ACFCS Special Contributor Report: When it Comes to Oversight of Securities Space, Are Regulators Ready for AI-Enabled, Algorithmic Financial Crime?

In 2012, Knight Capital Group crumbled, all because of a software glitch. The company lost $440 million when its computer placed millions of erroneous orders. This went on for 45 minutes before the trading “kill switch” was flipped.  

One would think Knight Capital Group’s use of computer trading software would cause traders and groups to proceed with caution. However, high-frequency trading bots, AI investment advisors, and auto arbitrage systems are now standard in the field.  

Not only do these computer-based programs operate at an unprecedented speed, but they also work in the shadows.  

The Securities and Exchange Commission (SEC) and Financial Industry Regulatory Authority (FINRA) currently enforce laws written before technological advancements in trading.  

These laws are designed to detect human-based fraud. Now, with machines making financial decisions, being taught how to perform trades (and subsequently, how to be deceptive), the issue that regulators must grapple with is whether they can recognize when machines break the law.  

This begs the question: how can any human regulator keep up with and comprehend these computer-based, artificial intelligence-enhanced (AI) programs?

Global threat actor groups supercharged by AI have seen international fraud figures explode, with some estimates of AI-enabled fraud quadrupling in just the last few years. 

So how are regulators responding? 

The SEC has a Market Abuse Unit (MAU). The MAU is a specialized team that uses data to detect market manipulation and financial crimes. The unit relies heavily on human analysts. However, the MAU focuses on emerging technologies that can facilitate fraud and misconduct.  

The issue today is that the MAU faces a challenge many other government oversight bodies are wrestling with: creating software updates to keep pace and detect financial fraud schemes – that are designed to evade detection.

While the MAU has committed to combating computer-generated financial fraud, its sophistication and resources are likely not comparable to that of many private trading firms. Traders work on algorithms daily, editing and morphing the programs to achieve the maximum profits possible.  

The cold reality: The MAU likely can’t compete with the daily editing, tuning and pruning of such programs.  

The MAU will consistently play a game of catch-up, racing to edit its technology to detect fraud stemming from computer trading programs. If the MAU does not adopt technological advancements as fast as private trading firms, it will always be behind.  

Regulators will not be able to protect consumers from financial fraud if this is the case.  

Private firms have AIs running at what can feel like the speed of light, while regulators are still adopting what many consider dated, even antiquated technology.

First, the SEC needs to recognize and codify legislation that reflects this notion: any time you use certain automated pieces of technology that can think for themselves and take decision-making out of the hands of human traders, there is an immense risk.  

Coding, running and tuning an AI system that needs sufficient, accurate and reliable data inherently carries a risk.  

Machines malfunction, data can be faulty, and, oftentimes, it is hard to understand how complex models function. The SEC needs to approach legislation with this sentiment in mind.  

For instance, the SEC can mandate that firms register and disclose all of their trading algorithms – in essence create a regulatory key to view the secret sauce of their “black box.” This means that all trading algorithms will be thoroughly documented and submitted to regulators – though many trading firms and their third-party technology vendors may chafe at such a rule, stating the information is proprietary.  

Registration and disclosure are essentially a permit to operate the program. The SEC should require explainability of algorithms. If the individual software engineers cannot explain the model’s reasoning, then the company will not be considered to be in compliance.  

There is no excuse for not knowing the reasoning behind a decision that the algorithm acts upon. The requirement of explainability adds a layer of accountability to those deploying the algorithm.  

Although the MAU exists, it is not enough. The SEC should create a specific unit for AI trading systems. This unit should be able to test computer trading software to determine that it will not participate in financial fraud.

The SEC needs to also enforce liability for anonymous systems. Even if the system acts unintentionally, those benefiting from the system should be liable for its actions. There needs to be a fiduciary duty associated with the use of computer trading systems.  

Additionally, the SEC needs to create legislation that is fair to small and large industry players. It is important for the SEC to understand that not all industry players should be treated the same.  

With big industry players diving headfirst into autonomous systems, the SEC will begin to craft legislation that reflects the use of computer-based programs as the industry norm.  

This would put small industry players at a regulatory disadvantage. Small players will not be able to comply with the same regulatory framework as large firms due to cost.  

If an AI system recommends an investment that is quite risky to a retiree, who is responsible?

FINRA’s rules as they currently stand appear ill-suited for AI-generated recommendations and an after-the-fact blame game.  

FINRA has a Market Regulation Program. The program conducts market surveillance to identify potential market manipulation and fraudulent activities. To date, FINRA’s Market Regulation Program detects fraudulent activities such as wash trades, layering, and spoofing. However, with the use of AI, a new issue arises: how can FINRA detect newly invented AI market distortions?  

FINRA’s current tools would be hard-pressed to detect machine-learned fraudulent activity. On top of that, AI algorithms alter their behavior to avoid detection (as they will optimally operate in the shadows).  

FINRA fines firms, traders, and brokers who conduct fraudulent activity. But, what can FINRA do to an algorithm?  

The firms, traders, and brokers could simply claim that the AI model learned the fraudulent behavior “on its own.” This dynamic could allow firms, traders, and brokers to escape accountability for the actions of their AI algorithms. 

Similar to the SEC, FINRA can require AI and algorithmic registration. FINRA can require firms, traders, and brokers to register material algorithms.

Registration of such algorithms can include:  

1. 1. purpose and risk,  
   2. data sources used for model training, and  
   3. risk controls and human oversight.  

This registration does not require revealing proprietary codes; rather, FINRA would just need risk factors, controls, and accountability structures.  

FINRA can create an “AI and Algorithmic Supervision Rule.” FINRA can require firms to designate an individual responsible for each AI system or algorithm.  

Stress testing should be required on a regular basis. Protocols for shutting down the system should be mandated. This means every system needs to have a “kill switch.”  

FINRA could also create a regulatory AI testing lab. This would be modeled on how the Federal Aviation Administration (FAA) tests flight software for planes.

Firms can submit AI models for simulation. The analysts at the lab will be able to discern how the model behaves under certain market conditions. Any system that poses a high risk to the industry can be flagged, approved under certain circumstances, or not allowed at all. FINRA must make clear that firms cannot blame the autonomous learning aspect of AI algorithms to circumvent responsibility.  

FINRA needs to firmly state that anyone who uses an algorithm is accountable for its actions. This closes the “loophole” of firms skirting responsibility by blaming the AI algorithm itself.

The next wave of financial crime will not look like unscrupulous brokers. It will look like autonomous computers acting in ways that humans cannot comprehend.

AI is reshaping the market faster than the SEC and FINRA can update their regulations.  

Unless the SEC and FINRA devote specific units and a significant amount of development to combat computer-generated financial crime, it will always be playing catch-up.  

Today, the SEC and FINRA are not just responsible for overseeing traders; they are also responsible for overseeing the programs they deploy. If the SEC and FINRA do not act, we will likely witness the next flash crash occur (this time, in milliseconds) in the near future.