> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-2.md).

# Financial-services compliance

Financial-services compliance — multi-regulator frame (SEC, FINRA, FinCEN, OCC, CFPB, SOX, GLBA), evidence shape per regime.

Financial-services AI sits across the most fragmented regulatory landscape on the platform. Five primary regimes; evaluation evidence requirements differ for each.

## Regulatory frame

| Regime               | Applies when                                                     | Evaluation-evidence shape                                                          |
| -------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| **SEC / FINRA**      | Investment advisory, broker-dealer, customer recommendations     | Suitability evidence, disclosure presence, audit-trail of recommendation rationale |
| **FinCEN (BSA/AML)** | Customer onboarding, transaction monitoring, sanctions screening | Sanctions-screening recall, document-authenticity rate, SAR narration faithfulness |
| **OCC / FRB / FDIC** | Banking-product underwriting, loan origination, fair-lending     | Fair-lending disparity audits, model-risk management documentation                 |
| **CFPB**             | Consumer-facing financial products, fair-treatment               | Disparity ratios, complaint-rate correlations, plain-language requirements         |
| **SOX**              | Public-company financial-data trading, audit narration           | Immutable decision-rationale logs                                                  |
| **GLBA**             | Customer non-public personal information handling                | Privacy boundary, encryption, access controls                                      |
| **State (DFS, DOI)** | State-licensed lenders / insurers / broker-dealers               | State-by-state varies; market-conduct examination prep                             |

## SEC / FINRA

Stratix evaluation evidence supports:

* **Suitability records** — every recommendation tied to an evaluation that scored it against the customer's risk profile
* **Disclosure-presence audits** — substring-scorer evidence that required disclaimers appeared
* **Bias-toward-proprietary-products** scorer — evidence that recommendations are not skewed toward house funds
* **Recommendation-rationale audit trail** — judge results referencing specific market data

Recent FINRA sweeps include $1M-$50M fines for suitability violations in robo-advisor products. Documenting evaluation-driven controls reduces enforcement exposure.

## FinCEN BSA/AML

* **Sanctions coverage** — 100% recall on every input name against the active sanctions list
* **Document authenticity** — image-tampering detection rate
* **SAR-narration faithfulness** — judge agreement that filed SARs accurately describe the underlying transaction
* **Adverse-media coverage** — relevance scores for media hits

Per-violation penalties run $1M-$1B in BSA/AML enforcement actions. Stratix evidence is auditor-ready.

## OCC / FRB / FDIC fair lending (ECOA)

Cross-cutting concern for any AI in lending decisions:

* **Disparity ratios** below 1.25× across all protected-class proxies
* **Model risk management** — every model version cited in a decision tied to its evaluation history
* **Override rates** — when humans override AI recommendations, track for systemic-bias signal

Stratix supports per-segment disparity computation via custom code graders. See the [fair-lending platform pattern](/4.2-industry-use-cases/pattern-1.md).

## CFPB consumer protection

Plain-language evaluation, complaint-rate monitoring, and accessibility compliance for digital products. Reading-level scorer + cultural-appropriateness judges support consumer-facing applications.

## SOX trading compliance

Immutable narration of every trading decision. Stratix evaluation IDs cited in audit trails. Audit-friendly evaluation history retention available on Enterprise tier.

## GLBA privacy

Customer non-public personal information must not appear in trace bodies unless tenant-isolation and encryption controls are in place. Recommended setup:

* Enterprise tier with executed DPA
* PII-redaction at trace ingestion (your code, not Stratix)
* SSO with role-based access
* Configurable audit retention matching your record-retention policy

## State regulators (DFS, DOI)

State-by-state variance. New York DFS Cybersecurity Regulation (Part 500) is among the strictest; California CCPA/CPRA adds privacy obligations. State market-conduct examinations frequently trigger broader regulatory inquiries.

## Recommended setup

1. Enterprise tier with executed DPA and BAA-equivalent contractual terms
2. SSO with role-based access; separate roles for compliance / risk / engineering / analyst
3. Trace evaluations citing evaluation IDs in release-notes / audit packages
4. Quarterly disparity audit with compliance signoff
5. Per-region data residency where state law requires
6. Audit-log retention matching the longest applicable record-retention requirement

## See also

* [Industry pattern: fair-lending platform pattern](/4.2-industry-use-cases/pattern-1.md)
* [Enterprise](/4.2-industry-use-cases/financial-services.md)
* [Security and compliance](/4.2-industry-use-cases/financial-services.md)
* [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md)