AI agents for compliance teams in capital markets in the United States

US broker-dealers and investment advisers can use AI agents to pre-review retail communications, test recommendations against the best interest standard, flag off-channel communication risk and draft exception reviews for supervisors. Registered principals and the chief compliance officer keep every approval and finding. SEC and FINRA rules on supervision, communications and books and records set the boundaries.

What does capital markets compliance look like in the United States?

Supervision is a structured legal duty. A broker-dealer must have written supervisory procedures, designated principals who review the activity of registered representatives, and systems that catch exceptions. Daily trade reviews, account reviews and correspondence reviews fill principals' days, and compliance tests whether that supervision actually works.

Communications are heavily regulated. Retail communications generally need principal approval before use, correspondence must be reviewed under the firm's procedures, and all business communications must be preserved. Firms have faced significant enforcement for staff using unapproved messaging apps, so off-channel risk is a standing item.

Investment advisers have their own load: a chief compliance officer, an annual review of the compliance programme, the marketing rule's limits on testimonials and performance advertising, and the fiduciary duty to clients. Broker-dealers making recommendations to retail customers must meet the best interest standard and document why a recommendation fits.

Where can AI agents help?

1. Retail communications pre-review (depth 2). The agent reads draft adverts, social posts and client letters against the firm's rules on fair and balanced content, performance claims and required disclosures, and drafts comments for the principal.
2. Best interest testing (depth 1). The agent samples recommendations and checks that the file shows the customer's profile, reasonably available alternatives, costs and the reason the recommendation was in the customer's best interest.
3. Off-channel risk flags (depth 1). The agent searches preserved communications for references to conversations on unapproved channels, such as "text me" or "moving this to my phone", and lists them for review.
4. Exception review drafting (depth 2). For trade and account surveillance exceptions, the agent assembles the account history and drafts the supervisor's review note.
5. Annual review evidence (depth 2). For advisers, the agent drafts the evidence summary for the chief compliance officer's annual review from testing results and incidents.

How you measure these matters as much as which you pick. Our guide on how to measure a compliance agent's performance recommends tracking missed issues against a sample that people reviewed in full, not just the time saved.

What must stay with principals and the CCO?

Approving a retail communication is a principal's act under FINRA rules, and the principal must actually review it. The agent drafts comments; the principal approves, edits or rejects, and the record shows who did. The same applies to correspondence review and to supervisory sign-offs on exceptions.

Findings that a recommendation breached the best interest standard, or that a representative used unapproved channels, lead to remediation and possibly disciplinary action and regulatory reporting. Those stay with people.

The chief compliance officer's annual review and the firm's annual certification of its compliance processes are personal statements by named people. An agent assembles evidence; the people sign. This is the logic of AI compliance agents as second line, never the last word.

Which US rules apply?

There is no single federal AI law. The SEC regulates broker-dealers and investment advisers, and FINRA, as the self-regulatory organisation for broker-dealers, sets and enforces supervision, communications and conduct rules. Both require preservation of business communications. The best interest standard governs recommendations by broker-dealers to retail customers, and advisers owe a fiduciary duty.

For firms inside bank holding companies, the Federal Reserve and the OCC apply SR 11-7, the interagency model risk guidance, to models including surveillance and testing agents: they need validation, monitoring and governance. NYDFS adds requirements for firms it regulates. GLBA and the SEC's privacy rules govern customer financial information, and state privacy laws such as California's CCPA as amended by the CPRA may reach other personal data. Our overview of how AI agents are regulated in the United States covers more.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How do you start in the first 90 days?

Month one: run off-channel risk flags at depth 1 over a past period of preserved communications. It is read-only, compliance can verify every hit, and it addresses a known supervisory priority.

Month two: run best interest testing at depth 1 on recommendations your team already reviewed. Compare findings representative by representative and study every disagreement.

Month three: pilot communications pre-review at depth 2 with one marketing team. Every draft comment is held for the principal, and every approval remains the principal's. Update written supervisory procedures to describe the agent's role before go-live.

Where Pryme fits

In Pryme, principal approval is enforced as a held verdict: the agent's comments wait for a named principal, who approves or rejects. Every verdict is filed in an append-only record that sits alongside the firm's books and records. Attest certifies each agent on the firm's own past communications and files.