Financial-services compliance
Financial-services compliance — multi-regulator frame (SEC, FINRA, FinCEN, OCC, CFPB, SOX, GLBA), evidence shape per regime.
Financial-services AI sits across the most fragmented regulatory landscape on the platform. Five primary regimes; evaluation evidence requirements differ for each.
Regulatory frame
SEC / FINRA
Investment advisory, broker-dealer, customer recommendations
Suitability evidence, disclosure presence, audit-trail of recommendation rationale
FinCEN (BSA/AML)
Customer onboarding, transaction monitoring, sanctions screening
Sanctions-screening recall, document-authenticity rate, SAR narration faithfulness
OCC / FRB / FDIC
Banking-product underwriting, loan origination, fair-lending
Fair-lending disparity audits, model-risk management documentation
CFPB
Consumer-facing financial products, fair-treatment
Disparity ratios, complaint-rate correlations, plain-language requirements
SOX
Public-company financial-data trading, audit narration
Immutable decision-rationale logs
GLBA
Customer non-public personal information handling
Privacy boundary, encryption, access controls
State (DFS, DOI)
State-licensed lenders / insurers / broker-dealers
State-by-state varies; market-conduct examination prep
SEC / FINRA
Stratix evaluation evidence supports:
Suitability records — every recommendation tied to an evaluation that scored it against the customer's risk profile
Disclosure-presence audits — substring-scorer evidence that required disclaimers appeared
Bias-toward-proprietary-products scorer — evidence that recommendations are not skewed toward house funds
Recommendation-rationale audit trail — judge results referencing specific market data
Recent FINRA sweeps include $1M-$50M fines for suitability violations in robo-advisor products. Documenting evaluation-driven controls reduces enforcement exposure.
FinCEN BSA/AML
Sanctions coverage — 100% recall on every input name against the active sanctions list
Document authenticity — image-tampering detection rate
SAR-narration faithfulness — judge agreement that filed SARs accurately describe the underlying transaction
Adverse-media coverage — relevance scores for media hits
Per-violation penalties run $1M-$1B in BSA/AML enforcement actions. Stratix evidence is auditor-ready.
OCC / FRB / FDIC fair lending (ECOA)
Cross-cutting concern for any AI in lending decisions:
Disparity ratios below 1.25× across all protected-class proxies
Model risk management — every model version cited in a decision tied to its evaluation history
Override rates — when humans override AI recommendations, track for systemic-bias signal
Stratix supports per-segment disparity computation via custom code graders. See the fair-lending platform pattern.
CFPB consumer protection
Plain-language evaluation, complaint-rate monitoring, and accessibility compliance for digital products. Reading-level scorer + cultural-appropriateness judges support consumer-facing applications.
SOX trading compliance
Immutable narration of every trading decision. Stratix evaluation IDs cited in audit trails. Audit-friendly evaluation history retention available on Enterprise tier.
GLBA privacy
Customer non-public personal information must not appear in trace bodies unless tenant-isolation and encryption controls are in place. Recommended setup:
Enterprise tier with executed DPA
PII-redaction at trace ingestion (your code, not Stratix)
SSO with role-based access
Configurable audit retention matching your record-retention policy
State regulators (DFS, DOI)
State-by-state variance. New York DFS Cybersecurity Regulation (Part 500) is among the strictest; California CCPA/CPRA adds privacy obligations. State market-conduct examinations frequently trigger broader regulatory inquiries.
Recommended setup
Enterprise tier with executed DPA and BAA-equivalent contractual terms
SSO with role-based access; separate roles for compliance / risk / engineering / analyst
Trace evaluations citing evaluation IDs in release-notes / audit packages
Quarterly disparity audit with compliance signoff
Per-region data residency where state law requires
Audit-log retention matching the longest applicable record-retention requirement
See also
Last updated
Was this helpful?