SEC warns firms to get their AI house in order

The SEC might have stepped back from a new proposal meant to make advisors responsible for  eliminating conflicts of interest in AI-generated investing recommendations.

But artificial intelligence, machine learning and similar technologies remain top concerns for the industry watchdog, as evidenced by a report on examination priorities released Monday. Also high on the Securities and Exchange Commission's list of topics deserving special attention are dually registered advisory and brokerage firms, opaque and unconventional investment products and wealth managers that outsource certain functions to remote locations.

The SEC releases a report on its examination priorities every year to give firms a sense of what regulators are likely to be looking for if they come knocking on their doors. SEC examiners now pay a visit to every one of the more than 15,000 federally registered financial advisors at least once every seven years.

READ MORE:
The SEC's early regulatory warning shot and 6 other takeaways from its 2024 exam priorities
Triumphs and unfinished business: SEC Chair Gary Gensler's first three years
Advisors under regulatory scrutiny over single-day trade settlements
Compliance experts look to AI, tech to help with WhatsApp violations

Amy Lynch, the founder and president of the regulatory consultant FrontLine Compliance, noted there has been a push to increase the frequency of those exams.

"I think they're finally realizing that, because obviously the number of SEC-registered advisors keeps increasing, and they're not able to keep up with the increase, they need to shorten their exam cycles and try to find ways to hit more firms," Lynch said.

Another early release of exam priorities in October

 
For years, the SEC had followed the practice of releasing its exam priorities in January or February. This year marks the second in a row that the list has come out in October.

Clearly, the SEC is trying to give firms plenty of time to come into line with its compliance admonitions, said Steffen Hemmerich, the head of Mayer Brown's broker-dealer regulatory and compliance practice in the firm's New York office.

"I think they're really trying to be more proactive with this, communicating what they are looking for," Hemmerich said. "And also they want to be more transparent and more engaging with registrants. I think that's a good thing."

Lynch said the October announcement allows firms to align their compliance spending with the SEC's priorities.

"Now is when firms are deciding their budgets," she said. "And they may take a look at the priorities and decide, OK, here are the things you have to change in your compliance program, and these are the additional resources you need to do that."

Overpromising on AI and other concerns

Regarding artificial intelligence, the SEC said its enforcement division will be checking the accuracy of firms' public statements about their reliance on AI and similar systems. Regulators have warned in recent years of a type of misportrayal known as "AI-washing" — or making exaggerated claims about the uses for artificial intelligence — and have cracked down on firms that couldn't back up their promises. 

The SEC has separately proposed a new regulation that would make wealth managers responsible for eliminating or "negating" any conflicts of interest that might arise from their use of AI. But that proposal has been shelved in response to industry groups who complained its wording would seem to apply to even long-employed applications like spreadsheets. Still, the SEC's latest examination priority list says regulators remained concerned about how AI is being used in "portfolio management, trading, marketing and compliance."

Gamification and clients' best interest

Hemmerich said the SEC is more broadly interested in firms' digital engagement practices — or the myriad ways they deal with clients online. Regulators have expressed particular concern that online brokerages are "gamifying" their services, or giving investors intermittent digital nudges to encourage frequent trading that's not in their best interest.

"That was actually a hot topic back in 2021 and 2022," Hermmerich said. "That, of course, includes AI and the use of AI in connection with investor interactions. And now the SEC pointed out here, I think, two or three times in the report that they will be examining firms with respect to the use of digital engagement practices."

Speaking on Monday at a Securities Industry and Financial Markets Association event in New York, SEC Chairman Gary Gensler confirmed that remains a topic of great interest to the SEC. Gensler said firms generally understand they are under an obligation to look out for clients' best interests.

"Yet when it comes to brokers and investment advisors, are their algorithms optimizing just for the customer or also for the broker or advisor's interests?" he said. "Broker-dealers and investment advisors, regardless of whether they are interacting with customers the old-fashioned way with human thought or with algorithms, need to ensure they are not putting their own interest ahead of the interest of their customers."

Robert Cruz, the vice president of information governance for the compliance software company SMARSH, was at the SIFMA conference Monday and heard Gensler's speech. He said regulators really seem intent on learning how advisors are using new technologies.

"What kind of actions are these things enabling?" Cruz said. "Is it gamification? Or is it possibly misleading investors? They are really focusing on how people are using the tools and potentially misusing them."

Third-party vendors and the risks of outsourcing

Lori Weston, the director of product and strategy at STP Investment Services, said the concerns extend to third-party firms who might use AI to provide outsourced services to advisory firms. This is particularly true for vendors who provide help with investment selection and management.

"Advisors should review their overall policies regarding the supervision and oversight of all third-party providers, with a particular focus on the third-party provider's use of AI," Weston said. "In today's interconnected environment, AI risks can infiltrate a firm's operations via third-party vendors."

The outsourcing of services is also of a more general concern to the SEC. Its list of examination priorities warns that firms that use a large network of remote third-party providers could be faced with questions about whether they're doing enough to keep tabs on those contractors.

That ties in directly to cybersecurity. The regulator's enforcement division plans to "consider cybersecurity risks and resiliency goals associated with third-party products, sub-contractors, services and any information technology (IT) resources used by the business without the IT department's approval, knowledge or oversight, or non-supported infrastructure," according to the examination priority report.

Cybersecurity and data breaches

The SEC also mentions revisions adopted in May to its information privacy rule known as Regulation S-P. Among other things, the changes require firms to report data breaches to clients within 30 days.

As is usual with many such rules, advisors have a grace period with the new requirements.  Advisory firms with $1.5 billion or more under management have 18 months to come into compliance; smaller firms have two years.

"In preparation for the compliance date of the Commission's amendments to Regulation S-P,5 the Division will engage with firms during examinations about their progress in preparing to establish incident response programs reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information," according to the SEC.

Homing in on hybrids: dually registered firms

The SEC has long had concerns about wealth managers that are dually registered as investment advisors and broker-dealers. Such firms employ about 45% of the more than 713,000 advisors and brokers registered at the federal level and constitute one of the  fastest-growing segments of the industry in recent years.

Regulators have been particularly keen to make sure firms with both an advisory and brokerage are being upfront with clients about which of the two business models they are dealing with at any given time. That concern has grown only stronger as many firms move assets out of brokerage accounts, where they produce commissions for individual trades, into fee-generating advisory accounts.

Many wealth managers have come to advisory accounts whose fees are set as a percentage of assets under management as a means of securing a steady stream of income. But regulators want to make sure firms are providing services in return.

"They're worried about these 'set it and forget it' types of accounts, and if firms are just making fees off of them and no one is paying attention," Lynch said. "They want to make sure that clients are getting what they are paying for, which means they're being actively managed."

Expensive and illiquid complex investment vehicles

Regarding  unconventional investment products, the SEC said it will be paying particular attention to instruments that are high cost products, illiquid and difficult-to-value assets and prone to fluctuate along with interest rates. Lynch noted that investment vehicles tied to commercial real estate are mentioned several times in the report.

Owners of these types of properties have faced increased borrowing costs amid high interest rates in recent years and struggled to refinance debt used to finance their initial purchases.

"The office market in particular got hit in many areas of the country," Lynch said. "And these buildings and these managers and the owners of these buildings have suffered because of a lack of occupancy."