Regulators Are Using AI: How the SEC and FINRA Do It

Updated October 2026. First published April 2024.

The 2024 version of this post imagined what an SEC AI system might do with a broker-dealer's records. You don't have to imagine it now. The SEC publishes an inventory of its AI use cases, FINRA's chief executive has described FINRA's tools in some detail, and the SEC spent 2026 rethinking the audit trail that most market surveillance runs on. Here is what each has said, and what it means for the data your firm produces.

What the SEC Lists

Federal agencies publish their AI use cases, and the SEC's 2025 inventory includes several that reach broker-dealers directly. Among the deployed ones:

The Division of Examinations has used machine learning since April 2015 to "predict entities with certain risk characteristics." Staff may consider the results in their exam work.
Examinations has matched similar names across data sources with a model since February 2018, and has searched unstructured filings with natural language processing since April 2020.
Since May 2024, an Examinations model has flagged accounts with activity of interest for an exam team to review. A related model that looks for potentially manipulative trading in registrant data was still in development.
The Division of Enforcement has used a model since April 2018 to find accounts that traded ahead of material price moves.

Enforcement was also building a large language model to summarize and classify tips, complaints, and referrals, because the volume is more than its triage staff can read. In August 2025, the SEC created an AI task force led by Valerie Szczepanik, its newly named Chief AI Officer.

The tools show up in cases. SEC releases often say a case originated from the Market Abuse Unit's Analysis and Detection Center, which uses data analysis to spot suspicious trading patterns. In December 2024, the SEC settled with a Florida trader over a spoofing scheme in thinly traded stocks that ran from April 2022 through January 2024, sometimes through accounts in other people's names. Staff found it by analyzing trading records in the Consolidated Audit Trail. He agreed to pay $381,718 in disgorgement, $57,570.48 in prejudgment interest, and a $150,000 penalty.

What FINRA Says

FINRA's president and CEO, Robert Cook, described its tools in an October 2025 post. AI-based algorithms review the hundreds of billions of market events generated each day for signs of fraud and manipulation. FINRA runs cross-market surveillance under contract for 26 SROs covering 35 equities and options exchanges. Matters outside its jurisdiction go to the SEC or another agency as referrals.

Inside FINRA, an internal LLM chat tool called FILLIP went to all staff in May 2025, and about 40 percent of employees use it each week. Staff have used it in member firm risk reviews and to analyze mutual fund and ETF data for exams. Another tool summarizes investor complaints, which run to more than 10,000 a year. Tools in development would summarize registration disclosures and compare data across firms' eFOCUS reports. FINRA says it keeps a human in the loop and limits staff access to sensitive data by regulatory need.

The Audit Trail Underneath

Most of this runs on the Consolidated Audit Trail. The CAT collects each order's origination, routes, modifications, cancellations, and executions in NMS securities and OTC equity securities. It links those events into a single lifecycle for the order. It's large: the SEC cites 154 trillion events in 2024, up from 109 trillion in 2022. Three things about it have changed since this post first ran.

Customer data came out. An SEC order of February 10, 2025 ended collection of names, addresses, and years of birth for U.S. natural persons, and a plan amendment approved January 13, 2026 removed customer and account-level information from the CAT. Regulators can still follow one customer's trading across brokers through a CAT Customer ID. Attaching a name to that ID now takes a separate request to the firm, and the SEC says regulators still rely on older sources such as electronic blue sheets.

Cost became the main argument. When the SEC approved the CAT plan in 2016, it estimated operating costs of about $55.8 million a year. The 2025 budget the SROs first approved was over $248 million, and the 2026 budget is about $156 million after cost cuts. In 2025, the Eleventh Circuit vacated the SEC's order approving a revised funding model.

The SEC may take it over. After an April 16, 2026 concept release, Chairman Paul Atkins wrote on August 10, 2026 that he had directed staff to draft a rule that would rescind Rule 613 and have exchanges, FINRA, and broker-dealers report CAT data to the SEC or its designee. Firms would keep reporting through the current CAT infrastructure and specifications. Staff are also looking at funding through appropriations or Section 31 fees. He expects the transition to run until late 2027.

What It Means for Your Firm

The tools above share a pattern. Software picks the accounts, firms, and trades worth a closer look, and a person decides what happens next. Your firm's data is how you get picked, and your records are how you answer.

The data you report to the CAT is what cross-market surveillance reads. Its accuracy is a compliance question as much as a technology one, whoever ends up running the system.
With customer identity out of the CAT, expect a records request or a blue sheet request after an alert. The name comes from your response, so the response has to be fast and right.
Exam staff use models to decide where to look, and you can't see the model. What you control is what an examiner finds after arriving: documented supervisory reviews, aged exceptions that are closed, and records you can produce on request.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.