FINRA 2025 Regulatory Outlook (EY)

Summary

• FINRA has observed an increase in cyber attacks and outages at third-party vendors used by member firms.p.2
• Firms are encouraged to discuss with their Risk Monitoring Analysts potential bad actors and changes to third-party AI systems.p.2
• FINRA advises firms to be proactive in establishing third-party risk management policies, such as assessments and contingency plans.p.2
• FINRA is concerned that the speed to market of AI may cause firms to overlook accuracy, bias, exploitation by bad actors and regulatory compliance.p.2
• New account fraud increasingly involves malicious use of GenAI to create synthetic IDs and falsified customer information, including deepfake media.p.2
• Digital boiler room schemes use chat rooms and social media to lure investors into opening accounts.p.2

Key insights

1. Firms are obligated to maintain supervisory procedures and conduct ongoing due diligence on third-party vendors.p.2
2. Firms should consider risks from third-party vendors' use of GenAI, such as leakage of personally identifiable information and proprietary information.p.2
3. FINRA views AI from a technologically neutral stance and expects firms to test before deploying, incorporate controls and include all relevant stakeholders.p.2
4. FINRA continues to focus on Customer Identification Program and Customer Due Diligence efforts to manage customer information.p.2
5. Automated customer onboarding and maintenance tools should be calibrated and tested accordingly.p.2
6. FINRA reports an increase in digital boiler room schemes targeting investors through social media.p.2