harm can be avoided. Nevertheless, as with any new technology, firms should remain mindful that AI may create opportunities for misuse, circumvention of established controls, or unintended compliance issues. Appropriate governance, supervision, and monitoring remain important.
The purpose of this GT Alert is to identify categories of issues that firms may begin to encounter involving their employees’ use of AI in ways that cause customer harm or violate firm policies and procedures. Drawing on misconduct patterns observed in internal reviews conducted over the past two decades, and recognizing well-established motivations for employee misconduct, this Alert identifies several areas that firms may wish to consider for review.
Misconduct of Associated Persons and the Obligation to Undertake an Internal Review
Historically, internal reviews have often involved situations in which individuals acted outside firm policies for personal benefit, convenience, or to avoid perceived adverse consequences. When material issues arise in a firm’s business, including employee misconduct, the firm has a duty to scope those issues. See generally FINRA Rule 3110. That duty includes understanding both the root cause and the extent of the misconduct, as well as any resulting customer harm. Firms also have various reporting obligations. See e.g. FINRA Rule 4530, and Forms U4 and U5. Customer remediation issues also must be considered.
Some traditional internal review topics reflecting employee misconduct have included, but certainly are not limited to:
- Improper Loans from Customers
- Churning and Reverse Churning
- Unapproved Outside Business Activities and Private Securities Transactions
- Undisclosed Outside Accounts
- Taking Time and Price Discretion and Unauthorized Trading
- Outright Fraud (all varieties)
- Selling Away
- Customer Profiling, and Account Document Completion
- Creation, Reliance Upon, and Distribution of Unapproved Sales Literature
- Unapproved Communications with the Public
- Failure to Report Customer Complaints
- Gifts and Entertainment Issues
The motivations underlying misconduct do not change simply because an employee uses AI. Employees who are inclined to act improperly may continue to seek gain or attempt to avoid adverse consequences, regardless of the tools available to them.
Ongoing Efforts to Use AI at Broker-Dealers
Over the past several months, many firms have announced the rollout of new firm-approved AI tools for their employees and customers alike. AI has been touted as an amplifier of talent, enabling higher productivity. The tools include sophisticated platforms utilizing AI agents, and other basic tools such as ones that search and summarize information and explain workflows. Of course, these tools are distinct from the AI tools that employees may access outside firm-approved ones, such as personal versions of Claude, ChatGPT, Gemini, and similar products.
In order to capture and identify uses of AI for Members, FINRA has provided a number of useful publications and resources. Among other things, FINRA’s website has a section dedicated to AI (Artificial Intelligence (AI) in the Securities Industry | FINRA.org), and FINRA has produced a podcast (An Evolving Landscape: Generative AI and Large Language Models in the Financial Industry | FINRA.org), and has provided a chart identifying 14 areas in which Members are utilizing AI (How-Member-Firms-Use-GenAI.pdf). Those 14 areas are:
- Summarization and Information Extraction
- Conversational AI & Question Answering
- Sentiment Analysis
- Translation
- Content Generation & Drafting
- Classification & Categorization
- Workflow Automation & Process Intelligence
- Coding
- Query
- Synthetic Data Generation
- Personalization & Recommendation
- Analysis & Pattern Recognition
- Data Transformation
- Modeling & Simulation
FINRA also has issued Regulatory Notice 24-09 addressing AI, and FINRA has devoted a substantial section to AI in its 2026 Annual Regulatory Oversight Report. In that report, FINRA identified “Summarization and Information Extraction” as the most common AI use among Members.
Possible AI-Related Topics for Internal Reviews
At present, AI appears to be expanding the risk of employee misconduct in four primary areas: (i) unsanctioned creation of materials (and attendant recordkeeping violations), (ii) unsupported investment advice, (iii) outright fraud and other deliberate misconduct, and (iv) unapproved communications with the public. The risks are particularly acute when an employee uses an AI tool outside the firm’s environment to create work product that the employee then utilizes to interface with firm customers. Although such outside activity may fall outside the firm’s direct line of sight, the firm maintains its obligation to supervise how its employees interact with customers.
It is also worth noting that there continues to be a fair amount of recruiting and transition of employees between firms. That activity creates an additional risk – the acceptable AI practices of the prior firm may not align with the new firm’s practices. Therefore, firms should include AI practices as part of due diligence of new recruits.
1. Unsanctioned Creation of Materials (and attendant recordkeeping violations)
There are multiple improper reasons why employees would want to create unsanctioned materials to provide to customers. Perhaps the employee views the firm’s reporting as ineffective or imperfect, and the employee believes they can use AI to generate something better. Perhaps the intention is more nefarious. With AI, the bad behavior becomes much easier. All of the following reflects employee misbehavior pre-AI, that could be repeated with AI:
- An employee creates account reporting for a customer to massage bad performance.
- An employee generates account reports to conceal fraud.
- An employee plays stock guru by producing their own research or relies upon unvetted sources.
- An employee, dissatisfied with a firm procedure or perceiving a gap in it, creates an ad hoc form and inserts it into the firm’s process.
The use of AI also introduces additional risk scenarios. For example, what happens when an employee loads customer data into an outside AI tool? Or when an employee determines that a firm-designated workflow is inefficient and uses AI to develop an alternative process?
These issues also create books & records problems, and probable surprises in litigation and regulatory enforcement.
2. Unsupported Investment Advice
AI heightens the risk that employees of Members will formulate and offer their own unsupported investment advice, and will base investment recommendations to customers on research that has not been reviewed or approved by the firm. Most employees will follow established firm guidance and use conventional, approved sources. However, there will always be the risk of employees who do not.
Experience indicates that when employees develop and act on unsound investment strategies of their own design, problems can also exist in the completion of customer account profiling paperwork.
3. Outright Fraud and Other Deliberate Misconduct
Firms conducting internal reviews have encountered situations in which an employee of a Member has operated an unapproved outside business, or even solicited customer investment into a fictitious outside business or fraudulent investment scheme. Scoping is particularly important in those situations because harm in such cases is rarely limited to a single victim. AI makes it easier for employees – and third parties – to establish and operate outside businesses and to generate supporting documentation, including materials designed to appear official or firm-issued, which can then be used to solicit investments from firm customers. Those businesses may be legitimate but unapproved by the firm, or they may be part of a fraudulent scheme. Even where customer investments are not involved, the efficiency that AI provides appears to increase the risk of employees establishing or participating in unapproved outside businesses.
4. Unapproved Communications with the Public
There is a meaningful risk that employees will use AI to create and distribute to customers retail communications that require firm approval, filing, and retention under FINRA Rule 2210. AI also makes it easier for employees to develop seminar and presentation materials. Whether such materials would satisfy FINRA’s content standards is an open question that warrants attention.
There is also concern about practices that allow an employee to use AI to autonomously generate responses to customer emails. For example, what happens when a customer email contains a complaint that the employee is not authorized to respond to independently? Employees also may attempt to use AI to generate responses that appear to come from the firm but that the firm has no knowledge of or involvement in.
*****
Firms should consider proactively evaluating how AI use within their organizations may give rise to issues requiring internal review. The pace of AI development makes early attention to these questions advisable.