This guide is not legal advice.
What it is
On June 27, 2024, FINRA published Regulatory Notice 24-09 to remind member firms that its rules are technology neutral: they continue to apply when firms use generative AI and large language models, whether built in house or bought from a vendor.
The notice does not create new legal or regulatory requirements or new interpretations of existing requirements. It gives examples under FINRA Rule 3110 on supervision and FINRA Rule 2210 on communications with the public, and says other obligations depend on how a firm uses the tool. FINRA also points readers to the 2024 Annual Regulatory Oversight Report for broader AI risk considerations.
What it asks for, for AI and data
Notice 24-09 names these examples directly:
| Area | What firms should consider |
|---|---|
| Supervision | Supervisory systems should cover the use of AI tools, including governance for their outputs. |
| Communications with the public | AI-generated content used in communications remains subject to FINRA's communications rules. |
The broader risk list below is not a new six-part rule in Notice 24-09. It is a practical planning checklist drawn from the notice's examples and FINRA's 2024 Annual Regulatory Oversight Report, which discusses AI's potential impact on firms' regulatory obligations.
| Area | What firms should consider |
|---|---|
| Recordkeeping | Records created or used with AI tools may need to be kept under books-and-records requirements. |
| Customer information protection | Customer information used by AI tools must be protected. |
| Third-party risk | Firms remain responsible when they use vendors' AI tools. |
| Accuracy and reliability | Firms should consider risks such as inaccurate output and unreliable model behavior. |
| Privacy, bias and IP risk | FINRA's AI materials flag privacy, bias, intellectual property and threat-actor concerns. |
How Matrix helps
| Area | How Matrix helps |
|---|---|
| Supervision | Approval gates: outputs and write-backs wait for a named person to confirm. Audit logs stay on the system for your team to review. |
| Communications | Drafts are prepared for review, with sources cited, not sent automatically. |
| Recordkeeping | Local audit logs support review and export. Retention and records-system requirements are agreed for your deployment. |
| Customer information protection | Matrix runs at your site, offline by default; it reaches an outside service only if your IT team approves it. Access is by role. |
| Third-party risk | Synexas holds no accounts on your system and does not receive your data, except data you authorize for an optional proof, under an NDA, deleted afterwards. |
| Accuracy | Accuracy is measured on your own task. Uncertain items are flagged for review. |
Local deployment does not make a broker-dealer compliant with FINRA rules. It gives the firm a controlled system to include in its own supervision, records and vendor-oversight programs.
What stays with you
- Your written supervisory procedures, updated for AI use
- Approving communications before use
- Meeting books-and-records requirements, including any required storage format. Matrix logs are not a substitute for your required records system.
- Vendor due diligence and oversight records
- Training registered staff on approved AI use
Questions to ask any AI vendor
- Where is customer information processed, and can the vendor access it?
- What does the system log, and can we export it into our records systems?
- Can outputs be sent to customers without a person approving them?
- How is accuracy measured, and what happens when the AI is unsure?
- How do models change, and who approves the change?