Can an n8n AI Agent Draft Reg BI Recommendations? Supervision Controls for Broker-Dealers

Why this is a supervision question, not a tooling question

FINRA states that its rules are technology neutral. Securities laws and FINRA rules continue to apply when member firms use generative AI, just as they apply to any other tool. FINRA's 2026 oversight report says generative AI can implicate supervision, communications, recordkeeping and fair dealing, and points to Rule 3110, which requires a reasonably designed supervisory system tailored to the firm's business. Rule 3120 adds a supervisory control system that tests and verifies that those procedures are reasonably designed.

Reg BI applies when a broker-dealer or associated person recommends a securities transaction or investment strategy, including account recommendations, to a retail customer. The recommendation must be in the customer's best interest when made, without placing the firm's or the person's interest ahead of the customer's. The firm satisfies that standard by meeting four component obligations: Disclosure, Care, Conflict of Interest and Compliance.

Nothing in this framework changes because a model produced the first draft. The practical question is whether the firm can show that the draft passed through a supervised, evidenced process.

Where drafting ends and recommending begins

The first decision is definitional. Reg BI is triggered by a recommendation to a retail customer, and not every interaction a technology performs is a recommendation. The firm's own written procedures must say where drafted content becomes a recommendation, and who decides.

The safest design treats the agent as a proposer. It may assemble background, summarize account information the representative is already entitled to see, or prepare draft language for review. It does not select products, decide that a recommendation is in the customer's best interest, or send anything to a client. FINRA lists autonomy without human validation, and acting beyond intended scope, as agent risks. A written scope statement per agent, covering permitted purpose, data sources, tools and output types, is the starting control and should be approved before deployment.

Enforcing policy outside the agent

A recurring pattern in agent security guidance, including the OWASP AI Agent Security Cheat Sheet, is to treat the agent as a proposer and enforce authorization in a separate execution component outside the agent's context. That component independently validates scope, privilege and approval state before an action runs. A prompt instruction such as "do not recommend products" is a request to the model, not an enforced boundary.

This matters for supervision because a control the agent can talk its way around is hard to describe to an examiner. The same guidance recommends minimum tools per task, separate tool sets for different trust levels, and human oversight of high-impact actions.

A runtime enforcement layer is one way to implement this pattern. Trussed enforces policy in the execution path, applying allow, redact, block, rate limit or escalate for human approval to individual interactions and tool calls, and it generates audit-ready evidence from that enforcement. It operates at the level of interactions and tool calls. It does not provide transaction-level governance or end-to-end tracing of a workflow, and it does not decide whether a recommendation is suitable or in a customer's best interest. Those remain the firm's procedures and people.

What to verify about n8n itself

Compliance leaders should not assume that a low-code platform's defaults match the controls above. Before approving a pilot, ask the engineering team to demonstrate, rather than describe, how the deployment handles four points: credential and tool scoping per workflow, a human-approval step that cannot be bypassed, execution records that are retained and exportable, and where the platform runs, including whether it is self-hosted.

Where any of these is weak, the gap should be closed by a control outside the agent, not by relying on the agent's instructions. Re-test after every material change to prompts, tools, memory, retrieval, policies or model providers, since each can alter what the agent is able to do. Under Rule 3120 thinking, the controls themselves need testing and verification, not just the drafts.

Common questions from compliance teams

These questions address points not covered above.

• {"question":"Does human approval alone satisfy supervision expectations?","answer":"No. Approval is one control. FINRA expects a reasonably designed supervisory system, documented governance and a record of what occurred. A reviewer who sees only the final draft cannot tell what data the agent retrieved or which tools it called, so scope limits and evidence matter alongside approval."}
• {"question":"Does runtime enforcement replace our suitability and best-interest procedures?","answer":"No. Reg BI's Compliance and Conflict of Interest obligations require the firm's own written policies and procedures. Runtime enforcement applies those policies to interactions and tool calls and produces evidence. It does not make the best-interest determination."}
• {"question":"Is the 2023 SEC proposal on predictive data analytics binding?","answer":"As of November 2026, it should be treated as a proposal, not as binding. It does note that firms using technology to make certain recommendations to retail customers must maintain written policies reasonably designed to achieve Reg BI compliance."}