FINRA's AI Trading Agent Rules: What the 2026 Report Says, and Who It Binds
FINRA's 2026 report names six risks of AI agents and asks firms to control them. The obligations land on your broker, not on you. What that means.
FINRA’s 2026 Annual Regulatory Oversight Report added a standalone GenAI section — marked NEW FOR 2026 — that names AI agents as an emerging risk and lists six specific ways they can go wrong. Every obligation in it falls on FINRA member firms, not on the retail trader pointing an agent at a broker’s API. If you connect an AI agent to a brokerage account, nothing in that report supervises you; what reaches you is whatever controls your broker builds in response to it.
That distinction is the whole piece, and it is missing from almost every treatment of this document: the compliance press writes for the firm, the AI press writes for the user, and neither reads the other. Everything below is read from the report itself, published 9 December 2025 and fetched from finra.org on 22 September 2026.
What the report actually is
The 2026 report runs to 90 pages and describes itself, in its own introduction, as giving “FINRA member firms (‘firms’) with insight into findings from FINRA’s regulatory operations programs.” Its How to Use This Report page is blunter still: the report “is intended to be just one of the tools a firm can use to help inform the development and operation of its compliance program; it does not represent a complete inventory of regulatory obligations.”
It is not rulemaking and carries no binding force of its own. What binds is the underlying rule it points at, and the GenAI section points at one in particular: “Pursuant to FINRA Rule 3110 (Supervision), a member firm must have a reasonably designed supervisory system tailored to its business.”
The framing FINRA opens the section with matters more than the individual risks:
“FINRA’s rules—which are intended to be technologically neutral—and the securities laws more generally, continue to apply when firms use GenAI or similar technologies in the course of their businesses, just as they apply when firms use any other technology or tool.”
That is a regulator saying, in effect, that nothing new is required because nothing old stopped applying.
It is also worth knowing how much of the report this is. Computed from the document’s own table of contents — each topic area running from its start page to the next one’s — the new GenAI section occupies 5 pages of 90, ahead only of the crypto section:
# Illustrative — the shape of the page-span calculation, from the PDF's own
# table of contents (finra.org, 2026 report, 90 pages, read 2026-09-22).
toc = [("Financial Crimes Prevention", 6), ("GenAI - NEW FOR 2026", 24),
("Firm Operations", 29), ("Member Firms' Nexus to Crypto", 41),
("Communications and Sales", 45), ("Market Integrity", 61),
("Financial Management", 75), ("Appendix", 85)]
spans = {a: b_start - a_start for (a, a_start), (_, b_start) in zip(toc, toc[1:])}
spans["GenAI - NEW FOR 2026"] # -> 5A new five-page section is a signal, not an emergency. Read it as the regulator opening a file, not closing one.
The six risks FINRA names, verbatim
The report defines an AI agent as a system “capable of autonomously performing and completing tasks on behalf of a user” that can “interact within an environment, plan, make decisions and take action to achieve specific goals without predefined rules or logic programming.”
It then lists six risks that “could result in adverse impacts to investors, firms or the markets.” These are FINRA’s own headings and its own words, and the third column is ours — who is positioned to do anything about it when the agent is yours and the account is your broker’s:
| FINRA’s risk heading | FINRA’s description | Who can actually control it |
|---|---|---|
| Autonomy | “AI agents acting autonomously without human validation and approval” | You — nobody else sets your approval loop |
| Scope and Authority | “Agents may act beyond the user’s actual or intended scope and authority” | The broker, via account-level permissions |
| Auditability and Transparency | “Complicated, multi-step agent reasoning tasks can make outcomes difficult to trace or explain” | Shared — your logs, their trade records |
| Data Sensitivity | “Agents operating on sensitive data may unintentionally store, explore, disclose or misuse sensitive or proprietary information” | Your AI provider, outside the broker entirely |
| Domain Knowledge | “General-purpose AI agents may lack the necessary domain knowledge to effectively and consistently carry out complex and industry-specific tasks” | You, in your choice of model and tooling |
| Rewards and Reinforcement | “Misaligned or poorly designed reward functions could result in the agent optimizing decisions that could negatively impact investors, firms or markets” | You, in how the objective is written |
Read down the third column and the shape of the problem is obvious. Four of the six sit with the user or the user’s AI provider, and only one sits squarely with the broker. FINRA’s report is addressed to the party holding the smallest share of the surface.
What FINRA asks firms to consider
The section closes with four considerations for firms “exploring and developing AI agents,” quoted in full because they are the closest thing here to a specification: “how to monitor agent system access and data handling; where to have ‘human in the loop’ agent oversight protocols or practices; how to track agent actions and decisions; or how to establish guardrails or control mechanisms to limit or restrict agent behaviors, actions or decisions.”
Note the verbs. Monitor, track, restrict. Those are the things a broker builds into the account, and they are exactly what you can inspect before connecting anything.
What this looks like from the retail side
Turn FINRA’s language around and it becomes a checklist you can run against your own broker’s public pages, before you connect an agent to anything.
Robinhood’s agentic-trading page, read live on 22 September 2026, is a useful specimen because it is unusually explicit. On what it does provide: “Fund your account with an amount reserved for your agent’s trades,” with notifications on each trade and “the option to disconnect anytime from directly in the app.” That is FINRA’s “guardrails or control mechanisms” and “human in the loop,” implemented as account structure.
On what it does not provide, the same page is equally plain:
“Robinhood does not control, supervise, monitor, recommend, or audit these AI agents. Once your data is shared with an AI provider of your choice, it leaves Robinhood’s security environment and is governed by that provider’s terms, not ours. You assume all risk for orders placed by your AI agent for execution and for any use of your data by third-party AI providers.”
And on the trading itself: “Agentic trading involves significant risk, including the possible loss of your entire investment. AI agents can make errors, misinterpret instructions, act on incomplete or outdated information, and may behave in unexpected ways.”
Read the two together and the architecture is coherent, and it matches the table above almost line for line. The broker bounds Scope and Authority — the one risk it is positioned to bound — and then states that Autonomy, Data Sensitivity, Domain Knowledge and Rewards are yours.
That boundary is not only a policy sentence; when this desk connected to Robinhood’s trading MCP server on 5 September 2026, the account separation showed up as a per-account permission field returned by the server itself, and the protocol surface behind it is documented in our read-only session with that server. How different connector architectures set that band — and why a bridge-style integration behaves differently from a broker-hosted one — is covered in broker MCP servers.
What we could not verify
A split is being reported among non-US brokers between those restricting AI integrations to read-only market data and those permitting agent execution, with regulatory obligations given as the reason. We could not locate the relevant first-party disclosure for the named firms this session, so no firm is named here and the claim is not repeated as fact. If the split is real it would be the first case of a broker publicly pricing the question this page is about, and it is worth watching.
Two further things the report does not do, which some coverage implies it does: it does not create a rule for AI agents, and it does not address retail customers using AI agents on their own accounts at all. Its subject throughout is member firms’ own use of GenAI.
The practical translation
Nothing in FINRA’s 2026 report protects a retail trader from their own agent. What it does is push member firms toward building monitoring, tracking and restriction into agent-facing products — and those controls, unlike the report, are things you can read and test before you connect anything.
So the checkable questions are the broker’s, not the regulator’s. What permission band does the account carry, and is it a property of the account or a promise about the agent? Can you disconnect from inside the app, without a support ticket? Does every order produce a notification you will actually see? And what does the broker say, in writing, about who carries the loss? On the page examined above all four are answered before you sign up — a standard worth holding others to, and one a second vendor fails outright when the same questions are put to both.
The rest is operational, and it is yours: the guardrails, the budget, the kill switch, the log you can reconstruct a bad afternoon from. That work is the subject of running an autonomous trading agent, and no regulator is going to do it for you.
Frequently asked questions
Does FINRA have rules for AI trading agents?
Not as such. FINRA’s 2026 Annual Regulatory Oversight Report, published 9 December 2025, added a GenAI section naming AI agents as an emerging risk, but the report is not rulemaking — it describes itself as “just one of the tools a firm can use.” The binding obligation it points at is the existing FINRA Rule 3110 (Supervision), and it applies to member firms.
Am I regulated by FINRA if I let an AI agent trade my account?
No. FINRA regulates its member firms — broker-dealers — not their retail customers. A trader connecting an agent to a broker’s API is not a FINRA member and is not supervised under Rule 3110. The obligations land on the broker; what reaches you is the controls the broker builds.
What risks does FINRA name for AI agents?
Six, in the report’s own headings: Autonomy, Scope and Authority, Auditability and Transparency, Data Sensitivity, Domain Knowledge, and Rewards and Reinforcement. It adds that the general GenAI risks — bias, hallucinations, privacy — “also remain present and applicable for GenAI agents and their outputs.”
What does FINRA expect brokers to do about AI agents?
The report suggests firms consider “how to monitor agent system access and data handling; where to have ‘human in the loop’ agent oversight protocols or practices; how to track agent actions and decisions; or how to establish guardrails or control mechanisms to limit or restrict agent behaviors, actions or decisions.” These are suggestions to firms, not requirements on users.
Is this legal or compliance advice?
No. This page is a reading of a public document, written for retail traders deciding whether to connect an agent to a broker. It is not legal, tax or compliance advice, and it is not a substitute for reading the report — which is free, 90 pages, and on finra.org.
Educational content, not financial, legal or compliance advice. Nothing here recommends any product, any broker or any trade. All FINRA quotations are read from the 2026 FINRA Annual Regulatory Oversight Report and its GenAI section on finra.org on 22 September 2026; all Robinhood quotations are read from the broker’s agentic-trading page on the same date. This site has no affiliate relationship with any broker named on this page and carries no earning link on it. Regulatory guidance and vendor disclosures both change — check the primary sources before relying on either.