Tag Archives: Marc Gilman

Use of Artificial Intelligence in CFTC-Regulated Markets

by Marc Gilman

Photo of the author

Photo courtesy of the author

On December 5, 2024, the U.S. Commodity Futures Trading Commission (the “CFTC,” or the “Commission”) staff issued an advisory related to the use of artificial intelligence (“AI”) by CFTC-registered entities and registrants (the “Advisory”). In tandem, two CFTC representatives – Chairman Rostin Behnam and Commissioner Kristin N. Johnson – released statements supporting the Advisory and offering thoughts about the current and future implications of AI on CFTC registrants. This blog post will summarize the contents of the Advisory as well as the related statements of the CFTC representatives to collect a set of practical considerations for designing CFTC compliance programs to meet evolving regulatory expectations for the use of AI. 

Continue reading →

The Dual Threat of Identity Theft Red Flags and Cybersecurity Deficiencies in FINRA and SEC Enforcement

by Marc Gilman

In the last few years, cybersecurity, with an emphasis on protection of customer data, has topped the exam priorities and risk alerts of both the Financial Industry Regulatory Authority (“FINRA”) and the Securities and Exchange Commission (the “SEC”).  And, as the global pandemic pushes the financial services industry into the second year of a work from anywhere business environment, the deployment and continued improvement of cybersecurity controls to secure customer and firm data are critical.

Perhaps it should come as no surprise that regulations underpinning cybersecurity practices are coming to the fore.  A case in point is the announcement of FINRA’s letter of Acceptance, Waiver, and Consent (“AWC”) with Supreme Alliance LLC (“Supreme”) in December 2020 for violations of the SEC’s Regulation S-ID, also known as the identity theft red flags rule, and FINRA Rule 2010.[1]  FINRA’s settlement with Supreme is significant as it potentially signals a more aggressive and meaningful focus on Reg S-ID, which saw its first major enforcement in 2018 when the SEC fined Voya Financial Advisors, Inc. $1 million for violating it as well as the SEC’s Reg S-P.[2] 

This post will analyze the unique fact pattern of Supreme and offer practical suggestions for compliance officers navigating the nuances of identity theft protection and cybersecurity in this new, remote work world.

Continue reading →