FINRA Insiders Describe AI Challenges for Member Firms
Commentary by Chuck Hollis
FINRA executives highlighted risks firms face with generative AI and large language models ("LLMs") and how FINRA is approaching these challenges.
During an episode of FINRA Unscripted, Brad Ahrens, senior vice president of Advanced Analytics; Andrew McElduff, vice president with Member Supervision's Risk Monitoring team; and Haime Workie, vice president and head of FINRA's Office of Financial Innovation described a number of challenges that AI presents to firms. These include (i) explainability ("the ability to be able to have an understanding of how the machine came to a result"), (ii) data bias, (iii) customer information protection, (iv) supervision, (v) books and records, (vi) cyber related requirements and protections, (vii) hallucinations and (viii) toxicity ("reproduce[ing] offensive language or unfounded perspectives that are in the bad web content").
According to the speakers, member firms were taking a conservative approach toward understanding the impact of AI and its risks. Speakers advised that member firms using AI vendors must be able to ensure contract rights that protect the member firm and its clients, protect confidential information and develop reasonably designed supervisory systems appropriate to their business model and scale that would address technology governance around the AI, especially for critical business functions.
The FINRA executives stated that they established an internal Large Language Model Coalition, consisting of approximately 50 members from various departments within FINRA. They reported that the coalition formed three main working groups (Internal and External Opportunities Working Group, Technology Working Group and Policy/Contracts Group) focused on identifying internal and external opportunities, addressing technological requirements and cybersecurity risks and drafting internal usage policies and vendor contracts.
Commentary
As the speakers discussed, there are a variety of risks which are associated with, and may differ by, AI use case. Each AI use case and deployment is different. The member firms will need to have governance programs and processes in place to assess each AI use case, determine the attendant risks, and implement oversight processes to mitigate and manage these risks. In addition, in many instances member firms will be leveraging vendors for the development and deployment of this technology. The speakers reiterated that while a member firm may delegate a function, it cannot delegate the responsibility. The vendor management functions in each of the member firms will need to ensure they understand the technology and implement necessary and appropriate contractual provisions to manage and oversee these vendors and the risks they pose.