FINRA's Six AI Agent Risks and Supervisory Procedures

The 2026 Annual Regulatory Oversight Report published by the Financial Industry Regulatory Authority (FINRA) includes a subsection on AI agents.

The report itself was published on December 9, 2025, so this is not breaking news. FINRA also noted, in an official blog post on January 27, 2026, that its regulatory staff have spoken with numerous member firms about their use of AI agents. That statement does not establish that any particular examination topic or priority area has been set.

Rather than treating the report as an announcement of new rules, this article uses it to review how AI agent permissions, approval processes, and recordkeeping fit into a firm’s existing supervisory procedures.

The discussion focuses on how FINRA member broker-dealers design supervision for AI agents. Companies elsewhere, including in Japan, would need to confirm the laws and rules that apply to them.

What Was New for 2026: The GenAI Section Itself

FINRA’s annual report shares what the organization has learned through its regulatory oversight activities with member firms.

FINRA states that the report “does not create any new legal or regulatory requirements or new interpretations of existing requirements, or relieve firms of any existing obligations.” It also states that it “does not represent a complete inventory of regulatory obligations, compliance considerations, findings, effective practices or topics that FINRA will examine.”

In other words, it is not an announcement of new rules. It shares observations from FINRA’s oversight activities and practical considerations in the context of existing obligations.

FINRA has covered AI and generative AI in earlier annual reports. What is new in the 2026 edition is the section itself: the Introduction states that this year’s report includes a new topic area dedicated to “GenAI: Continuing and Emerging Trends.” Within that section sits a subsection on AI agents, “Emerging Trends in GenAI: Agents.”

The “NEW FOR 2026” label applies to the whole GenAI section, not only to the agents subsection. What the report added is a subsection that separates the questions specific to agents from general chat-style use of generative AI.

How FINRA Defines an “AI Agent”

The subsection opens by defining the term.

According to FINRA, an AI agent is a system or program capable of autonomously performing and completing tasks on behalf of a user—interacting within an environment, planning, making decisions, and taking action to achieve a specified goal without being programmed with predefined rules or logic.

FINRA adds that AI agents extend the capabilities of generative AI by automating tasks and interacting with a wider range of data and systems, faster and in some cases at lower cost than traditional business automation.

What the definition emphasizes is not the ability to produce text, but the parts closer to human judgment and action: planning, deciding, and acting.

That is why these questions are discussed separately from chat-style generative AI use.

The Six Risks FINRA Lists

FINRA lists the following six risks and challenges for AI agents.

It also notes that the risks of generative AI in general—bias, hallucinations, and privacy—remain present. These six items are not an exhaustive list of the risks associated with agents.

• Autonomy: agents acting autonomously without human validation or approval.
• Scope and authority: agents acting beyond the user’s actual or intended scope and authority.
• Auditability and transparency: complex, multi-step agent reasoning tasks make outcomes harder to trace and explain.
• Data sensitivity: agents handling sensitive information may unintentionally store, explore, disclose, or misuse it.
• Domain knowledge: general-purpose agents may lack the industry-specific expertise needed to perform complex tasks effectively and consistently.
• Rewards and reinforcement: misaligned or poorly designed reward functions could optimize an agent toward decisions that negatively affect investors, firms, or markets.

These questions overlap with one another. Permissions, records, data handling, fitness for the work, and how goals are set each need to be checked.

FINRA’s Considerations and the Link to Written Supervisory Procedures

FINRA sets out considerations a member firm may wish to weigh.

Within the agents subsection, the considerations are monitoring access and data handling, where humans are involved, tracking actions and decisions, and guardrails:

• Monitoring an agent’s system access and data handling.
• Establishing human-in-the-loop oversight protocols.
• Tracking an agent’s actions and decisions.
• Putting guardrails or control mechanisms in place to constrain an agent’s behavior, actions, and decisions.

Elsewhere in the GenAI section, under “Emerging Trends and Current Practices,” the report takes up:

• Implementing formal review and approval processes involving business and technology experts.
• Establishing supervision and governance, or model risk management, frameworks.
• Testing capabilities and limitations robustly.
• Monitoring outputs on an ongoing basis, with validation and human-in-the-loop review.

None of these is presented as a new obligation. What the report discusses is where to place human involvement—not a blanket requirement that every operation be approved in advance.

The obligations sit in the existing rules.

FINRA Rule 3110(a) requires a member firm to establish and maintain a supervisory system reasonably designed to achieve compliance with applicable securities laws and regulations and with FINRA rules. Rule 3110(b)(1) requires a firm to establish, maintain, and enforce written supervisory procedures (WSPs) covering its business activities and the activities of its associated persons. These procedures must be reasonably designed to achieve compliance with applicable securities laws, regulations, and FINRA rules. Rule 3110(b)(7) requires a firm to promptly amend its WSPs to reflect changes in applicable law and changes in its supervisory system.

So if a firm changes its supervisory system to account for its use of AI, that change needs to be reflected in the WSPs. The annual report offers considerations; it does not newly require that these six items be written into a firm’s procedures. This article connects that existing obligation to the report’s considerations as a way of reviewing how AI agents are run.

On technology governance when generative AI is used as part of a supervisory system, FINRA’s Regulatory Notice 24-09 speaks to the point directly. It explains that FINRA intends its rules and guidance to be technology-neutral, and that a firm using generative AI tools as part of its supervisory system should have policies and procedures addressing technology governance—including model risk management, data privacy and integrity, and the reliability and accuracy of the AI model.

Our Reading: Separate Permissions by Stage—Analysis, Decision, Execution

What follows is MIF’s own reading, based on FINRA’s material.

We divide the work assigned to AI into three stages—analysis and recommendation, deciding how to respond, and execution—and consider, for each stage, what to permit and how to supervise it. In practice, this means treating prediction, deciding how to respond, and taking action as separate functions.

In trade surveillance, for example, surfacing transactions that warrant review, deciding whether further investigation is needed, and notifying a person or opening a case can be designed as separate functions. Handing one function to AI does not mean the permissions for the next one have to follow automatically.

That separation alone, however, is not enough to address all six risks.

An agent that lacks domain knowledge can produce faulty analysis or recommendations even with no execution permissions at all. How goals are set matters not only for the final operation but for what the agent treats as important.

For each stage, a firm needs to check what information the agent can reach, what records are kept, whether the agent is suited to the intended task, and whether the objectives and metrics are sound.

We use these three stages not as a replacement taxonomy for the six risks, but as a way to decide where the permission boundaries and controls belong.

This article deals with the design of permissions, supervision, and records when AI is used in financial work. It does not evaluate market outlooks or particular investment strategies.

A Starting Point for Reviewing WSPs

The table below does not prescribe correct settings, and it is not an exhaustive checklist.

For each of the six risks FINRA lists, it is a starting point for asking what to check first when reviewing WSPs internally—a draft to be filled in against your own size, business, risk tolerance, and applicable regulation.

FINRA risk	Questions to ask first (examples)	Examples of where controls can be implemented
Autonomy (no human validation)	Which decisions and actions may proceed without prior human approval?	Internal approval workflow; approval-step settings in the product
Scope and authority	Do the permissions actually granted to the agent match the scope you intended? Which systems may it access, and which operations may it perform?	Access permissions on connected systems; tool-use restrictions in the product
Auditability and transparency	Are inputs and outputs, referenced material, model version, tool calls, approvals, and results retained in a form you can check afterward?	Logging infrastructure; change history
Data sensitivity	What information may the agent access, and where do you draw the line on storage and disclosure? What goes into the records, who may view them, and how long are they kept?	Data access controls; information classification policy
Domain knowledge	How do you validate the agent for that business area before putting it to work?	Pre-deployment testing and review (internal process)
Rewards and reinforcement	Do the agent’s optimization objectives and your internal performance metrics conflict with investor protection, market integrity, or applicable obligations?	Design review; model risk management framework (internal process)

The controls in the right column may be implemented at different levels. Some can be enforced through product settings, others through access controls in connected systems, and others through internal policies and procedures.

When you fill the table in, mark each row as a product setting, a restriction on a connected system, or an internal rule. That keeps “whose job is this?” from becoming a question after the agent is running.

Two notes on the table. On auditability, the goal is not to reproduce the model’s internal reasoning in full; it is to be able to confirm afterward how something was processed, approved, and executed. And a reward function is not the same thing as an internal business metric—extending the row to performance metrics is MIF’s applied suggestion, not a transcription of FINRA’s text.

Turning Controls into Supervisory Procedures

This table exists to surface technical checks and where they are implemented.

To connect it to WSPs, go beyond the implementation target: who supervises, when and what they check, how the result of that check is recorded, and who decides to stop or remediate when something falls outside the expected range. Set out, too, the re-verification steps that apply when the model, the connections, the permissions, or the covered business change.

If outbound messages require approval, for example, do not simply write “a person reviews it.” Name the approver, the material subject to review—the text, the recipient, the referenced information—how the approval is recorded, and the conditions under which a change after approval requires re-approval.

This is an example of the level of detail MIF recommends, not a prescribed regulatory template.

Closing Thoughts

In its 2026 report, FINRA added a section on generative AI and, within it, a subsection on AI agents.

What is written there is not a new rule. It is a set of questions and example responses a member firm may weigh when applying existing supervisory obligations to this particular implementation.

Our reading is that letting AI analyze can be designed separately from granting it the authority to decide and to act. Across those stages, a firm then checks data, records, suitability for the intended task, and how goals are set, and connects the result to its supervisory procedures.

For firms considering or already using AI agents, the first step is to check whether their WSPs and operational practices address each of these six risk areas—and where gaps remain.

Sources and Verification

This article was prepared as of September 2026, drawing primarily on the section “GenAI: Continuing and Emerging Trends” in FINRA’s 2026 Annual Regulatory Oversight Report, together with the report’s Introduction.

The report was published on December 9, 2025.

The definition of AI agents, the six risks, and the considerations are summaries of the report’s own descriptions.

Among the considerations, monitoring access and data handling, human-in-the-loop protocols, tracking actions and decisions, and guardrails appear in the agents subsection; formal review and approval, governance, testing, and ongoing monitoring appear elsewhere in the GenAI section.

The content of FINRA Rule 3110 is taken from the rule text ((a), (b)(1), and (b)(7)). Technology governance for generative AI used within a supervisory system is drawn from Regulatory Notice 24-09.

The three-stage framing—analysis and recommendation, deciding how to respond, execution—the starting table, and the example of specificity for WSPs are MIF’s analysis and suggestions, not FINRA’s views.

How FINRA supervises in practice, and where it places emphasis, may change.

Please confirm the current position through FINRA’s own announcements.

Key References

• Financial Industry Regulatory Authority (FINRA), 2026 Annual Regulatory Oversight Report, section “GenAI: Continuing and Emerging Trends,” published December 9, 2025.
• The same report, “Introduction.”
• FINRA Rule 3110 (Supervision), paragraphs (a), (b)(1), and (b)(7).
• FINRA Regulatory Notice 24-09, “FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models,” June 27, 2024.
• FINRA blog post, “Emerging Trend in GenAI: Observations on AI Agents” (Greg Ruppert, January 27, 2026).