> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-2.md). # Financial-services compliance Financial-services AI sits across the most fragmented regulatory landscape on the platform. Five primary regimes; evaluation evidence requirements differ for each. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | -------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | **SEC / FINRA** | Investment advisory, broker-dealer, customer recommendations | Suitability evidence, disclosure presence, audit-trail of recommendation rationale | | **FinCEN (BSA/AML)** | Customer onboarding, transaction monitoring, sanctions screening | Sanctions-screening recall, document-authenticity rate, SAR narration faithfulness | | **OCC / FRB / FDIC** | Banking-product underwriting, loan origination, fair-lending | Fair-lending disparity audits, model-risk management documentation | | **CFPB** | Consumer-facing financial products, fair-treatment | Disparity ratios, complaint-rate correlations, plain-language requirements | | **SOX** | Public-company financial-data trading, audit narration | Immutable decision-rationale logs | | **GLBA** | Customer non-public personal information handling | Privacy boundary, encryption, access controls | | **State (DFS, DOI)** | State-licensed lenders / insurers / broker-dealers | State-by-state varies; market-conduct examination prep | ## SEC / FINRA Stratix evaluation evidence supports: * **Suitability records** — every recommendation tied to an evaluation that scored it against the customer's risk profile * **Disclosure-presence audits** — substring-scorer evidence that required disclaimers appeared * **Bias-toward-proprietary-products** scorer — evidence that recommendations are not skewed toward house funds * **Recommendation-rationale audit trail** — judge results referencing specific market data Recent FINRA sweeps include $1M-$50M fines for suitability violations in robo-advisor products. Documenting evaluation-driven controls reduces enforcement exposure. ## FinCEN BSA/AML * **Sanctions coverage** — 100% recall on every input name against the active sanctions list * **Document authenticity** — image-tampering detection rate * **SAR-narration faithfulness** — judge agreement that filed SARs accurately describe the underlying transaction * **Adverse-media coverage** — relevance scores for media hits Per-violation penalties run $1M-$1B in BSA/AML enforcement actions. Stratix evidence is auditor-ready. ## OCC / FRB / FDIC fair lending (ECOA) Cross-cutting concern for any AI in lending decisions: * **Disparity ratios** below 1.25× across all protected-class proxies * **Model risk management** — every model version cited in a decision tied to its evaluation history * **Override rates** — when humans override AI recommendations, track for systemic-bias signal Stratix supports per-segment disparity computation via custom code graders. See the [fair-lending platform pattern](/4.2-industry-use-cases/pattern-1.md). ## CFPB consumer protection Plain-language evaluation, complaint-rate monitoring, and accessibility compliance for digital products. Reading-level scorer + cultural-appropriateness judges support consumer-facing applications. ## SOX trading compliance Immutable narration of every trading decision. Stratix evaluation IDs cited in audit trails. Audit-friendly evaluation history retention available on Enterprise tier. ## GLBA privacy Customer non-public personal information must not appear in trace bodies unless tenant-isolation and encryption controls are in place. Recommended setup: * Enterprise tier with executed DPA * PII-redaction at trace ingestion (your code, not Stratix) * SSO with role-based access * Configurable audit retention matching your record-retention policy ## State regulators (DFS, DOI) State-by-state variance. New York DFS Cybersecurity Regulation (Part 500) is among the strictest; California CCPA/CPRA adds privacy obligations. State market-conduct examinations frequently trigger broader regulatory inquiries. ## Recommended setup 1. Enterprise tier with executed DPA and BAA-equivalent contractual terms 2. SSO with role-based access; separate roles for compliance / risk / engineering / analyst 3. Trace evaluations citing evaluation IDs in release-notes / audit packages 4. Quarterly disparity audit with compliance signoff 5. Per-region data residency where state law requires 6. Audit-log retention matching the longest applicable record-retention requirement ## See also * [Industry pattern: fair-lending platform pattern](/4.2-industry-use-cases/pattern-1.md) * [Enterprise](/4.2-industry-use-cases/financial-services.md) * [Security and compliance](/4.2-industry-use-cases/financial-services.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.layerlens.ai/more-in-this-section-2/compliance-2.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.