Making Copilot Studio agents ready for FINRA: pre-send review of customer communications

What FINRA expects of AI-generated customer communications

FINRA describes its rules as technology neutral. Regulatory Notice 24-09 states that they apply to generative AI whether a tool is built in-house or provided by a third party, including embedded features in existing third-party products. A firm cannot treat a platform-provided agent as outside its supervisory obligations. FINRA also expects firms to evaluate GenAI tools before deployment.

Two rules do most of the work for customer communications. Rule 2210 defines communications as correspondence, retail communications and institutional communications. Correspondence is any written, including electronic, communication distributed or made available to 25 or fewer retail investors within any 30 calendar-day period. An appropriately qualified registered principal must approve each retail communication before the earlier of its use or its filing with FINRA's Advertising Regulation Department. Rule 2210 also requires content that is fair and balanced, based on fair dealing and good faith, and that includes the material facts or qualifications needed so it is not misleading. These standards apply regardless of medium.

Rule 3110(b)(4) requires supervisory procedures for review of incoming and outgoing written, including electronic, correspondence. A registered principal must conduct the review and evidence it in writing, electronically or on paper. Procedures must suit the firm's business, size, structure and customers, and firms apply risk-based principles to decide how much additional review is needed. This reflects FINRA's rules as of November 2026.

Defining allow, redact, block and escalate

Each outcome should be defined in policy before the agent goes live, with an owner and a rationale. The definitions below are a starting point. Firms set the thresholds based on their own business and risk assessment.

For messages that pass automated policy checks, the firm still has to decide how they fit its supervisory procedures. Under Rule 3110, risk-based principles determine the extent of review, so document why some categories are reviewed before sending and others are sampled afterward.

• Allow: Content meets policy, the category does not require prior principal approval, and the firm's supervisory procedures cover review of the communication. The decision is still recorded.
• Redact: The message is acceptable once sensitive customer or confidential firm data is removed. The record shows what was removed.
• Block: The content conflicts with a policy rule, such as misleading or promissory claims, or lacks a required disclosure that cannot be added automatically. Nothing is sent.
• Escalate: The communication needs a registered principal, for example because it is a retail communication requiring approval before use, or because the rules cannot settle the case.

Evaluating runtime enforcement, and where Trussed fits

A compliance or model risk team assessing any runtime approach should ask five questions. Can it act before the send executes, and which channels and tool calls does it cover? Does it produce allow, redact, block and escalate outcomes, with escalations routed to a registered principal and written evidence of review? Does the evidence record include the draft, decision, reviewer, edits, final content and date, and can it be exported for examiners? Where is it deployed, and what are its retention and data residency terms? How does it fit the firm's model risk management, technology governance and pre-deployment evaluation? Regulatory Notice 24-09 says that if GenAI is used within the supervisory system itself, policies should cover model risk management, data privacy and integrity, reliability and accuracy.

Trussed is runtime control for consequential AI. It enforces policy in the execution path of agent interactions and tool calls, with allow, redact, block, rate limit and escalate-for-human-approval outcomes, and it generates audit-ready evidence from that enforcement. It is deployed self-managed in the customer's cloud, with configurable retention and data residency. Enforcement applies to individual interactions and tool calls. Trussed has run continuously in production in a regulated enterprise for more than 18 months, and insurance is the regulated financial sector where it is deepest. Trussed does not provide FINRA certification and cannot guarantee compliance. The firm's supervisory system and its registered principals remain responsible for meeting FINRA requirements.