Using LLMs to Disposition Trade Surveillance Alerts: FINRA Supervision and Recordkeeping Requirements

Which obligations apply when an LLM assists alert review

No FINRA rule is written specifically for LLM alert disposition. The obligations come from existing rules applied to a new tool. Regulatory Notice 24-09 states that FINRA's rules are technology neutral and, with the securities laws generally, continue to apply when member firms use generative AI or LLMs. That holds whether the firm builds a tool for proprietary use or uses a third party's technology, including embedded features in existing products. The notice also says the applicable rules depend on how the firm deploys the technology, and that a firm should evaluate a tool before deployment and confirm it can still comply with the rules that govern the business use.

The notice specifically contemplates surveillance use: generating reports with summaries for the firm's human compliance personnel of potential evidence of malfeasance, such as market abuse or insider trading. It is guidance, not a new rule.

Rule 3110 is the supervision anchor. FINRA's 2025 Annual Regulatory Oversight Report says it requires a process to review securities transactions that is reasonably designed to identify trades that may violate insider trading and manipulation prohibitions, and that the firm must promptly investigate any such trade. An LLM that shapes how alerts are reviewed becomes part of that process.

Rule 4511 is the recordkeeping anchor. As of November 2026, it requires members to make and preserve books and records required under FINRA rules, the Exchange Act and applicable Exchange Act rules. Records with no specified period must be kept for at least six years, and required records must be preserved in a format and media that complies with SEC Rule 17a-4. Retention periods and format details should be confirmed with counsel against the full text of Rule 17a-4.

AI-assisted recommendation versus human-approved disposition

The distinction that matters most to an examiner is who decided. If the LLM drafts a summary and a recommended disposition and a named reviewer approves or changes it, the human remains accountable and the LLM is a supporting tool. If the LLM can close an alert on its own, the firm has to explain how that fits a supervisory system built around human review. The Notice 24-09 framing of summaries for human compliance personnel is consistent with the first pattern. It does not prescribe an approval mechanism, so the firm should define and document its own standard.

Written supervisory procedures should name the LLM-assisted step, state that the LLM summarizes, triages or recommends, and identify who makes the disposition. Supervisory testing should then cover that step, not only the surrounding workflow.

Timing and documentation deserve particular attention. FINRA's 2026 Annual Regulatory Oversight Report lists surveillance deficiencies that include not performing timely reviews of alerts or exception reports, not documenting alert review findings, and failing to periodically evaluate the adequacy of surveillance controls and thresholds. An LLM can reduce the first two exposures if it speeds review and prompts documentation. It can also create them if reviewers approve summaries without recording their own findings, or if timestamps cannot be shown.

Runtime enforcement versus after-the-fact review

A prompt that tells an LLM not to close alerts is an instruction, not a control. A control that holds is enforced in the execution path: the system decides, at the moment of each interaction or tool call, whether to allow it, redact sensitive data, block it, or escalate it for human approval. Any action that would close or disposition an alert is blocked or routed to a named approver. Data and tool access is scoped so the LLM sees only what the review requires.

The practical benefit is evidence. When enforcement happens at runtime, the record of what the LLM received, what it produced, what it was permitted to do and who approved the result is created at the time, per interaction. Reconstructing a disposition months later from application logs and reviewer recollection is slower and harder to defend.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, at the level of individual interactions and tool calls, and generates audit-ready evidence from that enforcement. It can be self-managed in the customer's cloud with configurable retention and data residency, which bears on how a firm aligns evidence with its own retention schedule. Insurance, also a regulated financial sector, is where Trussed is deepest. The platform has run 18+ months in continuous production in a regulated enterprise at 99.95% uptime on live traffic.

What runtime controls do not cover

Runtime enforcement and per-interaction evidence address one slice of the problem. They do not replace the firm's own surveillance logic, including parameters, thresholds and coverage. The 2026 oversight report treats the adequacy of surveillance controls and thresholds as a separate firm responsibility. They also do not replace model risk management. Validation, monitoring and performance testing of the LLM are a distinct workstream, and examiners may reasonably ask about both. Transaction-level governance is likewise outside the scope of controls that operate on individual interactions and tool calls.

Two tradeoffs are worth planning for. Escalation for human approval adds reviewer effort, so the firm should decide which actions truly require it rather than escalating everything. Narrow data scoping reduces exposure but can limit how useful an LLM summary is. Both choices should be documented as supervisory design decisions.

Regulatory Notice 25-07 notes that members' use of technological capabilities has raised novel questions about complying with SEC and FINRA recordkeeping rules. The treatment of AI-generated records is an area to monitor, and FINRA has said it may issue further guidance on specific use cases.